diff --git a/rd/0761142efbda6c4b1e801223de723578.dll_.json b/rd/0761142efbda6c4b1e801223de723578.dll_.json
index 35946e3..5fc7999 100644
--- a/rd/0761142efbda6c4b1e801223de723578.dll_.json
+++ b/rd/0761142efbda6c4b1e801223de723578.dll_.json
@@ -1 +1 @@
-{"meta":{"timestamp":"2024-03-02T04:09:47.639170","version":"7.0.1","argv":["./tests/data/0761142efbda6c4b1e801223de723578.dll_","-j"],"sample":{"md5":"0761142efbda6c4b1e801223de723578","sha1":"47ae05c3da1efe957da80f03dfec9ecb9e1ebcfc","sha256":"94a9155bed7e9d2752f7d861a608ccfeade029379f734220c5a1bbc1b563ed0e","path":"C:/Users/HP/Documents/GitHub/capa/tests/data/0761142efbda6c4b1e801223de723578.dll_"},"flavor":"static","analysis":{"format":"pe","arch":"amd64","os":"windows","extractor":"VivisectFeatureExtractor","rules":["C:/Users/HP/Documents/GitHub/capa/rules"],"base_address":{"type":"absolute","value":1698430976},"layout":{"functions":[{"address":{"type":"absolute","value":1698435088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698435154}},{"address":{"type":"absolute","value":1698435178}},{"address":{"type":"absolute","value":1698435211}},{"address":{"type":"absolute","value":1698435289}},{"address":{"type":"absolute","value":1698435373}},{"address":{"type":"absolute","value":1698435386}},{"address":{"type":"absolute","value":1698435411}},{"address":{"type":"absolute","value":1698435429}},{"address":{"type":"absolute","value":1698435536}}]},{"address":{"type":"absolute","value":1698435584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698435679}}]},{"address":{"type":"absolute","value":1698435888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698435679}},{"address":{"type":"absolute","value":1698435888}},{"address":{"type":"absolute","value":1698435910}},{"address":{"type":"absolute","value":1698435920}}]},{"address":{"type":"absolute","value":1698435968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1698435984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1698436080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436112}}]},{"address":{"type":"absolute","value":1698436128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436128}}]},{"address":{"type":"absolute","value":1698436160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448186}},{"address":{"type":"absolute","value":1698448214}}]},{"address":{"type":"absolute","value":1698436176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436176}}]},{"address":{"type":"absolute","value":1698436240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436240}}]},{"address":{"type":"absolute","value":1698436272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436272}}]},{"address":{"type":"absolute","value":1698436320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436320}}]},{"address":{"type":"absolute","value":1698436352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436352}}]},{"address":{"type":"absolute","value":1698436400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436400}}]},{"address":{"type":"absolute","value":1698436432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698454547}},{"address":{"type":"absolute","value":1698454561}},{"address":{"type":"absolute","value":1698454564}},{"address":{"type":"absolute","value":1698454576}},{"address":{"type":"absolute","value":1698454608}},{"address":{"type":"absolute","value":1698454643}}]},{"address":{"type":"absolute","value":1698436448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436491}}]},{"address":{"type":"absolute","value":1698436512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698463210}},{"address":{"type":"absolute","value":1698463306}},{"address":{"type":"absolute","value":1698463319}},{"address":{"type":"absolute","value":1698463364}},{"address":{"type":"absolute","value":1698463479}},{"address":{"type":"absolute","value":1698463531}},{"address":{"type":"absolute","value":1698463586}},{"address":{"type":"absolute","value":1698463669}},{"address":{"type":"absolute","value":1698463772}},{"address":{"type":"absolute","value":1698463795}},{"address":{"type":"absolute","value":1698463858}},{"address":{"type":"absolute","value":1698463920}},{"address":{"type":"absolute","value":1698464016}},{"address":{"type":"absolute","value":1698464064}},{"address":{"type":"absolute","value":1698464080}},{"address":{"type":"absolute","value":1698464152}},{"address":{"type":"absolute","value":1698464170}},{"address":{"type":"absolute","value":1698464188}},{"address":{"type":"absolute","value":1698464230}},{"address":{"type":"absolute","value":1698464260}},{"address":{"type":"absolute","value":1698464293}},{"address":{"type":"absolute","value":1698464344}},{"address":{"type":"absolute","value":1698464370}},{"address":{"type":"absolute","value":1698464390}},{"address":{"type":"absolute","value":1698464471}},{"address":{"type":"absolute","value":1698464485}}]},{"address":{"type":"absolute","value":1698436528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698454046}},{"address":{"type":"absolute","value":1698454164}},{"address":{"type":"absolute","value":1698454217}},{"address":{"type":"absolute","value":1698454384}},{"address":{"type":"absolute","value":1698454468}}]},{"address":{"type":"absolute","value":1698436656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461700}},{"address":{"type":"absolute","value":1698461708}},{"address":{"type":"absolute","value":1698461760}},{"address":{"type":"absolute","value":1698461794}},{"address":{"type":"absolute","value":1698461827}},{"address":{"type":"absolute","value":1698461872}},{"address":{"type":"absolute","value":1698461881}},{"address":{"type":"absolute","value":1698461914}}]},{"address":{"type":"absolute","value":1698436672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462021}},{"address":{"type":"absolute","value":1698462048}},{"address":{"type":"absolute","value":1698462080}}]},{"address":{"type":"absolute","value":1698436688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698436704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698436720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461208}},{"address":{"type":"absolute","value":1698461232}},{"address":{"type":"absolute","value":1698461303}},{"address":{"type":"absolute","value":1698461320}},{"address":{"type":"absolute","value":1698461365}},{"address":{"type":"absolute","value":1698461408}},{"address":{"type":"absolute","value":1698461424}}]},{"address":{"type":"absolute","value":1698436736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462705}}]},{"address":{"type":"absolute","value":1698436752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453241}},{"address":{"type":"absolute","value":1698453270}},{"address":{"type":"absolute","value":1698453296}}]},{"address":{"type":"absolute","value":1698436768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462278}}]},{"address":{"type":"absolute","value":1698436784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462346}},{"address":{"type":"absolute","value":1698462389}}]},{"address":{"type":"absolute","value":1698436800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462416}},{"address":{"type":"absolute","value":1698462495}},{"address":{"type":"absolute","value":1698462530}}]},{"address":{"type":"absolute","value":1698436816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436816}}]},{"address":{"type":"absolute","value":1698436864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261739}},{"address":{"type":"absolute","value":1699264512}}]},{"address":{"type":"absolute","value":1698436880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261931}},{"address":{"type":"absolute","value":1699264528}}]},{"address":{"type":"absolute","value":1698436896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698436912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263030}},{"address":{"type":"absolute","value":1699263085}},{"address":{"type":"absolute","value":1699263133}},{"address":{"type":"absolute","value":1699263220}}]},{"address":{"type":"absolute","value":1698436928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263601}},{"address":{"type":"absolute","value":1699263617}}]},{"address":{"type":"absolute","value":1698436944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}}]},{"address":{"type":"absolute","value":1698436960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}}]},{"address":{"type":"absolute","value":1698436976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436976}}]},{"address":{"type":"absolute","value":1698437024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263290}}]},{"address":{"type":"absolute","value":1698437040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699263824}},{"address":{"type":"absolute","value":1699263846}},{"address":{"type":"absolute","value":1699263878}}]},{"address":{"type":"absolute","value":1698437056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1698437072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1698437088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238956}},{"address":{"type":"absolute","value":1699238970}},{"address":{"type":"absolute","value":1699238977}}]},{"address":{"type":"absolute","value":1698437104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437104}}]},{"address":{"type":"absolute","value":1698437152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437152}}]},{"address":{"type":"absolute","value":1698437200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437200}}]},{"address":{"type":"absolute","value":1698437232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}}]},{"address":{"type":"absolute","value":1698437248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}}]},{"address":{"type":"absolute","value":1698437264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234544}},{"address":{"type":"absolute","value":1699234597}},{"address":{"type":"absolute","value":1699234627}},{"address":{"type":"absolute","value":1699234699}},{"address":{"type":"absolute","value":1699234725}},{"address":{"type":"absolute","value":1699234797}},{"address":{"type":"absolute","value":1699234868}},{"address":{"type":"absolute","value":1699234912}}]},{"address":{"type":"absolute","value":1698437280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699236352}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699235904}},{"address":{"type":"absolute","value":1699235962}},{"address":{"type":"absolute","value":1699235999}},{"address":{"type":"absolute","value":1699236072}},{"address":{"type":"absolute","value":1699236098}},{"address":{"type":"absolute","value":1699236173}},{"address":{"type":"absolute","value":1699236244}},{"address":{"type":"absolute","value":1699236276}}]},{"address":{"type":"absolute","value":1698437328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236480}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699243568}},{"address":{"type":"absolute","value":1699243765}},{"address":{"type":"absolute","value":1699244162}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1698437360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243189}},{"address":{"type":"absolute","value":1699243251}}]},{"address":{"type":"absolute","value":1698437376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699244400}}]},{"address":{"type":"absolute","value":1698437392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243410}},{"address":{"type":"absolute","value":1699243433}}]},{"address":{"type":"absolute","value":1698437408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699240240}},{"address":{"type":"absolute","value":1699240296}},{"address":{"type":"absolute","value":1699240358}},{"address":{"type":"absolute","value":1699240432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699241005}},{"address":{"type":"absolute","value":1699241036}},{"address":{"type":"absolute","value":1699241056}},{"address":{"type":"absolute","value":1699241106}},{"address":{"type":"absolute","value":1699241124}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}}]},{"address":{"type":"absolute","value":1698437456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241269}}]},{"address":{"type":"absolute","value":1698437472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241897}}]},{"address":{"type":"absolute","value":1698437488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267072}}]},{"address":{"type":"absolute","value":1698437504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}}]},{"address":{"type":"absolute","value":1698437520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267454}}]},{"address":{"type":"absolute","value":1698437536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699267523}},{"address":{"type":"absolute","value":1699267552}}]},{"address":{"type":"absolute","value":1698437552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267568}}]},{"address":{"type":"absolute","value":1698437568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267692}},{"address":{"type":"absolute","value":1699267740}}]},{"address":{"type":"absolute","value":1698437584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267868}},{"address":{"type":"absolute","value":1699267916}}]},{"address":{"type":"absolute","value":1698437600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437600}}]},{"address":{"type":"absolute","value":1698437632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043593}},{"address":{"type":"absolute","value":1699043647}},{"address":{"type":"absolute","value":1699043664}},{"address":{"type":"absolute","value":1699043694}},{"address":{"type":"absolute","value":1699043729}},{"address":{"type":"absolute","value":1699043768}},{"address":{"type":"absolute","value":1699043798}},{"address":{"type":"absolute","value":1699044016}},{"address":{"type":"absolute","value":1699044099}},{"address":{"type":"absolute","value":1699044127}},{"address":{"type":"absolute","value":1699044242}},{"address":{"type":"absolute","value":1699268384}}]},{"address":{"type":"absolute","value":1698437648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}},{"address":{"type":"absolute","value":1699044464}},{"address":{"type":"absolute","value":1699044512}},{"address":{"type":"absolute","value":1699044547}},{"address":{"type":"absolute","value":1699044586}},{"address":{"type":"absolute","value":1699268432}}]},{"address":{"type":"absolute","value":1698437664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437664}}]},{"address":{"type":"absolute","value":1698437696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437696}}]},{"address":{"type":"absolute","value":1698437728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437761}}]},{"address":{"type":"absolute","value":1698437808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437808}},{"address":{"type":"absolute","value":1699268730}},{"address":{"type":"absolute","value":1699268735}},{"address":{"type":"absolute","value":1699268850}},{"address":{"type":"absolute","value":1699269065}},{"address":{"type":"absolute","value":1699269125}}]},{"address":{"type":"absolute","value":1698437872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437872}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}}]},{"address":{"type":"absolute","value":1698437920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437920}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699266048}},{"address":{"type":"absolute","value":1699266638}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}},{"address":{"type":"absolute","value":1699271296}},{"address":{"type":"absolute","value":1699271336}},{"address":{"type":"absolute","value":1699271345}},{"address":{"type":"absolute","value":1699271472}},{"address":{"type":"absolute","value":1699271493}},{"address":{"type":"absolute","value":1699271894}},{"address":{"type":"absolute","value":1699271969}},{"address":{"type":"absolute","value":1699272000}},{"address":{"type":"absolute","value":1699272460}},{"address":{"type":"absolute","value":1699272473}},{"address":{"type":"absolute","value":1699272498}}]},{"address":{"type":"absolute","value":1698437984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437984}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}},{"address":{"type":"absolute","value":1699272640}},{"address":{"type":"absolute","value":1699272678}},{"address":{"type":"absolute","value":1699272752}},{"address":{"type":"absolute","value":1699272770}}]},{"address":{"type":"absolute","value":1698438048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438048}},{"address":{"type":"absolute","value":1699272848}},{"address":{"type":"absolute","value":1699273304}},{"address":{"type":"absolute","value":1699273631}},{"address":{"type":"absolute","value":1699273958}},{"address":{"type":"absolute","value":1699274827}},{"address":{"type":"absolute","value":1699274880}},{"address":{"type":"absolute","value":1699275381}}]},{"address":{"type":"absolute","value":1698438112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438112}},{"address":{"type":"absolute","value":1699275522}},{"address":{"type":"absolute","value":1699275621}},{"address":{"type":"absolute","value":1699276104}}]},{"address":{"type":"absolute","value":1698438160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236712}},{"address":{"type":"absolute","value":1699236720}}]},{"address":{"type":"absolute","value":1698438192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236811}},{"address":{"type":"absolute","value":1699236836}},{"address":{"type":"absolute","value":1699236868}},{"address":{"type":"absolute","value":1699236896}}]},{"address":{"type":"absolute","value":1698438208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1698438224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236959}},{"address":{"type":"absolute","value":1699236992}},{"address":{"type":"absolute","value":1699237059}},{"address":{"type":"absolute","value":1699237082}},{"address":{"type":"absolute","value":1699237104}}]},{"address":{"type":"absolute","value":1698438240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237168}},{"address":{"type":"absolute","value":1699237188}}]},{"address":{"type":"absolute","value":1698438256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237616}},{"address":{"type":"absolute","value":1699237643}},{"address":{"type":"absolute","value":1699237808}},{"address":{"type":"absolute","value":1699237859}},{"address":{"type":"absolute","value":1699237877}}]},{"address":{"type":"absolute","value":1698438272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699238164}},{"address":{"type":"absolute","value":1699238288}},{"address":{"type":"absolute","value":1699238320}},{"address":{"type":"absolute","value":1699238337}},{"address":{"type":"absolute","value":1699238352}},{"address":{"type":"absolute","value":1699238368}}]},{"address":{"type":"absolute","value":1698438288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}}]},{"address":{"type":"absolute","value":1698438304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}},{"address":{"type":"absolute","value":1699262739}},{"address":{"type":"absolute","value":1699262797}}]},{"address":{"type":"absolute","value":1698438320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262836}}]},{"address":{"type":"absolute","value":1698438336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}},{"address":{"type":"absolute","value":1699264736}},{"address":{"type":"absolute","value":1699264813}},{"address":{"type":"absolute","value":1699264881}},{"address":{"type":"absolute","value":1699264896}},{"address":{"type":"absolute","value":1699264964}}]},{"address":{"type":"absolute","value":1698438352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264992}},{"address":{"type":"absolute","value":1699265024}},{"address":{"type":"absolute","value":1699265037}}]},{"address":{"type":"absolute","value":1698438368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265088}},{"address":{"type":"absolute","value":1699265099}},{"address":{"type":"absolute","value":1699265162}},{"address":{"type":"absolute","value":1699265200}},{"address":{"type":"absolute","value":1699265216}},{"address":{"type":"absolute","value":1699265232}},{"address":{"type":"absolute","value":1699265248}}]},{"address":{"type":"absolute","value":1698438384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438384}},{"address":{"type":"absolute","value":1698438393}}]},{"address":{"type":"absolute","value":1698438512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438540}},{"address":{"type":"absolute","value":1698438579}}]},{"address":{"type":"absolute","value":1698438608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698480912}},{"address":{"type":"absolute","value":1698480924}},{"address":{"type":"absolute","value":1698480960}},{"address":{"type":"absolute","value":1698480992}}]},{"address":{"type":"absolute","value":1698438624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438687}}]},{"address":{"type":"absolute","value":1698438704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438767}}]},{"address":{"type":"absolute","value":1698438784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438847}}]},{"address":{"type":"absolute","value":1698438864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438927}}]},{"address":{"type":"absolute","value":1698438944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439007}}]},{"address":{"type":"absolute","value":1698439024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439087}}]},{"address":{"type":"absolute","value":1698439104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439172}}]},{"address":{"type":"absolute","value":1698439184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439184}}]},{"address":{"type":"absolute","value":1698439216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439282}}]},{"address":{"type":"absolute","value":1698439296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479492}}]},{"address":{"type":"absolute","value":1698439312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479276}},{"address":{"type":"absolute","value":1698479340}},{"address":{"type":"absolute","value":1698479353}},{"address":{"type":"absolute","value":1698479364}},{"address":{"type":"absolute","value":1698479388}}]},{"address":{"type":"absolute","value":1698439328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479432}},{"address":{"type":"absolute","value":1698479441}}]},{"address":{"type":"absolute","value":1698439344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439418}},{"address":{"type":"absolute","value":1698439439}}]},{"address":{"type":"absolute","value":1698439472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439555}}]},{"address":{"type":"absolute","value":1698439568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698485952}}]},{"address":{"type":"absolute","value":1698439584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486000}}]},{"address":{"type":"absolute","value":1698439600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439666}}]},{"address":{"type":"absolute","value":1698439680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533796}}]},{"address":{"type":"absolute","value":1698439696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533700}},{"address":{"type":"absolute","value":1698533729}},{"address":{"type":"absolute","value":1698533744}}]},{"address":{"type":"absolute","value":1698439728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534596}}]},{"address":{"type":"absolute","value":1698439744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534676}}]},{"address":{"type":"absolute","value":1698439760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439788}},{"address":{"type":"absolute","value":1698439827}}]},{"address":{"type":"absolute","value":1698439856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698534240}},{"address":{"type":"absolute","value":1698534292}}]},{"address":{"type":"absolute","value":1698439872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439935}}]},{"address":{"type":"absolute","value":1698439952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440015}}]},{"address":{"type":"absolute","value":1698440032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440095}}]},{"address":{"type":"absolute","value":1698440112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440175}}]},{"address":{"type":"absolute","value":1698440192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440255}}]},{"address":{"type":"absolute","value":1698440272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440340}}]},{"address":{"type":"absolute","value":1698440352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440377}},{"address":{"type":"absolute","value":1698440416}}]},{"address":{"type":"absolute","value":1698440448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440473}},{"address":{"type":"absolute","value":1698440512}}]},{"address":{"type":"absolute","value":1698440544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440569}},{"address":{"type":"absolute","value":1698440608}}]},{"address":{"type":"absolute","value":1698440640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440703}}]},{"address":{"type":"absolute","value":1698440720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440765}}]},{"address":{"type":"absolute","value":1698440784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440805}},{"address":{"type":"absolute","value":1698440837}}]},{"address":{"type":"absolute","value":1698440864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440864}}]},{"address":{"type":"absolute","value":1698440896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440962}}]},{"address":{"type":"absolute","value":1698440976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516560}}]},{"address":{"type":"absolute","value":1698440992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516473}},{"address":{"type":"absolute","value":1698516480}}]},{"address":{"type":"absolute","value":1698441008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441025}},{"address":{"type":"absolute","value":1698441040}},{"address":{"type":"absolute","value":1698517557}}]},{"address":{"type":"absolute","value":1698441056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441077}},{"address":{"type":"absolute","value":1698441104}},{"address":{"type":"absolute","value":1698517700}},{"address":{"type":"absolute","value":1698517761}},{"address":{"type":"absolute","value":1698517827}},{"address":{"type":"absolute","value":1698518024}},{"address":{"type":"absolute","value":1698518048}}]},{"address":{"type":"absolute","value":1698441120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441144}},{"address":{"type":"absolute","value":1698441168}},{"address":{"type":"absolute","value":1698518351}},{"address":{"type":"absolute","value":1698518398}}]},{"address":{"type":"absolute","value":1698441184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441204}},{"address":{"type":"absolute","value":1698441220}},{"address":{"type":"absolute","value":1698518416}},{"address":{"type":"absolute","value":1698518471}},{"address":{"type":"absolute","value":1698518490}}]},{"address":{"type":"absolute","value":1698441232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441256}},{"address":{"type":"absolute","value":1698441296}}]},{"address":{"type":"absolute","value":1698441328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441352}},{"address":{"type":"absolute","value":1698441392}}]},{"address":{"type":"absolute","value":1698441424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1698441440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441494}}]},{"address":{"type":"absolute","value":1698441504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441525}},{"address":{"type":"absolute","value":1698441557}}]},{"address":{"type":"absolute","value":1698441584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529709}},{"address":{"type":"absolute","value":1698529772}}]},{"address":{"type":"absolute","value":1698441600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441668}}]},{"address":{"type":"absolute","value":1698441680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441705}},{"address":{"type":"absolute","value":1698441713}},{"address":{"type":"absolute","value":1698526807}}]},{"address":{"type":"absolute","value":1698441744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}},{"address":{"type":"absolute","value":1698529936}}]},{"address":{"type":"absolute","value":1698441760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441760}}]},{"address":{"type":"absolute","value":1698441792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441820}},{"address":{"type":"absolute","value":1698530224}},{"address":{"type":"absolute","value":1698530261}},{"address":{"type":"absolute","value":1698530373}},{"address":{"type":"absolute","value":1698530427}},{"address":{"type":"absolute","value":1698530448}},{"address":{"type":"absolute","value":1698530512}},{"address":{"type":"absolute","value":1698530544}}]},{"address":{"type":"absolute","value":1698441888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441915}}]},{"address":{"type":"absolute","value":1698442016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442033}},{"address":{"type":"absolute","value":1698442048}},{"address":{"type":"absolute","value":1698532578}}]},{"address":{"type":"absolute","value":1698442096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532628}}]},{"address":{"type":"absolute","value":1698442112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442132}},{"address":{"type":"absolute","value":1698442144}}]},{"address":{"type":"absolute","value":1698442176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442244}}]},{"address":{"type":"absolute","value":1698442256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442256}}]},{"address":{"type":"absolute","value":1698442288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529028}}]},{"address":{"type":"absolute","value":1698442304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528725}},{"address":{"type":"absolute","value":1698528755}},{"address":{"type":"absolute","value":1698528788}},{"address":{"type":"absolute","value":1698528860}},{"address":{"type":"absolute","value":1698528866}},{"address":{"type":"absolute","value":1698528928}},{"address":{"type":"absolute","value":1698528961}},{"address":{"type":"absolute","value":1698528976}}]},{"address":{"type":"absolute","value":1698442320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442383}}]},{"address":{"type":"absolute","value":1698442400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527003}},{"address":{"type":"absolute","value":1698528525}},{"address":{"type":"absolute","value":1698528533}}]},{"address":{"type":"absolute","value":1698442416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442416}}]},{"address":{"type":"absolute","value":1698442512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442537}},{"address":{"type":"absolute","value":1699208359}},{"address":{"type":"absolute","value":1699208384}},{"address":{"type":"absolute","value":1699208405}},{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}},{"address":{"type":"absolute","value":1699224292}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1698442624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442687}}]},{"address":{"type":"absolute","value":1698442704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442724}},{"address":{"type":"absolute","value":1699209536}}]},{"address":{"type":"absolute","value":1698442816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442836}},{"address":{"type":"absolute","value":1699209584}}]},{"address":{"type":"absolute","value":1698442928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699264647}},{"address":{"type":"absolute","value":1699264688}}]},{"address":{"type":"absolute","value":1698442944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442965}},{"address":{"type":"absolute","value":1699210038}},{"address":{"type":"absolute","value":1699210052}},{"address":{"type":"absolute","value":1699210080}},{"address":{"type":"absolute","value":1699210176}},{"address":{"type":"absolute","value":1699210234}},{"address":{"type":"absolute","value":1699210257}},{"address":{"type":"absolute","value":1699224292}}]},{"address":{"type":"absolute","value":1698443056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443056}}]},{"address":{"type":"absolute","value":1698443136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443136}}]},{"address":{"type":"absolute","value":1698443168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698553472}},{"address":{"type":"absolute","value":1698553490}},{"address":{"type":"absolute","value":1698553504}}]},{"address":{"type":"absolute","value":1698443184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443184}}]},{"address":{"type":"absolute","value":1698443216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698477792}},{"address":{"type":"absolute","value":1698477808}}]},{"address":{"type":"absolute","value":1698443232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443232}}]},{"address":{"type":"absolute","value":1698443280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445007}},{"address":{"type":"absolute","value":1698445045}},{"address":{"type":"absolute","value":1698445066}},{"address":{"type":"absolute","value":1698445084}},{"address":{"type":"absolute","value":1698445152}}]},{"address":{"type":"absolute","value":1698443296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}}]},{"address":{"type":"absolute","value":1698443312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443345}},{"address":{"type":"absolute","value":1699269292}},{"address":{"type":"absolute","value":1699269315}},{"address":{"type":"absolute","value":1699269367}},{"address":{"type":"absolute","value":1699269390}},{"address":{"type":"absolute","value":1699269439}},{"address":{"type":"absolute","value":1699269486}},{"address":{"type":"absolute","value":1699269509}},{"address":{"type":"absolute","value":1699269562}},{"address":{"type":"absolute","value":1699269585}},{"address":{"type":"absolute","value":1699269653}},{"address":{"type":"absolute","value":1699269676}},{"address":{"type":"absolute","value":1699269728}},{"address":{"type":"absolute","value":1699269751}},{"address":{"type":"absolute","value":1699269808}}]},{"address":{"type":"absolute","value":1698443376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445941}},{"address":{"type":"absolute","value":1698445992}},{"address":{"type":"absolute","value":1698446144}},{"address":{"type":"absolute","value":1698446174}},{"address":{"type":"absolute","value":1698446208}},{"address":{"type":"absolute","value":1698446245}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698443392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448816}},{"address":{"type":"absolute","value":1698448910}},{"address":{"type":"absolute","value":1698448995}},{"address":{"type":"absolute","value":1698449162}},{"address":{"type":"absolute","value":1698449232}},{"address":{"type":"absolute","value":1698449280}}]},{"address":{"type":"absolute","value":1698443408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453072}}]},{"address":{"type":"absolute","value":1698443424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451356}}]},{"address":{"type":"absolute","value":1698443440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698451460}},{"address":{"type":"absolute","value":1698451488}}]},{"address":{"type":"absolute","value":1698443504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451520}}]},{"address":{"type":"absolute","value":1698443520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452003}},{"address":{"type":"absolute","value":1698452016}}]},{"address":{"type":"absolute","value":1698443536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451568}}]},{"address":{"type":"absolute","value":1698443552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452134}},{"address":{"type":"absolute","value":1698452144}}]},{"address":{"type":"absolute","value":1698443568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447929}}]},{"address":{"type":"absolute","value":1698443584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451773}},{"address":{"type":"absolute","value":1698451818}}]},{"address":{"type":"absolute","value":1698443600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452280}}]},{"address":{"type":"absolute","value":1698443616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452625}}]},{"address":{"type":"absolute","value":1698443632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452542}}]},{"address":{"type":"absolute","value":1698443648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452721}}]},{"address":{"type":"absolute","value":1698443664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452357}},{"address":{"type":"absolute","value":1698452415}}]},{"address":{"type":"absolute","value":1698443680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452892}}]},{"address":{"type":"absolute","value":1698443696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698443712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451649}},{"address":{"type":"absolute","value":1698451683}},{"address":{"type":"absolute","value":1698451696}},{"address":{"type":"absolute","value":1698470480}}]},{"address":{"type":"absolute","value":1698443728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443728}}]},{"address":{"type":"absolute","value":1698443776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443776}}]},{"address":{"type":"absolute","value":1698444080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444143}},{"address":{"type":"absolute","value":1698444194}},{"address":{"type":"absolute","value":1698444254}},{"address":{"type":"absolute","value":1698444288}},{"address":{"type":"absolute","value":1698444336}},{"address":{"type":"absolute","value":1698444384}}]},{"address":{"type":"absolute","value":1698444496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444496}}]},{"address":{"type":"absolute","value":1698444640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1698444688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444688}}]},{"address":{"type":"absolute","value":1698444832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444832}}]},{"address":{"type":"absolute","value":1698444880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}}]},{"address":{"type":"absolute","value":1698444944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445007}},{"address":{"type":"absolute","value":1698445045}},{"address":{"type":"absolute","value":1698445066}},{"address":{"type":"absolute","value":1698445084}},{"address":{"type":"absolute","value":1698445152}}]},{"address":{"type":"absolute","value":1698445344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445007}},{"address":{"type":"absolute","value":1698445045}},{"address":{"type":"absolute","value":1698445066}},{"address":{"type":"absolute","value":1698445084}},{"address":{"type":"absolute","value":1698445152}}]},{"address":{"type":"absolute","value":1698445376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}}]},{"address":{"type":"absolute","value":1698445728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445941}},{"address":{"type":"absolute","value":1698445992}},{"address":{"type":"absolute","value":1698446144}},{"address":{"type":"absolute","value":1698446174}},{"address":{"type":"absolute","value":1698446208}},{"address":{"type":"absolute","value":1698446245}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698446304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698446409}},{"address":{"type":"absolute","value":1698446443}},{"address":{"type":"absolute","value":1698446544}},{"address":{"type":"absolute","value":1698446579}},{"address":{"type":"absolute","value":1698446609}},{"address":{"type":"absolute","value":1698446637}},{"address":{"type":"absolute","value":1698446674}},{"address":{"type":"absolute","value":1698446722}}]},{"address":{"type":"absolute","value":1698446864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698446864}},{"address":{"type":"absolute","value":1698446928}},{"address":{"type":"absolute","value":1698446960}}]},{"address":{"type":"absolute","value":1698447040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447084}},{"address":{"type":"absolute","value":1698447184}},{"address":{"type":"absolute","value":1698447265}},{"address":{"type":"absolute","value":1698447312}},{"address":{"type":"absolute","value":1698447338}},{"address":{"type":"absolute","value":1698447360}}]},{"address":{"type":"absolute","value":1698447424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447424}},{"address":{"type":"absolute","value":1698447534}}]},{"address":{"type":"absolute","value":1698447600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447648}},{"address":{"type":"absolute","value":1698447743}}]},{"address":{"type":"absolute","value":1698447808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698447888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447929}}]},{"address":{"type":"absolute","value":1698448032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448046}},{"address":{"type":"absolute","value":1698448064}},{"address":{"type":"absolute","value":1698474036}},{"address":{"type":"absolute","value":1698474064}}]},{"address":{"type":"absolute","value":1698448080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448186}},{"address":{"type":"absolute","value":1698448214}}]},{"address":{"type":"absolute","value":1698448288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448816}},{"address":{"type":"absolute","value":1698448910}},{"address":{"type":"absolute","value":1698448995}},{"address":{"type":"absolute","value":1698449162}},{"address":{"type":"absolute","value":1698449232}},{"address":{"type":"absolute","value":1698449280}}]},{"address":{"type":"absolute","value":1698449552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698449552}},{"address":{"type":"absolute","value":1698449573}},{"address":{"type":"absolute","value":1698449605}}]},{"address":{"type":"absolute","value":1698451312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451356}}]},{"address":{"type":"absolute","value":1698451424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698451460}},{"address":{"type":"absolute","value":1698451488}}]},{"address":{"type":"absolute","value":1698451520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451520}}]},{"address":{"type":"absolute","value":1698451568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451568}}]},{"address":{"type":"absolute","value":1698451616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451649}},{"address":{"type":"absolute","value":1698451683}},{"address":{"type":"absolute","value":1698451696}},{"address":{"type":"absolute","value":1698470480}}]},{"address":{"type":"absolute","value":1698451728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451773}},{"address":{"type":"absolute","value":1698451818}}]},{"address":{"type":"absolute","value":1698451872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447929}}]},{"address":{"type":"absolute","value":1698451888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698451920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452003}},{"address":{"type":"absolute","value":1698452016}}]},{"address":{"type":"absolute","value":1698452048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452134}},{"address":{"type":"absolute","value":1698452144}}]},{"address":{"type":"absolute","value":1698452176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451773}},{"address":{"type":"absolute","value":1698451818}}]},{"address":{"type":"absolute","value":1698452192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452280}}]},{"address":{"type":"absolute","value":1698452320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452357}},{"address":{"type":"absolute","value":1698452415}}]},{"address":{"type":"absolute","value":1698452448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452542}}]},{"address":{"type":"absolute","value":1698452592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452625}}]},{"address":{"type":"absolute","value":1698452688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452721}}]},{"address":{"type":"absolute","value":1698452784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452892}}]},{"address":{"type":"absolute","value":1698453024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453050}}]},{"address":{"type":"absolute","value":1698453072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453072}}]},{"address":{"type":"absolute","value":1698453136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453241}},{"address":{"type":"absolute","value":1698453270}},{"address":{"type":"absolute","value":1698453296}}]},{"address":{"type":"absolute","value":1698453312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453312}}]},{"address":{"type":"absolute","value":1698453344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453424}},{"address":{"type":"absolute","value":1698453456}},{"address":{"type":"absolute","value":1698453475}},{"address":{"type":"absolute","value":1698453650}},{"address":{"type":"absolute","value":1698453664}},{"address":{"type":"absolute","value":1698453706}},{"address":{"type":"absolute","value":1698453709}},{"address":{"type":"absolute","value":1698453740}},{"address":{"type":"absolute","value":1698453745}},{"address":{"type":"absolute","value":1698453760}}]},{"address":{"type":"absolute","value":1698453792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453792}},{"address":{"type":"absolute","value":1698453851}},{"address":{"type":"absolute","value":1698453875}},{"address":{"type":"absolute","value":1698453888}},{"address":{"type":"absolute","value":1698453904}}]},{"address":{"type":"absolute","value":1698453936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698454046}},{"address":{"type":"absolute","value":1698454164}},{"address":{"type":"absolute","value":1698454217}},{"address":{"type":"absolute","value":1698454384}},{"address":{"type":"absolute","value":1698454468}}]},{"address":{"type":"absolute","value":1698454496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698454547}},{"address":{"type":"absolute","value":1698454561}},{"address":{"type":"absolute","value":1698454564}},{"address":{"type":"absolute","value":1698454576}},{"address":{"type":"absolute","value":1698454608}},{"address":{"type":"absolute","value":1698454643}}]},{"address":{"type":"absolute","value":1698454672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}}]},{"address":{"type":"absolute","value":1698454736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454803}},{"address":{"type":"absolute","value":1698454976}},{"address":{"type":"absolute","value":1698455008}},{"address":{"type":"absolute","value":1698455044}},{"address":{"type":"absolute","value":1698455209}},{"address":{"type":"absolute","value":1698455251}},{"address":{"type":"absolute","value":1698455262}},{"address":{"type":"absolute","value":1698455297}},{"address":{"type":"absolute","value":1698455457}},{"address":{"type":"absolute","value":1698455561}},{"address":{"type":"absolute","value":1698455744}},{"address":{"type":"absolute","value":1698456017}},{"address":{"type":"absolute","value":1698456080}},{"address":{"type":"absolute","value":1698456179}},{"address":{"type":"absolute","value":1698456263}},{"address":{"type":"absolute","value":1698456320}},{"address":{"type":"absolute","value":1698456334}},{"address":{"type":"absolute","value":1698456594}},{"address":{"type":"absolute","value":1698456652}},{"address":{"type":"absolute","value":1698456792}},{"address":{"type":"absolute","value":1698456859}},{"address":{"type":"absolute","value":1698457084}},{"address":{"type":"absolute","value":1698457148}},{"address":{"type":"absolute","value":1698457184}},{"address":{"type":"absolute","value":1698457279}},{"address":{"type":"absolute","value":1698457410}},{"address":{"type":"absolute","value":1698457542}},{"address":{"type":"absolute","value":1698457636}},{"address":{"type":"absolute","value":1698457783}},{"address":{"type":"absolute","value":1698457805}},{"address":{"type":"absolute","value":1698457998}},{"address":{"type":"absolute","value":1698458116}},{"address":{"type":"absolute","value":1698458147}},{"address":{"type":"absolute","value":1698458197}},{"address":{"type":"absolute","value":1698458301}},{"address":{"type":"absolute","value":1698458438}},{"address":{"type":"absolute","value":1698458531}},{"address":{"type":"absolute","value":1698458552}},{"address":{"type":"absolute","value":1698458649}},{"address":{"type":"absolute","value":1698458709}},{"address":{"type":"absolute","value":1698458800}},{"address":{"type":"absolute","value":1698458863}},{"address":{"type":"absolute","value":1698458891}},{"address":{"type":"absolute","value":1698458943}},{"address":{"type":"absolute","value":1698459057}},{"address":{"type":"absolute","value":1698459340}},{"address":{"type":"absolute","value":1698459530}},{"address":{"type":"absolute","value":1698459577}},{"address":{"type":"absolute","value":1698459627}},{"address":{"type":"absolute","value":1698459712}},{"address":{"type":"absolute","value":1698459740}},{"address":{"type":"absolute","value":1698459771}},{"address":{"type":"absolute","value":1698459827}},{"address":{"type":"absolute","value":1698459866}},{"address":{"type":"absolute","value":1698459898}},{"address":{"type":"absolute","value":1698459982}},{"address":{"type":"absolute","value":1698460082}},{"address":{"type":"absolute","value":1698460340}},{"address":{"type":"absolute","value":1698460390}},{"address":{"type":"absolute","value":1698460648}}]},{"address":{"type":"absolute","value":1698460704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698460704}}]},{"address":{"type":"absolute","value":1698460768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698461184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461208}},{"address":{"type":"absolute","value":1698461232}},{"address":{"type":"absolute","value":1698461303}},{"address":{"type":"absolute","value":1698461320}},{"address":{"type":"absolute","value":1698461365}},{"address":{"type":"absolute","value":1698461408}},{"address":{"type":"absolute","value":1698461424}}]},{"address":{"type":"absolute","value":1698461648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461700}},{"address":{"type":"absolute","value":1698461708}},{"address":{"type":"absolute","value":1698461760}},{"address":{"type":"absolute","value":1698461794}},{"address":{"type":"absolute","value":1698461827}},{"address":{"type":"absolute","value":1698461872}},{"address":{"type":"absolute","value":1698461881}},{"address":{"type":"absolute","value":1698461914}}]},{"address":{"type":"absolute","value":1698461984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462021}},{"address":{"type":"absolute","value":1698462048}},{"address":{"type":"absolute","value":1698462080}}]},{"address":{"type":"absolute","value":1698462112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698462144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698462176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453241}},{"address":{"type":"absolute","value":1698453270}},{"address":{"type":"absolute","value":1698453296}}]},{"address":{"type":"absolute","value":1698462192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462278}}]},{"address":{"type":"absolute","value":1698462304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462346}},{"address":{"type":"absolute","value":1698462389}}]},{"address":{"type":"absolute","value":1698462416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462416}},{"address":{"type":"absolute","value":1698462495}},{"address":{"type":"absolute","value":1698462530}}]},{"address":{"type":"absolute","value":1698462624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461208}},{"address":{"type":"absolute","value":1698461232}},{"address":{"type":"absolute","value":1698461303}},{"address":{"type":"absolute","value":1698461320}},{"address":{"type":"absolute","value":1698461365}},{"address":{"type":"absolute","value":1698461408}},{"address":{"type":"absolute","value":1698461424}}]},{"address":{"type":"absolute","value":1698462656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462705}}]},{"address":{"type":"absolute","value":1698462736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462736}}]},{"address":{"type":"absolute","value":1698462832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462832}}]},{"address":{"type":"absolute","value":1698462912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462912}}]},{"address":{"type":"absolute","value":1698462992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462992}}]},{"address":{"type":"absolute","value":1698463024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698463210}},{"address":{"type":"absolute","value":1698463306}},{"address":{"type":"absolute","value":1698463319}},{"address":{"type":"absolute","value":1698463364}},{"address":{"type":"absolute","value":1698463479}},{"address":{"type":"absolute","value":1698463531}},{"address":{"type":"absolute","value":1698463586}},{"address":{"type":"absolute","value":1698463669}},{"address":{"type":"absolute","value":1698463772}},{"address":{"type":"absolute","value":1698463795}},{"address":{"type":"absolute","value":1698463858}},{"address":{"type":"absolute","value":1698463920}},{"address":{"type":"absolute","value":1698464016}},{"address":{"type":"absolute","value":1698464064}},{"address":{"type":"absolute","value":1698464080}},{"address":{"type":"absolute","value":1698464152}},{"address":{"type":"absolute","value":1698464170}},{"address":{"type":"absolute","value":1698464188}},{"address":{"type":"absolute","value":1698464230}},{"address":{"type":"absolute","value":1698464260}},{"address":{"type":"absolute","value":1698464293}},{"address":{"type":"absolute","value":1698464344}},{"address":{"type":"absolute","value":1698464370}},{"address":{"type":"absolute","value":1698464390}},{"address":{"type":"absolute","value":1698464471}},{"address":{"type":"absolute","value":1698464485}}]},{"address":{"type":"absolute","value":1698464512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698464583}},{"address":{"type":"absolute","value":1698464636}},{"address":{"type":"absolute","value":1698464737}},{"address":{"type":"absolute","value":1698464761}},{"address":{"type":"absolute","value":1698464832}},{"address":{"type":"absolute","value":1698464848}}]},{"address":{"type":"absolute","value":1698465008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698465205}},{"address":{"type":"absolute","value":1698465216}}]},{"address":{"type":"absolute","value":1698465264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698465402}},{"address":{"type":"absolute","value":1698465411}},{"address":{"type":"absolute","value":1698465474}},{"address":{"type":"absolute","value":1698465840}},{"address":{"type":"absolute","value":1698465913}},{"address":{"type":"absolute","value":1698466220}},{"address":{"type":"absolute","value":1698466374}},{"address":{"type":"absolute","value":1698466464}}]},{"address":{"type":"absolute","value":1698466688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698466688}}]},{"address":{"type":"absolute","value":1698466720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698466771}},{"address":{"type":"absolute","value":1698466844}},{"address":{"type":"absolute","value":1698466854}},{"address":{"type":"absolute","value":1698466899}},{"address":{"type":"absolute","value":1698466907}}]},{"address":{"type":"absolute","value":1698467072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467108}},{"address":{"type":"absolute","value":1698467136}},{"address":{"type":"absolute","value":1698467232}},{"address":{"type":"absolute","value":1698467315}}]},{"address":{"type":"absolute","value":1698467408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467408}},{"address":{"type":"absolute","value":1698467461}}]},{"address":{"type":"absolute","value":1698467520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467557}},{"address":{"type":"absolute","value":1698467582}},{"address":{"type":"absolute","value":1698467588}}]},{"address":{"type":"absolute","value":1698467616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467653}},{"address":{"type":"absolute","value":1698467678}},{"address":{"type":"absolute","value":1698467684}},{"address":{"type":"absolute","value":1698470176}}]},{"address":{"type":"absolute","value":1698467712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467408}},{"address":{"type":"absolute","value":1698467461}}]},{"address":{"type":"absolute","value":1698467744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467788}},{"address":{"type":"absolute","value":1698467803}}]},{"address":{"type":"absolute","value":1698467824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467557}},{"address":{"type":"absolute","value":1698467582}},{"address":{"type":"absolute","value":1698467588}},{"address":{"type":"absolute","value":1698467971}},{"address":{"type":"absolute","value":1698467994}},{"address":{"type":"absolute","value":1698468018}},{"address":{"type":"absolute","value":1698468067}},{"address":{"type":"absolute","value":1698470304}},{"address":{"type":"absolute","value":1698470341}}]},{"address":{"type":"absolute","value":1698468096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698468128}},{"address":{"type":"absolute","value":1698468199}},{"address":{"type":"absolute","value":1698468220}},{"address":{"type":"absolute","value":1698468240}},{"address":{"type":"absolute","value":1698468282}}]},{"address":{"type":"absolute","value":1698468304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698468321}},{"address":{"type":"absolute","value":1698468345}},{"address":{"type":"absolute","value":1698468394}},{"address":{"type":"absolute","value":1698468414}},{"address":{"type":"absolute","value":1698468469}},{"address":{"type":"absolute","value":1698468482}}]},{"address":{"type":"absolute","value":1698468496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698468537}},{"address":{"type":"absolute","value":1698468597}},{"address":{"type":"absolute","value":1698468621}},{"address":{"type":"absolute","value":1698468624}},{"address":{"type":"absolute","value":1698468675}},{"address":{"type":"absolute","value":1698468699}},{"address":{"type":"absolute","value":1698468704}},{"address":{"type":"absolute","value":1698468755}},{"address":{"type":"absolute","value":1698468779}},{"address":{"type":"absolute","value":1698468784}},{"address":{"type":"absolute","value":1698468832}},{"address":{"type":"absolute","value":1698468860}},{"address":{"type":"absolute","value":1698468864}},{"address":{"type":"absolute","value":1698468890}},{"address":{"type":"absolute","value":1698468927}}]},{"address":{"type":"absolute","value":1698469008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698469008}}]},{"address":{"type":"absolute","value":1698469040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444688}},{"address":{"type":"absolute","value":1698469095}},{"address":{"type":"absolute","value":1698469120}}]},{"address":{"type":"absolute","value":1698469184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698469280}},{"address":{"type":"absolute","value":1698469328}},{"address":{"type":"absolute","value":1698469332}},{"address":{"type":"absolute","value":1698469344}},{"address":{"type":"absolute","value":1698469538}},{"address":{"type":"absolute","value":1698469545}}]},{"address":{"type":"absolute","value":1698469776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698469776}}]},{"address":{"type":"absolute","value":1698469856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698469856}},{"address":{"type":"absolute","value":1698469933}}]},{"address":{"type":"absolute","value":1698469984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470028}},{"address":{"type":"absolute","value":1698470070}}]},{"address":{"type":"absolute","value":1698470096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470129}}]},{"address":{"type":"absolute","value":1698470176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470176}}]},{"address":{"type":"absolute","value":1698470240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470293}}]},{"address":{"type":"absolute","value":1698470304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470304}},{"address":{"type":"absolute","value":1698470341}}]},{"address":{"type":"absolute","value":1698470448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470480}}]},{"address":{"type":"absolute","value":1698470512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470619}},{"address":{"type":"absolute","value":1698470624}},{"address":{"type":"absolute","value":1698470664}},{"address":{"type":"absolute","value":1698470672}},{"address":{"type":"absolute","value":1698470715}},{"address":{"type":"absolute","value":1698470720}},{"address":{"type":"absolute","value":1698470768}},{"address":{"type":"absolute","value":1698470833}},{"address":{"type":"absolute","value":1698470896}},{"address":{"type":"absolute","value":1698470944}},{"address":{"type":"absolute","value":1698470992}},{"address":{"type":"absolute","value":1698471040}}]},{"address":{"type":"absolute","value":1698471072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471192}},{"address":{"type":"absolute","value":1698471207}},{"address":{"type":"absolute","value":1698471225}},{"address":{"type":"absolute","value":1698471285}},{"address":{"type":"absolute","value":1698471314}}]},{"address":{"type":"absolute","value":1698471344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471360}}]},{"address":{"type":"absolute","value":1698471392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471412}}]},{"address":{"type":"absolute","value":1698471456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471476}}]},{"address":{"type":"absolute","value":1698471520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471762}},{"address":{"type":"absolute","value":1698471808}}]},{"address":{"type":"absolute","value":1698472064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472097}}]},{"address":{"type":"absolute","value":1698472112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472132}},{"address":{"type":"absolute","value":1698472144}}]},{"address":{"type":"absolute","value":1698472176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472196}},{"address":{"type":"absolute","value":1698472208}}]},{"address":{"type":"absolute","value":1698472288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472288}},{"address":{"type":"absolute","value":1698472317}},{"address":{"type":"absolute","value":1698472531}},{"address":{"type":"absolute","value":1698472764}},{"address":{"type":"absolute","value":1698472820}}]},{"address":{"type":"absolute","value":1698473280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698473312}},{"address":{"type":"absolute","value":1698473361}},{"address":{"type":"absolute","value":1698473408}},{"address":{"type":"absolute","value":1698473452}},{"address":{"type":"absolute","value":1698473488}},{"address":{"type":"absolute","value":1698473535}},{"address":{"type":"absolute","value":1698473579}},{"address":{"type":"absolute","value":1698473636}},{"address":{"type":"absolute","value":1698473796}},{"address":{"type":"absolute","value":1698473892}},{"address":{"type":"absolute","value":1698473920}},{"address":{"type":"absolute","value":1698473952}}]},{"address":{"type":"absolute","value":1698474016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698474036}},{"address":{"type":"absolute","value":1698474064}}]},{"address":{"type":"absolute","value":1698474112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471476}},{"address":{"type":"absolute","value":1698474159}},{"address":{"type":"absolute","value":1698474179}},{"address":{"type":"absolute","value":1698474192}}]},{"address":{"type":"absolute","value":1698474336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698474376}},{"address":{"type":"absolute","value":1698474472}}]},{"address":{"type":"absolute","value":1698474496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698474628}},{"address":{"type":"absolute","value":1698474722}},{"address":{"type":"absolute","value":1698474800}},{"address":{"type":"absolute","value":1698474909}}]},{"address":{"type":"absolute","value":1698475088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698475088}},{"address":{"type":"absolute","value":1698475173}},{"address":{"type":"absolute","value":1698475232}},{"address":{"type":"absolute","value":1698475264}},{"address":{"type":"absolute","value":1698475337}},{"address":{"type":"absolute","value":1698475393}},{"address":{"type":"absolute","value":1698475422}},{"address":{"type":"absolute","value":1698475535}}]},{"address":{"type":"absolute","value":1698475616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698475621}},{"address":{"type":"absolute","value":1698475648}}]},{"address":{"type":"absolute","value":1698475680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698475760}},{"address":{"type":"absolute","value":1698475769}},{"address":{"type":"absolute","value":1698475802}},{"address":{"type":"absolute","value":1698475872}},{"address":{"type":"absolute","value":1698475910}},{"address":{"type":"absolute","value":1698475940}},{"address":{"type":"absolute","value":1698475970}},{"address":{"type":"absolute","value":1698475984}}]},{"address":{"type":"absolute","value":1698476064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698476064}},{"address":{"type":"absolute","value":1698476159}},{"address":{"type":"absolute","value":1698476180}},{"address":{"type":"absolute","value":1698476199}},{"address":{"type":"absolute","value":1698476320}}]},{"address":{"type":"absolute","value":1698476416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698476722}},{"address":{"type":"absolute","value":1698476741}},{"address":{"type":"absolute","value":1698476768}},{"address":{"type":"absolute","value":1698476785}}]},{"address":{"type":"absolute","value":1698476928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698476959}},{"address":{"type":"absolute","value":1698476979}}]},{"address":{"type":"absolute","value":1698477120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477120}},{"address":{"type":"absolute","value":1698477341}}]},{"address":{"type":"absolute","value":1698477472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477472}},{"address":{"type":"absolute","value":1698477485}},{"address":{"type":"absolute","value":1698477537}}]},{"address":{"type":"absolute","value":1698477568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477616}}]},{"address":{"type":"absolute","value":1698477648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477686}},{"address":{"type":"absolute","value":1698477705}}]},{"address":{"type":"absolute","value":1698477728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698477792}},{"address":{"type":"absolute","value":1698477808}}]},{"address":{"type":"absolute","value":1698477840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477979}},{"address":{"type":"absolute","value":1698478073}},{"address":{"type":"absolute","value":1698478173}},{"address":{"type":"absolute","value":1698478192}},{"address":{"type":"absolute","value":1698478368}},{"address":{"type":"absolute","value":1698478475}}]},{"address":{"type":"absolute","value":1698478560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698478611}},{"address":{"type":"absolute","value":1698478643}},{"address":{"type":"absolute","value":1698478658}},{"address":{"type":"absolute","value":1698478680}},{"address":{"type":"absolute","value":1698478688}},{"address":{"type":"absolute","value":1698478736}},{"address":{"type":"absolute","value":1698478770}}]},{"address":{"type":"absolute","value":1698478848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698478848}},{"address":{"type":"absolute","value":1698478944}},{"address":{"type":"absolute","value":1698478982}}]},{"address":{"type":"absolute","value":1698479024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479064}},{"address":{"type":"absolute","value":1698479076}}]},{"address":{"type":"absolute","value":1698479136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479176}},{"address":{"type":"absolute","value":1698479188}}]},{"address":{"type":"absolute","value":1698479248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479276}},{"address":{"type":"absolute","value":1698479340}},{"address":{"type":"absolute","value":1698479353}},{"address":{"type":"absolute","value":1698479364}},{"address":{"type":"absolute","value":1698479388}}]},{"address":{"type":"absolute","value":1698479408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479432}},{"address":{"type":"absolute","value":1698479441}}]},{"address":{"type":"absolute","value":1698479456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479492}}]},{"address":{"type":"absolute","value":1698479536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479604}},{"address":{"type":"absolute","value":1698479645}},{"address":{"type":"absolute","value":1698480059}},{"address":{"type":"absolute","value":1698480078}},{"address":{"type":"absolute","value":1698480150}},{"address":{"type":"absolute","value":1698480213}},{"address":{"type":"absolute","value":1698480480}}]},{"address":{"type":"absolute","value":1698480768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698480768}},{"address":{"type":"absolute","value":1698480801}},{"address":{"type":"absolute","value":1698480832}}]},{"address":{"type":"absolute","value":1698480848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698480912}},{"address":{"type":"absolute","value":1698480924}},{"address":{"type":"absolute","value":1698480960}},{"address":{"type":"absolute","value":1698480992}}]},{"address":{"type":"absolute","value":1698481024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698481230}},{"address":{"type":"absolute","value":1698481456}}]},{"address":{"type":"absolute","value":1698482016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482103}},{"address":{"type":"absolute","value":1698482165}},{"address":{"type":"absolute","value":1698482315}},{"address":{"type":"absolute","value":1698482352}},{"address":{"type":"absolute","value":1698482361}},{"address":{"type":"absolute","value":1698482400}},{"address":{"type":"absolute","value":1698482432}},{"address":{"type":"absolute","value":1698482464}},{"address":{"type":"absolute","value":1698482528}},{"address":{"type":"absolute","value":1698482560}},{"address":{"type":"absolute","value":1698482592}},{"address":{"type":"absolute","value":1698482624}},{"address":{"type":"absolute","value":1698482656}},{"address":{"type":"absolute","value":1698487168}},{"address":{"type":"absolute","value":1698487436}},{"address":{"type":"absolute","value":1698487466}},{"address":{"type":"absolute","value":1698487535}},{"address":{"type":"absolute","value":1698487632}},{"address":{"type":"absolute","value":1698487671}},{"address":{"type":"absolute","value":1698487680}},{"address":{"type":"absolute","value":1698487729}},{"address":{"type":"absolute","value":1698487749}},{"address":{"type":"absolute","value":1698487797}},{"address":{"type":"absolute","value":1698487837}},{"address":{"type":"absolute","value":1698487884}},{"address":{"type":"absolute","value":1698488032}},{"address":{"type":"absolute","value":1698488081}},{"address":{"type":"absolute","value":1698488098}},{"address":{"type":"absolute","value":1698488240}},{"address":{"type":"absolute","value":1698488297}},{"address":{"type":"absolute","value":1698488320}},{"address":{"type":"absolute","value":1698488392}},{"address":{"type":"absolute","value":1698489552}},{"address":{"type":"absolute","value":1698489706}},{"address":{"type":"absolute","value":1698489760}},{"address":{"type":"absolute","value":1698489872}},{"address":{"type":"absolute","value":1698489915}},{"address":{"type":"absolute","value":1698489933}},{"address":{"type":"absolute","value":1698490018}},{"address":{"type":"absolute","value":1698490054}},{"address":{"type":"absolute","value":1698490080}},{"address":{"type":"absolute","value":1698490114}},{"address":{"type":"absolute","value":1698490161}},{"address":{"type":"absolute","value":1698490225}},{"address":{"type":"absolute","value":1698490273}},{"address":{"type":"absolute","value":1698490301}},{"address":{"type":"absolute","value":1698490336}},{"address":{"type":"absolute","value":1698490366}},{"address":{"type":"absolute","value":1698490400}},{"address":{"type":"absolute","value":1698490435}},{"address":{"type":"absolute","value":1698490463}},{"address":{"type":"absolute","value":1698490484}},{"address":{"type":"absolute","value":1698490800}},{"address":{"type":"absolute","value":1698490856}},{"address":{"type":"absolute","value":1698490977}},{"address":{"type":"absolute","value":1698490993}},{"address":{"type":"absolute","value":1698491020}},{"address":{"type":"absolute","value":1698491056}},{"address":{"type":"absolute","value":1698491264}},{"address":{"type":"absolute","value":1698491293}},{"address":{"type":"absolute","value":1698491321}},{"address":{"type":"absolute","value":1698491379}},{"address":{"type":"absolute","value":1698491477}},{"address":{"type":"absolute","value":1698491525}},{"address":{"type":"absolute","value":1698491586}},{"address":{"type":"absolute","value":1698491608}},{"address":{"type":"absolute","value":1698491632}},{"address":{"type":"absolute","value":1698491654}},{"address":{"type":"absolute","value":1698491717}},{"address":{"type":"absolute","value":1698491764}},{"address":{"type":"absolute","value":1698491786}},{"address":{"type":"absolute","value":1698491808}},{"address":{"type":"absolute","value":1698491888}},{"address":{"type":"absolute","value":1698492007}},{"address":{"type":"absolute","value":1698492064}},{"address":{"type":"absolute","value":1698492085}},{"address":{"type":"absolute","value":1698492112}},{"address":{"type":"absolute","value":1698492134}},{"address":{"type":"absolute","value":1698492169}},{"address":{"type":"absolute","value":1698492336}},{"address":{"type":"absolute","value":1698492384}},{"address":{"type":"absolute","value":1698492448}},{"address":{"type":"absolute","value":1698492469}},{"address":{"type":"absolute","value":1698492496}},{"address":{"type":"absolute","value":1698492518}},{"address":{"type":"absolute","value":1698492574}},{"address":{"type":"absolute","value":1698492651}},{"address":{"type":"absolute","value":1698493136}},{"address":{"type":"absolute","value":1698493189}},{"address":{"type":"absolute","value":1698493238}},{"address":{"type":"absolute","value":1698493312}},{"address":{"type":"absolute","value":1698493415}},{"address":{"type":"absolute","value":1698493430}},{"address":{"type":"absolute","value":1698493439}},{"address":{"type":"absolute","value":1698493485}},{"address":{"type":"absolute","value":1698493524}},{"address":{"type":"absolute","value":1698493545}},{"address":{"type":"absolute","value":1698493564}},{"address":{"type":"absolute","value":1698495744}},{"address":{"type":"absolute","value":1698495798}},{"address":{"type":"absolute","value":1698495870}},{"address":{"type":"absolute","value":1698497984}},{"address":{"type":"absolute","value":1698498023}},{"address":{"type":"absolute","value":1698498091}},{"address":{"type":"absolute","value":1698498183}},{"address":{"type":"absolute","value":1698501104}},{"address":{"type":"absolute","value":1698501212}},{"address":{"type":"absolute","value":1698501221}},{"address":{"type":"absolute","value":1698501225}},{"address":{"type":"absolute","value":1698501265}},{"address":{"type":"absolute","value":1698501294}},{"address":{"type":"absolute","value":1698501317}},{"address":{"type":"absolute","value":1698501333}},{"address":{"type":"absolute","value":1698501349}},{"address":{"type":"absolute","value":1698501425}},{"address":{"type":"absolute","value":1698501441}},{"address":{"type":"absolute","value":1698501457}},{"address":{"type":"absolute","value":1698505216}},{"address":{"type":"absolute","value":1698505273}},{"address":{"type":"absolute","value":1698505294}},{"address":{"type":"absolute","value":1698505312}},{"address":{"type":"absolute","value":1698505364}},{"address":{"type":"absolute","value":1698505425}},{"address":{"type":"absolute","value":1698505454}},{"address":{"type":"absolute","value":1698510560}}]},{"address":{"type":"absolute","value":1698482784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}}]},{"address":{"type":"absolute","value":1698483136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483136}},{"address":{"type":"absolute","value":1698483175}},{"address":{"type":"absolute","value":1698483205}},{"address":{"type":"absolute","value":1698483220}},{"address":{"type":"absolute","value":1698483263}},{"address":{"type":"absolute","value":1698483280}},{"address":{"type":"absolute","value":1698483392}},{"address":{"type":"absolute","value":1698494236}},{"address":{"type":"absolute","value":1698494511}},{"address":{"type":"absolute","value":1698494528}},{"address":{"type":"absolute","value":1698500538}},{"address":{"type":"absolute","value":1698500606}},{"address":{"type":"absolute","value":1698500672}},{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}},{"address":{"type":"absolute","value":1698508461}},{"address":{"type":"absolute","value":1698508672}},{"address":{"type":"absolute","value":1698508745}},{"address":{"type":"absolute","value":1698508773}},{"address":{"type":"absolute","value":1698508783}},{"address":{"type":"absolute","value":1698508788}},{"address":{"type":"absolute","value":1698508806}},{"address":{"type":"absolute","value":1698508950}},{"address":{"type":"absolute","value":1698508994}},{"address":{"type":"absolute","value":1698509200}},{"address":{"type":"absolute","value":1698509218}},{"address":{"type":"absolute","value":1698509257}},{"address":{"type":"absolute","value":1698509272}}]},{"address":{"type":"absolute","value":1698483440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483476}},{"address":{"type":"absolute","value":1698483488}},{"address":{"type":"absolute","value":1698483523}}]},{"address":{"type":"absolute","value":1698483568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483598}},{"address":{"type":"absolute","value":1698483603}},{"address":{"type":"absolute","value":1698483632}}]},{"address":{"type":"absolute","value":1698483648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483648}},{"address":{"type":"absolute","value":1698483674}},{"address":{"type":"absolute","value":1698483693}},{"address":{"type":"absolute","value":1698483712}},{"address":{"type":"absolute","value":1698483728}},{"address":{"type":"absolute","value":1698483744}},{"address":{"type":"absolute","value":1698483776}},{"address":{"type":"absolute","value":1698495116}},{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}},{"address":{"type":"absolute","value":1698501536}},{"address":{"type":"absolute","value":1698501623}},{"address":{"type":"absolute","value":1698501628}},{"address":{"type":"absolute","value":1698501666}},{"address":{"type":"absolute","value":1698501713}},{"address":{"type":"absolute","value":1698504656}},{"address":{"type":"absolute","value":1698504708}},{"address":{"type":"absolute","value":1698504717}},{"address":{"type":"absolute","value":1698504769}},{"address":{"type":"absolute","value":1698504780}},{"address":{"type":"absolute","value":1698504792}},{"address":{"type":"absolute","value":1698504800}},{"address":{"type":"absolute","value":1698504839}},{"address":{"type":"absolute","value":1698509296}},{"address":{"type":"absolute","value":1698509336}},{"address":{"type":"absolute","value":1698509414}},{"address":{"type":"absolute","value":1698509478}},{"address":{"type":"absolute","value":1698509518}},{"address":{"type":"absolute","value":1698509555}},{"address":{"type":"absolute","value":1698509699}},{"address":{"type":"absolute","value":1698509765}},{"address":{"type":"absolute","value":1698509824}},{"address":{"type":"absolute","value":1698509856}},{"address":{"type":"absolute","value":1698509869}},{"address":{"type":"absolute","value":1698509942}},{"address":{"type":"absolute","value":1698510121}},{"address":{"type":"absolute","value":1698510387}},{"address":{"type":"absolute","value":1698510426}},{"address":{"type":"absolute","value":1698510448}},{"address":{"type":"absolute","value":1698510457}}]},{"address":{"type":"absolute","value":1698483792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483792}},{"address":{"type":"absolute","value":1698483818}},{"address":{"type":"absolute","value":1698483837}},{"address":{"type":"absolute","value":1698483856}},{"address":{"type":"absolute","value":1698483872}},{"address":{"type":"absolute","value":1698483888}},{"address":{"type":"absolute","value":1698483920}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510608}},{"address":{"type":"absolute","value":1698510688}},{"address":{"type":"absolute","value":1698510800}}]},{"address":{"type":"absolute","value":1698483936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483936}},{"address":{"type":"absolute","value":1698483962}},{"address":{"type":"absolute","value":1698483981}},{"address":{"type":"absolute","value":1698484000}},{"address":{"type":"absolute","value":1698484016}},{"address":{"type":"absolute","value":1698484032}},{"address":{"type":"absolute","value":1698484064}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510928}},{"address":{"type":"absolute","value":1698510984}},{"address":{"type":"absolute","value":1698510993}}]},{"address":{"type":"absolute","value":1698484080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698484080}},{"address":{"type":"absolute","value":1698484102}},{"address":{"type":"absolute","value":1698484536}}]},{"address":{"type":"absolute","value":1698485696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698485696}},{"address":{"type":"absolute","value":1698485720}},{"address":{"type":"absolute","value":1698485785}},{"address":{"type":"absolute","value":1698485844}},{"address":{"type":"absolute","value":1698485920}}]},{"address":{"type":"absolute","value":1698485952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698485952}}]},{"address":{"type":"absolute","value":1698486000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486000}}]},{"address":{"type":"absolute","value":1698486048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486096}},{"address":{"type":"absolute","value":1698486109}},{"address":{"type":"absolute","value":1698486128}}]},{"address":{"type":"absolute","value":1698486144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486196}},{"address":{"type":"absolute","value":1698486220}},{"address":{"type":"absolute","value":1698486271}},{"address":{"type":"absolute","value":1698486316}}]},{"address":{"type":"absolute","value":1698486368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486368}},{"address":{"type":"absolute","value":1698486528}},{"address":{"type":"absolute","value":1698486674}},{"address":{"type":"absolute","value":1698486680}},{"address":{"type":"absolute","value":1698486705}},{"address":{"type":"absolute","value":1698486743}},{"address":{"type":"absolute","value":1698486832}},{"address":{"type":"absolute","value":1698486854}},{"address":{"type":"absolute","value":1698486930}},{"address":{"type":"absolute","value":1698486958}},{"address":{"type":"absolute","value":1698487013}}]},{"address":{"type":"absolute","value":1698487168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698487168}},{"address":{"type":"absolute","value":1698487436}},{"address":{"type":"absolute","value":1698487466}},{"address":{"type":"absolute","value":1698487535}},{"address":{"type":"absolute","value":1698487632}},{"address":{"type":"absolute","value":1698487671}},{"address":{"type":"absolute","value":1698487680}},{"address":{"type":"absolute","value":1698487729}},{"address":{"type":"absolute","value":1698487749}},{"address":{"type":"absolute","value":1698487797}},{"address":{"type":"absolute","value":1698487837}},{"address":{"type":"absolute","value":1698487884}},{"address":{"type":"absolute","value":1698488032}},{"address":{"type":"absolute","value":1698488081}},{"address":{"type":"absolute","value":1698488098}},{"address":{"type":"absolute","value":1698488240}},{"address":{"type":"absolute","value":1698488297}},{"address":{"type":"absolute","value":1698488320}},{"address":{"type":"absolute","value":1698488392}}]},{"address":{"type":"absolute","value":1698488592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698488592}},{"address":{"type":"absolute","value":1698488747}},{"address":{"type":"absolute","value":1698488800}},{"address":{"type":"absolute","value":1698488912}},{"address":{"type":"absolute","value":1698488952}},{"address":{"type":"absolute","value":1698488970}},{"address":{"type":"absolute","value":1698489056}},{"address":{"type":"absolute","value":1698489089}},{"address":{"type":"absolute","value":1698489108}},{"address":{"type":"absolute","value":1698489139}},{"address":{"type":"absolute","value":1698489186}},{"address":{"type":"absolute","value":1698489249}},{"address":{"type":"absolute","value":1698489297}},{"address":{"type":"absolute","value":1698489322}},{"address":{"type":"absolute","value":1698489346}},{"address":{"type":"absolute","value":1698489371}},{"address":{"type":"absolute","value":1698489408}},{"address":{"type":"absolute","value":1698489443}},{"address":{"type":"absolute","value":1698489468}},{"address":{"type":"absolute","value":1698489488}}]},{"address":{"type":"absolute","value":1698489552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698489552}},{"address":{"type":"absolute","value":1698489706}},{"address":{"type":"absolute","value":1698489760}},{"address":{"type":"absolute","value":1698489872}},{"address":{"type":"absolute","value":1698489915}},{"address":{"type":"absolute","value":1698489933}},{"address":{"type":"absolute","value":1698490018}},{"address":{"type":"absolute","value":1698490054}},{"address":{"type":"absolute","value":1698490080}},{"address":{"type":"absolute","value":1698490114}},{"address":{"type":"absolute","value":1698490161}},{"address":{"type":"absolute","value":1698490225}},{"address":{"type":"absolute","value":1698490273}},{"address":{"type":"absolute","value":1698490301}},{"address":{"type":"absolute","value":1698490336}},{"address":{"type":"absolute","value":1698490366}},{"address":{"type":"absolute","value":1698490400}},{"address":{"type":"absolute","value":1698490435}},{"address":{"type":"absolute","value":1698490463}},{"address":{"type":"absolute","value":1698490484}}]},{"address":{"type":"absolute","value":1698490544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698490544}},{"address":{"type":"absolute","value":1698490600}},{"address":{"type":"absolute","value":1698490720}},{"address":{"type":"absolute","value":1698490739}},{"address":{"type":"absolute","value":1698490766}}]},{"address":{"type":"absolute","value":1698490800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698490800}},{"address":{"type":"absolute","value":1698490856}},{"address":{"type":"absolute","value":1698490977}},{"address":{"type":"absolute","value":1698490993}},{"address":{"type":"absolute","value":1698491020}}]},{"address":{"type":"absolute","value":1698491056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698491056}},{"address":{"type":"absolute","value":1698491264}},{"address":{"type":"absolute","value":1698491293}},{"address":{"type":"absolute","value":1698491321}},{"address":{"type":"absolute","value":1698491379}},{"address":{"type":"absolute","value":1698491477}},{"address":{"type":"absolute","value":1698491525}},{"address":{"type":"absolute","value":1698491586}},{"address":{"type":"absolute","value":1698491608}},{"address":{"type":"absolute","value":1698491632}},{"address":{"type":"absolute","value":1698491654}},{"address":{"type":"absolute","value":1698491717}},{"address":{"type":"absolute","value":1698491764}},{"address":{"type":"absolute","value":1698491786}},{"address":{"type":"absolute","value":1698491808}}]},{"address":{"type":"absolute","value":1698491888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698491888}},{"address":{"type":"absolute","value":1698492007}},{"address":{"type":"absolute","value":1698492064}},{"address":{"type":"absolute","value":1698492085}},{"address":{"type":"absolute","value":1698492112}},{"address":{"type":"absolute","value":1698492134}},{"address":{"type":"absolute","value":1698492169}},{"address":{"type":"absolute","value":1698492336}},{"address":{"type":"absolute","value":1698492384}},{"address":{"type":"absolute","value":1698492448}},{"address":{"type":"absolute","value":1698492469}},{"address":{"type":"absolute","value":1698492496}},{"address":{"type":"absolute","value":1698492518}},{"address":{"type":"absolute","value":1698492574}},{"address":{"type":"absolute","value":1698492651}}]},{"address":{"type":"absolute","value":1698492736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698492736}},{"address":{"type":"absolute","value":1698492831}},{"address":{"type":"absolute","value":1698493022}},{"address":{"type":"absolute","value":1698493031}},{"address":{"type":"absolute","value":1698493088}}]},{"address":{"type":"absolute","value":1698493136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698493136}},{"address":{"type":"absolute","value":1698493189}},{"address":{"type":"absolute","value":1698493238}},{"address":{"type":"absolute","value":1698493312}},{"address":{"type":"absolute","value":1698493415}},{"address":{"type":"absolute","value":1698493430}},{"address":{"type":"absolute","value":1698493439}},{"address":{"type":"absolute","value":1698493485}},{"address":{"type":"absolute","value":1698493524}},{"address":{"type":"absolute","value":1698493545}},{"address":{"type":"absolute","value":1698493564}}]},{"address":{"type":"absolute","value":1698493632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698493730}},{"address":{"type":"absolute","value":1698493872}},{"address":{"type":"absolute","value":1698493962}},{"address":{"type":"absolute","value":1698494005}},{"address":{"type":"absolute","value":1698494064}}]},{"address":{"type":"absolute","value":1698494208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698494236}},{"address":{"type":"absolute","value":1698494511}},{"address":{"type":"absolute","value":1698494528}}]},{"address":{"type":"absolute","value":1698494544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698494544}},{"address":{"type":"absolute","value":1698494621}},{"address":{"type":"absolute","value":1698494643}},{"address":{"type":"absolute","value":1698494721}},{"address":{"type":"absolute","value":1698494884}},{"address":{"type":"absolute","value":1698494928}},{"address":{"type":"absolute","value":1698494937}},{"address":{"type":"absolute","value":1698494992}}]},{"address":{"type":"absolute","value":1698495024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495116}}]},{"address":{"type":"absolute","value":1698495136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}}]},{"address":{"type":"absolute","value":1698495504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}}]},{"address":{"type":"absolute","value":1698495520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}}]},{"address":{"type":"absolute","value":1698495536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698491888}},{"address":{"type":"absolute","value":1698492007}},{"address":{"type":"absolute","value":1698492064}},{"address":{"type":"absolute","value":1698492085}},{"address":{"type":"absolute","value":1698492112}},{"address":{"type":"absolute","value":1698492134}},{"address":{"type":"absolute","value":1698492169}},{"address":{"type":"absolute","value":1698492336}},{"address":{"type":"absolute","value":1698492384}},{"address":{"type":"absolute","value":1698492448}},{"address":{"type":"absolute","value":1698492469}},{"address":{"type":"absolute","value":1698492496}},{"address":{"type":"absolute","value":1698492518}},{"address":{"type":"absolute","value":1698492574}},{"address":{"type":"absolute","value":1698492651}},{"address":{"type":"absolute","value":1698495536}},{"address":{"type":"absolute","value":1698495589}},{"address":{"type":"absolute","value":1698495643}},{"address":{"type":"absolute","value":1698495680}},{"address":{"type":"absolute","value":1698495696}},{"address":{"type":"absolute","value":1698495712}}]},{"address":{"type":"absolute","value":1698495744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495744}},{"address":{"type":"absolute","value":1698495798}},{"address":{"type":"absolute","value":1698495870}}]},{"address":{"type":"absolute","value":1698495904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495904}},{"address":{"type":"absolute","value":1698495989}},{"address":{"type":"absolute","value":1698496016}},{"address":{"type":"absolute","value":1698496080}},{"address":{"type":"absolute","value":1698496101}},{"address":{"type":"absolute","value":1698496117}},{"address":{"type":"absolute","value":1698496128}},{"address":{"type":"absolute","value":1698496192}},{"address":{"type":"absolute","value":1698496213}},{"address":{"type":"absolute","value":1698496243}},{"address":{"type":"absolute","value":1698496296}}]},{"address":{"type":"absolute","value":1698496368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}}]},{"address":{"type":"absolute","value":1698497376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}}]},{"address":{"type":"absolute","value":1698497504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}}]},{"address":{"type":"absolute","value":1698497680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497680}},{"address":{"type":"absolute","value":1698497715}},{"address":{"type":"absolute","value":1698497849}},{"address":{"type":"absolute","value":1698497915}}]},{"address":{"type":"absolute","value":1698497936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497984}},{"address":{"type":"absolute","value":1698498023}},{"address":{"type":"absolute","value":1698498091}},{"address":{"type":"absolute","value":1698498183}}]},{"address":{"type":"absolute","value":1698498240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698498358}},{"address":{"type":"absolute","value":1698498388}},{"address":{"type":"absolute","value":1698498441}},{"address":{"type":"absolute","value":1698498488}},{"address":{"type":"absolute","value":1698498544}},{"address":{"type":"absolute","value":1698498608}}]},{"address":{"type":"absolute","value":1698498752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}}]},{"address":{"type":"absolute","value":1698499424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499751}}]},{"address":{"type":"absolute","value":1698499824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499824}},{"address":{"type":"absolute","value":1698499891}},{"address":{"type":"absolute","value":1698500020}},{"address":{"type":"absolute","value":1698500101}},{"address":{"type":"absolute","value":1698500160}},{"address":{"type":"absolute","value":1698500197}},{"address":{"type":"absolute","value":1698500205}},{"address":{"type":"absolute","value":1698501856}}]},{"address":{"type":"absolute","value":1698500224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698500538}},{"address":{"type":"absolute","value":1698500606}},{"address":{"type":"absolute","value":1698500672}}]},{"address":{"type":"absolute","value":1698500704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698500704}},{"address":{"type":"absolute","value":1698500828}},{"address":{"type":"absolute","value":1698500841}},{"address":{"type":"absolute","value":1698500850}},{"address":{"type":"absolute","value":1698500890}},{"address":{"type":"absolute","value":1698500926}},{"address":{"type":"absolute","value":1698500977}},{"address":{"type":"absolute","value":1698501061}}]},{"address":{"type":"absolute","value":1698501104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497984}},{"address":{"type":"absolute","value":1698498023}},{"address":{"type":"absolute","value":1698498091}},{"address":{"type":"absolute","value":1698498183}},{"address":{"type":"absolute","value":1698501104}},{"address":{"type":"absolute","value":1698501212}},{"address":{"type":"absolute","value":1698501221}},{"address":{"type":"absolute","value":1698501225}},{"address":{"type":"absolute","value":1698501265}},{"address":{"type":"absolute","value":1698501294}},{"address":{"type":"absolute","value":1698501317}},{"address":{"type":"absolute","value":1698501333}},{"address":{"type":"absolute","value":1698501349}},{"address":{"type":"absolute","value":1698501425}},{"address":{"type":"absolute","value":1698501441}},{"address":{"type":"absolute","value":1698501457}}]},{"address":{"type":"absolute","value":1698501536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698501536}},{"address":{"type":"absolute","value":1698501623}},{"address":{"type":"absolute","value":1698501628}},{"address":{"type":"absolute","value":1698501666}},{"address":{"type":"absolute","value":1698501713}}]},{"address":{"type":"absolute","value":1698501776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}}]},{"address":{"type":"absolute","value":1698501808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}}]},{"address":{"type":"absolute","value":1698501856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698501856}}]},{"address":{"type":"absolute","value":1698502768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698502883}},{"address":{"type":"absolute","value":1698502896}},{"address":{"type":"absolute","value":1698503407}},{"address":{"type":"absolute","value":1698503558}},{"address":{"type":"absolute","value":1698503584}}]},{"address":{"type":"absolute","value":1698503872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698503891}}]},{"address":{"type":"absolute","value":1698503952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}}]},{"address":{"type":"absolute","value":1698504240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}}]},{"address":{"type":"absolute","value":1698504656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504656}},{"address":{"type":"absolute","value":1698504708}},{"address":{"type":"absolute","value":1698504717}},{"address":{"type":"absolute","value":1698504769}},{"address":{"type":"absolute","value":1698504780}},{"address":{"type":"absolute","value":1698504792}},{"address":{"type":"absolute","value":1698504800}},{"address":{"type":"absolute","value":1698504839}}]},{"address":{"type":"absolute","value":1698504896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504896}},{"address":{"type":"absolute","value":1698504953}},{"address":{"type":"absolute","value":1698504974}},{"address":{"type":"absolute","value":1698504992}},{"address":{"type":"absolute","value":1698505044}},{"address":{"type":"absolute","value":1698505105}},{"address":{"type":"absolute","value":1698505134}}]},{"address":{"type":"absolute","value":1698505216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505216}},{"address":{"type":"absolute","value":1698505273}},{"address":{"type":"absolute","value":1698505294}},{"address":{"type":"absolute","value":1698505312}},{"address":{"type":"absolute","value":1698505364}},{"address":{"type":"absolute","value":1698505425}},{"address":{"type":"absolute","value":1698505454}}]},{"address":{"type":"absolute","value":1698505536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}}]},{"address":{"type":"absolute","value":1698505552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}}]},{"address":{"type":"absolute","value":1698505616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}}]},{"address":{"type":"absolute","value":1698505648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505664}}]},{"address":{"type":"absolute","value":1698505696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505755}},{"address":{"type":"absolute","value":1698505824}},{"address":{"type":"absolute","value":1698505884}},{"address":{"type":"absolute","value":1698505889}}]},{"address":{"type":"absolute","value":1698505984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505984}},{"address":{"type":"absolute","value":1698506006}},{"address":{"type":"absolute","value":1698506046}},{"address":{"type":"absolute","value":1698506092}},{"address":{"type":"absolute","value":1698506211}},{"address":{"type":"absolute","value":1698506217}},{"address":{"type":"absolute","value":1698506242}},{"address":{"type":"absolute","value":1698506283}},{"address":{"type":"absolute","value":1698506295}},{"address":{"type":"absolute","value":1698506416}},{"address":{"type":"absolute","value":1698506467}}]},{"address":{"type":"absolute","value":1698506528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698506528}},{"address":{"type":"absolute","value":1698506731}},{"address":{"type":"absolute","value":1698506918}},{"address":{"type":"absolute","value":1698506924}},{"address":{"type":"absolute","value":1698506953}},{"address":{"type":"absolute","value":1698507057}},{"address":{"type":"absolute","value":1698507069}},{"address":{"type":"absolute","value":1698507110}},{"address":{"type":"absolute","value":1698507184}},{"address":{"type":"absolute","value":1698507211}},{"address":{"type":"absolute","value":1698507500}},{"address":{"type":"absolute","value":1698507506}},{"address":{"type":"absolute","value":1698507584}},{"address":{"type":"absolute","value":1698507898}},{"address":{"type":"absolute","value":1698507958}},{"address":{"type":"absolute","value":1698508015}},{"address":{"type":"absolute","value":1698508038}},{"address":{"type":"absolute","value":1698508087}},{"address":{"type":"absolute","value":1698508115}},{"address":{"type":"absolute","value":1698508134}},{"address":{"type":"absolute","value":1698508155}},{"address":{"type":"absolute","value":1698508174}},{"address":{"type":"absolute","value":1698508186}}]},{"address":{"type":"absolute","value":1698508336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698508461}},{"address":{"type":"absolute","value":1698508672}},{"address":{"type":"absolute","value":1698508745}},{"address":{"type":"absolute","value":1698508773}},{"address":{"type":"absolute","value":1698508783}},{"address":{"type":"absolute","value":1698508788}},{"address":{"type":"absolute","value":1698508806}},{"address":{"type":"absolute","value":1698508950}},{"address":{"type":"absolute","value":1698508994}},{"address":{"type":"absolute","value":1698509200}},{"address":{"type":"absolute","value":1698509218}},{"address":{"type":"absolute","value":1698509257}},{"address":{"type":"absolute","value":1698509272}}]},{"address":{"type":"absolute","value":1698509296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698509296}},{"address":{"type":"absolute","value":1698509336}},{"address":{"type":"absolute","value":1698509414}},{"address":{"type":"absolute","value":1698509478}},{"address":{"type":"absolute","value":1698509518}},{"address":{"type":"absolute","value":1698509555}},{"address":{"type":"absolute","value":1698509699}},{"address":{"type":"absolute","value":1698509765}},{"address":{"type":"absolute","value":1698509824}},{"address":{"type":"absolute","value":1698509856}},{"address":{"type":"absolute","value":1698509869}},{"address":{"type":"absolute","value":1698509942}},{"address":{"type":"absolute","value":1698510121}},{"address":{"type":"absolute","value":1698510387}},{"address":{"type":"absolute","value":1698510426}},{"address":{"type":"absolute","value":1698510448}},{"address":{"type":"absolute","value":1698510457}}]},{"address":{"type":"absolute","value":1698510512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510512}}]},{"address":{"type":"absolute","value":1698510560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510560}}]},{"address":{"type":"absolute","value":1698510608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510608}},{"address":{"type":"absolute","value":1698510688}},{"address":{"type":"absolute","value":1698510800}}]},{"address":{"type":"absolute","value":1698510864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510928}},{"address":{"type":"absolute","value":1698510984}},{"address":{"type":"absolute","value":1698510993}}]},{"address":{"type":"absolute","value":1698511040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698511253}},{"address":{"type":"absolute","value":1698511424}},{"address":{"type":"absolute","value":1698511429}},{"address":{"type":"absolute","value":1698511480}},{"address":{"type":"absolute","value":1698511578}},{"address":{"type":"absolute","value":1698511637}},{"address":{"type":"absolute","value":1698511697}},{"address":{"type":"absolute","value":1698511792}},{"address":{"type":"absolute","value":1698511849}},{"address":{"type":"absolute","value":1698511881}},{"address":{"type":"absolute","value":1698511900}},{"address":{"type":"absolute","value":1698512080}},{"address":{"type":"absolute","value":1698512220}}]},{"address":{"type":"absolute","value":1698512416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698512416}},{"address":{"type":"absolute","value":1698512451}},{"address":{"type":"absolute","value":1698512461}}]},{"address":{"type":"absolute","value":1698512480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698512601}},{"address":{"type":"absolute","value":1698512642}},{"address":{"type":"absolute","value":1698512741}},{"address":{"type":"absolute","value":1698512800}},{"address":{"type":"absolute","value":1698512821}},{"address":{"type":"absolute","value":1698512848}},{"address":{"type":"absolute","value":1698513152}},{"address":{"type":"absolute","value":1698513200}},{"address":{"type":"absolute","value":1698513222}},{"address":{"type":"absolute","value":1698513381}}]},{"address":{"type":"absolute","value":1698513520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698513640}},{"address":{"type":"absolute","value":1698513681}},{"address":{"type":"absolute","value":1698513780}},{"address":{"type":"absolute","value":1698513856}},{"address":{"type":"absolute","value":1698513881}},{"address":{"type":"absolute","value":1698513906}},{"address":{"type":"absolute","value":1698514212}},{"address":{"type":"absolute","value":1698514272}},{"address":{"type":"absolute","value":1698514296}},{"address":{"type":"absolute","value":1698514436}}]},{"address":{"type":"absolute","value":1698514576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698514576}},{"address":{"type":"absolute","value":1698514694}},{"address":{"type":"absolute","value":1698514735}},{"address":{"type":"absolute","value":1698514905}},{"address":{"type":"absolute","value":1698514928}},{"address":{"type":"absolute","value":1698515054}},{"address":{"type":"absolute","value":1698515237}},{"address":{"type":"absolute","value":1698515312}},{"address":{"type":"absolute","value":1698515328}},{"address":{"type":"absolute","value":1698515366}},{"address":{"type":"absolute","value":1698515647}},{"address":{"type":"absolute","value":1698515731}},{"address":{"type":"absolute","value":1698515747}},{"address":{"type":"absolute","value":1698515782}},{"address":{"type":"absolute","value":1698515932}},{"address":{"type":"absolute","value":1698515966}}]},{"address":{"type":"absolute","value":1698516064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516128}},{"address":{"type":"absolute","value":1698516152}},{"address":{"type":"absolute","value":1698516164}}]},{"address":{"type":"absolute","value":1698516192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516352}}]},{"address":{"type":"absolute","value":1698516400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516400}}]},{"address":{"type":"absolute","value":1698516448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516473}},{"address":{"type":"absolute","value":1698516480}}]},{"address":{"type":"absolute","value":1698516496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516560}}]},{"address":{"type":"absolute","value":1698516624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516702}},{"address":{"type":"absolute","value":1698516722}}]},{"address":{"type":"absolute","value":1698516752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516833}},{"address":{"type":"absolute","value":1698516853}}]},{"address":{"type":"absolute","value":1698516880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516961}},{"address":{"type":"absolute","value":1698516981}}]},{"address":{"type":"absolute","value":1698517008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517079}},{"address":{"type":"absolute","value":1698517104}}]},{"address":{"type":"absolute","value":1698517136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517190}},{"address":{"type":"absolute","value":1698517216}}]},{"address":{"type":"absolute","value":1698517248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517389}}]},{"address":{"type":"absolute","value":1698517504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517557}}]},{"address":{"type":"absolute","value":1698517568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517700}},{"address":{"type":"absolute","value":1698517761}},{"address":{"type":"absolute","value":1698517827}},{"address":{"type":"absolute","value":1698518024}},{"address":{"type":"absolute","value":1698518048}}]},{"address":{"type":"absolute","value":1698518256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518351}},{"address":{"type":"absolute","value":1698518398}}]},{"address":{"type":"absolute","value":1698518416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518416}},{"address":{"type":"absolute","value":1698518471}},{"address":{"type":"absolute","value":1698518490}}]},{"address":{"type":"absolute","value":1698518512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518597}}]},{"address":{"type":"absolute","value":1698518688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518688}},{"address":{"type":"absolute","value":1698518708}},{"address":{"type":"absolute","value":1698518857}}]},{"address":{"type":"absolute","value":1698519808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698519824}},{"address":{"type":"absolute","value":1698519859}},{"address":{"type":"absolute","value":1698519888}},{"address":{"type":"absolute","value":1698519904}},{"address":{"type":"absolute","value":1698519920}},{"address":{"type":"absolute","value":1699037472}},{"address":{"type":"absolute","value":1699037560}},{"address":{"type":"absolute","value":1699037745}},{"address":{"type":"absolute","value":1699037781}}]},{"address":{"type":"absolute","value":1698519936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698519961}},{"address":{"type":"absolute","value":1698519989}},{"address":{"type":"absolute","value":1698519998}},{"address":{"type":"absolute","value":1698520013}},{"address":{"type":"absolute","value":1698520022}}]},{"address":{"type":"absolute","value":1698520032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520032}},{"address":{"type":"absolute","value":1698520112}},{"address":{"type":"absolute","value":1698520142}},{"address":{"type":"absolute","value":1698520219}},{"address":{"type":"absolute","value":1698520255}}]},{"address":{"type":"absolute","value":1698520384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520384}}]},{"address":{"type":"absolute","value":1698520432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520480}},{"address":{"type":"absolute","value":1698520545}}]},{"address":{"type":"absolute","value":1698520624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520754}},{"address":{"type":"absolute","value":1698520877}}]},{"address":{"type":"absolute","value":1698521824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698521947}},{"address":{"type":"absolute","value":1698521968}}]},{"address":{"type":"absolute","value":1698522000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698522073}},{"address":{"type":"absolute","value":1698522130}},{"address":{"type":"absolute","value":1698522160}}]},{"address":{"type":"absolute","value":1698522176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698522352}},{"address":{"type":"absolute","value":1698522458}},{"address":{"type":"absolute","value":1698522501}}]},{"address":{"type":"absolute","value":1698522624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698522784}},{"address":{"type":"absolute","value":1698522829}},{"address":{"type":"absolute","value":1698522937}},{"address":{"type":"absolute","value":1698523093}}]},{"address":{"type":"absolute","value":1698523424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698523424}}]},{"address":{"type":"absolute","value":1698523520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698523536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698523834}},{"address":{"type":"absolute","value":1698523868}},{"address":{"type":"absolute","value":1698523970}},{"address":{"type":"absolute","value":1698524149}},{"address":{"type":"absolute","value":1698524278}},{"address":{"type":"absolute","value":1698524761}},{"address":{"type":"absolute","value":1698524876}},{"address":{"type":"absolute","value":1698524948}},{"address":{"type":"absolute","value":1698525232}},{"address":{"type":"absolute","value":1698525573}},{"address":{"type":"absolute","value":1698525582}},{"address":{"type":"absolute","value":1698525596}}]},{"address":{"type":"absolute","value":1698526688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698526807}}]},{"address":{"type":"absolute","value":1698526960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527003}}]},{"address":{"type":"absolute","value":1698527072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1698527328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527412}},{"address":{"type":"absolute","value":1698527436}},{"address":{"type":"absolute","value":1698527456}},{"address":{"type":"absolute","value":1698527498}},{"address":{"type":"absolute","value":1698527519}},{"address":{"type":"absolute","value":1698527623}}]},{"address":{"type":"absolute","value":1698527648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527726}},{"address":{"type":"absolute","value":1698527850}}]},{"address":{"type":"absolute","value":1698527968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527968}},{"address":{"type":"absolute","value":1698528039}},{"address":{"type":"absolute","value":1698528227}}]},{"address":{"type":"absolute","value":1698528288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}}]},{"address":{"type":"absolute","value":1698528432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528432}}]},{"address":{"type":"absolute","value":1698528480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528525}},{"address":{"type":"absolute","value":1698528533}}]},{"address":{"type":"absolute","value":1698528640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528725}},{"address":{"type":"absolute","value":1698528755}},{"address":{"type":"absolute","value":1698528788}},{"address":{"type":"absolute","value":1698528860}},{"address":{"type":"absolute","value":1698528866}},{"address":{"type":"absolute","value":1698528928}},{"address":{"type":"absolute","value":1698528961}},{"address":{"type":"absolute","value":1698528976}}]},{"address":{"type":"absolute","value":1698528992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529028}}]},{"address":{"type":"absolute","value":1698529072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529096}},{"address":{"type":"absolute","value":1698529121}}]},{"address":{"type":"absolute","value":1698529136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527412}},{"address":{"type":"absolute","value":1698527436}},{"address":{"type":"absolute","value":1698527456}},{"address":{"type":"absolute","value":1698527498}},{"address":{"type":"absolute","value":1698527519}},{"address":{"type":"absolute","value":1698527623}}]},{"address":{"type":"absolute","value":1698529152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529221}},{"address":{"type":"absolute","value":1698529410}},{"address":{"type":"absolute","value":1698529484}}]},{"address":{"type":"absolute","value":1698529632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529709}},{"address":{"type":"absolute","value":1698529772}}]},{"address":{"type":"absolute","value":1698529792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1698529808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698526807}}]},{"address":{"type":"absolute","value":1698529824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529824}},{"address":{"type":"absolute","value":1698529848}},{"address":{"type":"absolute","value":1698529856}},{"address":{"type":"absolute","value":1698529872}},{"address":{"type":"absolute","value":1698529888}}]},{"address":{"type":"absolute","value":1698529904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527003}},{"address":{"type":"absolute","value":1698528525}},{"address":{"type":"absolute","value":1698528533}}]},{"address":{"type":"absolute","value":1698529936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}},{"address":{"type":"absolute","value":1698529936}}]},{"address":{"type":"absolute","value":1698529968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530066}},{"address":{"type":"absolute","value":1698530112}},{"address":{"type":"absolute","value":1698530128}}]},{"address":{"type":"absolute","value":1698530160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530160}}]},{"address":{"type":"absolute","value":1698530224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530224}},{"address":{"type":"absolute","value":1698530261}},{"address":{"type":"absolute","value":1698530373}},{"address":{"type":"absolute","value":1698530427}},{"address":{"type":"absolute","value":1698530448}},{"address":{"type":"absolute","value":1698530512}},{"address":{"type":"absolute","value":1698530544}}]},{"address":{"type":"absolute","value":1698530672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530928}},{"address":{"type":"absolute","value":1698531088}},{"address":{"type":"absolute","value":1698531158}},{"address":{"type":"absolute","value":1698531216}},{"address":{"type":"absolute","value":1698531362}},{"address":{"type":"absolute","value":1698531441}},{"address":{"type":"absolute","value":1698531651}},{"address":{"type":"absolute","value":1698531772}}]},{"address":{"type":"absolute","value":1698531920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698531963}},{"address":{"type":"absolute","value":1698531995}},{"address":{"type":"absolute","value":1698532025}},{"address":{"type":"absolute","value":1698532048}},{"address":{"type":"absolute","value":1698532080}},{"address":{"type":"absolute","value":1698532164}},{"address":{"type":"absolute","value":1698532176}},{"address":{"type":"absolute","value":1698532240}},{"address":{"type":"absolute","value":1698532256}},{"address":{"type":"absolute","value":1698532341}},{"address":{"type":"absolute","value":1698532370}}]},{"address":{"type":"absolute","value":1698532496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532578}}]},{"address":{"type":"absolute","value":1698532592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532628}}]},{"address":{"type":"absolute","value":1698532768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532816}},{"address":{"type":"absolute","value":1698532829}},{"address":{"type":"absolute","value":1698532848}}]},{"address":{"type":"absolute","value":1698532944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532996}},{"address":{"type":"absolute","value":1698533044}}]},{"address":{"type":"absolute","value":1698533152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533152}},{"address":{"type":"absolute","value":1698533187}},{"address":{"type":"absolute","value":1698533257}},{"address":{"type":"absolute","value":1698533269}},{"address":{"type":"absolute","value":1698533333}},{"address":{"type":"absolute","value":1698533357}},{"address":{"type":"absolute","value":1698533377}},{"address":{"type":"absolute","value":1698533429}}]},{"address":{"type":"absolute","value":1698533568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533616}},{"address":{"type":"absolute","value":1698533629}},{"address":{"type":"absolute","value":1698533648}}]},{"address":{"type":"absolute","value":1698533664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533700}},{"address":{"type":"absolute","value":1698533729}},{"address":{"type":"absolute","value":1698533744}}]},{"address":{"type":"absolute","value":1698533760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533796}}]},{"address":{"type":"absolute","value":1698533840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533869}},{"address":{"type":"absolute","value":1698533928}},{"address":{"type":"absolute","value":1698533940}},{"address":{"type":"absolute","value":1698534129}}]},{"address":{"type":"absolute","value":1698534208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698534240}},{"address":{"type":"absolute","value":1698534292}}]},{"address":{"type":"absolute","value":1698534560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534596}}]},{"address":{"type":"absolute","value":1698534640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534676}}]},{"address":{"type":"absolute","value":1698534768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534768}},{"address":{"type":"absolute","value":1698534836}},{"address":{"type":"absolute","value":1698534853}},{"address":{"type":"absolute","value":1698534888}},{"address":{"type":"absolute","value":1698534912}}]},{"address":{"type":"absolute","value":1698535056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532628}}]},{"address":{"type":"absolute","value":1698535088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535088}},{"address":{"type":"absolute","value":1698535152}},{"address":{"type":"absolute","value":1698535195}}]},{"address":{"type":"absolute","value":1698535232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535232}},{"address":{"type":"absolute","value":1698535279}},{"address":{"type":"absolute","value":1698535301}}]},{"address":{"type":"absolute","value":1698535344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535344}}]},{"address":{"type":"absolute","value":1698535376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535376}}]},{"address":{"type":"absolute","value":1698535408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530928}},{"address":{"type":"absolute","value":1698531088}},{"address":{"type":"absolute","value":1698531158}},{"address":{"type":"absolute","value":1698531216}},{"address":{"type":"absolute","value":1698531362}},{"address":{"type":"absolute","value":1698531441}},{"address":{"type":"absolute","value":1698531651}},{"address":{"type":"absolute","value":1698531772}}]},{"address":{"type":"absolute","value":1698535424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535424}}]},{"address":{"type":"absolute","value":1698535456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535456}},{"address":{"type":"absolute","value":1698535493}},{"address":{"type":"absolute","value":1698535538}}]},{"address":{"type":"absolute","value":1698535552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535552}},{"address":{"type":"absolute","value":1698535579}}]},{"address":{"type":"absolute","value":1698535600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535600}},{"address":{"type":"absolute","value":1698535627}}]},{"address":{"type":"absolute","value":1698535648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}}]},{"address":{"type":"absolute","value":1698535664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}}]},{"address":{"type":"absolute","value":1698535696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}}]},{"address":{"type":"absolute","value":1698535712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698484080}},{"address":{"type":"absolute","value":1698484102}},{"address":{"type":"absolute","value":1698484536}}]},{"address":{"type":"absolute","value":1698535744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}}]},{"address":{"type":"absolute","value":1698535760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535760}}]},{"address":{"type":"absolute","value":1698535792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535792}},{"address":{"type":"absolute","value":1698535890}}]},{"address":{"type":"absolute","value":1698535920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535920}},{"address":{"type":"absolute","value":1698535947}}]},{"address":{"type":"absolute","value":1698535968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483936}},{"address":{"type":"absolute","value":1698483962}},{"address":{"type":"absolute","value":1698483981}},{"address":{"type":"absolute","value":1698484000}},{"address":{"type":"absolute","value":1698484016}},{"address":{"type":"absolute","value":1698484032}},{"address":{"type":"absolute","value":1698484064}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510928}},{"address":{"type":"absolute","value":1698510984}},{"address":{"type":"absolute","value":1698510993}}]},{"address":{"type":"absolute","value":1698535984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483792}},{"address":{"type":"absolute","value":1698483818}},{"address":{"type":"absolute","value":1698483837}},{"address":{"type":"absolute","value":1698483856}},{"address":{"type":"absolute","value":1698483872}},{"address":{"type":"absolute","value":1698483888}},{"address":{"type":"absolute","value":1698483920}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510608}},{"address":{"type":"absolute","value":1698510688}},{"address":{"type":"absolute","value":1698510800}}]},{"address":{"type":"absolute","value":1698536032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483648}},{"address":{"type":"absolute","value":1698483674}},{"address":{"type":"absolute","value":1698483693}},{"address":{"type":"absolute","value":1698483712}},{"address":{"type":"absolute","value":1698483728}},{"address":{"type":"absolute","value":1698483744}},{"address":{"type":"absolute","value":1698483776}},{"address":{"type":"absolute","value":1698495116}},{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}},{"address":{"type":"absolute","value":1698501536}},{"address":{"type":"absolute","value":1698501623}},{"address":{"type":"absolute","value":1698501628}},{"address":{"type":"absolute","value":1698501666}},{"address":{"type":"absolute","value":1698501713}},{"address":{"type":"absolute","value":1698504656}},{"address":{"type":"absolute","value":1698504708}},{"address":{"type":"absolute","value":1698504717}},{"address":{"type":"absolute","value":1698504769}},{"address":{"type":"absolute","value":1698504780}},{"address":{"type":"absolute","value":1698504792}},{"address":{"type":"absolute","value":1698504800}},{"address":{"type":"absolute","value":1698504839}},{"address":{"type":"absolute","value":1698509296}},{"address":{"type":"absolute","value":1698509336}},{"address":{"type":"absolute","value":1698509414}},{"address":{"type":"absolute","value":1698509478}},{"address":{"type":"absolute","value":1698509518}},{"address":{"type":"absolute","value":1698509555}},{"address":{"type":"absolute","value":1698509699}},{"address":{"type":"absolute","value":1698509765}},{"address":{"type":"absolute","value":1698509824}},{"address":{"type":"absolute","value":1698509856}},{"address":{"type":"absolute","value":1698509869}},{"address":{"type":"absolute","value":1698509942}},{"address":{"type":"absolute","value":1698510121}},{"address":{"type":"absolute","value":1698510387}},{"address":{"type":"absolute","value":1698510426}},{"address":{"type":"absolute","value":1698510448}},{"address":{"type":"absolute","value":1698510457}}]},{"address":{"type":"absolute","value":1698536048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698484080}},{"address":{"type":"absolute","value":1698484102}},{"address":{"type":"absolute","value":1698484536}}]},{"address":{"type":"absolute","value":1698536080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483136}},{"address":{"type":"absolute","value":1698483175}},{"address":{"type":"absolute","value":1698483205}},{"address":{"type":"absolute","value":1698483220}},{"address":{"type":"absolute","value":1698483263}},{"address":{"type":"absolute","value":1698483280}},{"address":{"type":"absolute","value":1698483392}},{"address":{"type":"absolute","value":1698494236}},{"address":{"type":"absolute","value":1698494511}},{"address":{"type":"absolute","value":1698494528}},{"address":{"type":"absolute","value":1698500538}},{"address":{"type":"absolute","value":1698500606}},{"address":{"type":"absolute","value":1698500672}},{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}},{"address":{"type":"absolute","value":1698508461}},{"address":{"type":"absolute","value":1698508672}},{"address":{"type":"absolute","value":1698508745}},{"address":{"type":"absolute","value":1698508773}},{"address":{"type":"absolute","value":1698508783}},{"address":{"type":"absolute","value":1698508788}},{"address":{"type":"absolute","value":1698508806}},{"address":{"type":"absolute","value":1698508950}},{"address":{"type":"absolute","value":1698508994}},{"address":{"type":"absolute","value":1698509200}},{"address":{"type":"absolute","value":1698509218}},{"address":{"type":"absolute","value":1698509257}},{"address":{"type":"absolute","value":1698509272}}]},{"address":{"type":"absolute","value":1698536096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}}]},{"address":{"type":"absolute","value":1698536112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536112}}]},{"address":{"type":"absolute","value":1698536144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536144}},{"address":{"type":"absolute","value":1698536229}}]},{"address":{"type":"absolute","value":1698536272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536272}},{"address":{"type":"absolute","value":1698536352}},{"address":{"type":"absolute","value":1698536368}},{"address":{"type":"absolute","value":1698536464}}]},{"address":{"type":"absolute","value":1698536496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536560}},{"address":{"type":"absolute","value":1698536608}},{"address":{"type":"absolute","value":1698536624}}]},{"address":{"type":"absolute","value":1698536640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536640}},{"address":{"type":"absolute","value":1698536678}}]},{"address":{"type":"absolute","value":1698536688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536720}},{"address":{"type":"absolute","value":1698538507}}]},{"address":{"type":"absolute","value":1698536832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536832}},{"address":{"type":"absolute","value":1698536879}},{"address":{"type":"absolute","value":1698536896}},{"address":{"type":"absolute","value":1698537042}},{"address":{"type":"absolute","value":1698537056}}]},{"address":{"type":"absolute","value":1698537072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698537072}},{"address":{"type":"absolute","value":1698537285}},{"address":{"type":"absolute","value":1698537337}}]},{"address":{"type":"absolute","value":1698537408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698537408}},{"address":{"type":"absolute","value":1698537441}}]},{"address":{"type":"absolute","value":1698537456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698537456}},{"address":{"type":"absolute","value":1698537498}},{"address":{"type":"absolute","value":1698537521}},{"address":{"type":"absolute","value":1698537552}},{"address":{"type":"absolute","value":1698537616}}]},{"address":{"type":"absolute","value":1698537632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698537756}},{"address":{"type":"absolute","value":1698537808}},{"address":{"type":"absolute","value":1698537864}},{"address":{"type":"absolute","value":1698537952}},{"address":{"type":"absolute","value":1698537994}}]},{"address":{"type":"absolute","value":1698538048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538048}}]},{"address":{"type":"absolute","value":1698538256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538507}}]},{"address":{"type":"absolute","value":1698538704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538800}},{"address":{"type":"absolute","value":1698538816}}]},{"address":{"type":"absolute","value":1698538832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538986}},{"address":{"type":"absolute","value":1698539289}},{"address":{"type":"absolute","value":1698539456}},{"address":{"type":"absolute","value":1698539488}},{"address":{"type":"absolute","value":1698539539}}]},{"address":{"type":"absolute","value":1698539648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698540032}},{"address":{"type":"absolute","value":1698540215}},{"address":{"type":"absolute","value":1698540243}},{"address":{"type":"absolute","value":1698540270}},{"address":{"type":"absolute","value":1698540303}},{"address":{"type":"absolute","value":1698540387}}]},{"address":{"type":"absolute","value":1698540464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698540539}},{"address":{"type":"absolute","value":1698540629}}]},{"address":{"type":"absolute","value":1698541552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698541607}},{"address":{"type":"absolute","value":1698541638}},{"address":{"type":"absolute","value":1698541781}}]},{"address":{"type":"absolute","value":1698541872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698541955}},{"address":{"type":"absolute","value":1698542014}},{"address":{"type":"absolute","value":1698542032}},{"address":{"type":"absolute","value":1698542045}},{"address":{"type":"absolute","value":1698542139}},{"address":{"type":"absolute","value":1698542423}},{"address":{"type":"absolute","value":1698542488}},{"address":{"type":"absolute","value":1698542664}},{"address":{"type":"absolute","value":1698542840}},{"address":{"type":"absolute","value":1698543288}},{"address":{"type":"absolute","value":1698543344}},{"address":{"type":"absolute","value":1698543359}},{"address":{"type":"absolute","value":1698543456}},{"address":{"type":"absolute","value":1698543471}},{"address":{"type":"absolute","value":1698543568}},{"address":{"type":"absolute","value":1698543583}}]},{"address":{"type":"absolute","value":1698543744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698543744}},{"address":{"type":"absolute","value":1698543952}},{"address":{"type":"absolute","value":1698544050}},{"address":{"type":"absolute","value":1698544068}},{"address":{"type":"absolute","value":1698544322}},{"address":{"type":"absolute","value":1698544386}}]},{"address":{"type":"absolute","value":1698544480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698544480}},{"address":{"type":"absolute","value":1698544555}},{"address":{"type":"absolute","value":1698544608}},{"address":{"type":"absolute","value":1698544809}},{"address":{"type":"absolute","value":1698544817}},{"address":{"type":"absolute","value":1698544896}},{"address":{"type":"absolute","value":1698544917}},{"address":{"type":"absolute","value":1698544930}},{"address":{"type":"absolute","value":1698545134}},{"address":{"type":"absolute","value":1698545146}},{"address":{"type":"absolute","value":1698545218}},{"address":{"type":"absolute","value":1698545353}}]},{"address":{"type":"absolute","value":1698545520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698545568}},{"address":{"type":"absolute","value":1698545613}},{"address":{"type":"absolute","value":1698545734}}]},{"address":{"type":"absolute","value":1698545968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698545968}},{"address":{"type":"absolute","value":1698546016}},{"address":{"type":"absolute","value":1698546066}}]},{"address":{"type":"absolute","value":1698546096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698546180}}]},{"address":{"type":"absolute","value":1698546224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698546224}},{"address":{"type":"absolute","value":1698546288}},{"address":{"type":"absolute","value":1698546335}},{"address":{"type":"absolute","value":1698546533}},{"address":{"type":"absolute","value":1698546738}},{"address":{"type":"absolute","value":1698546753}},{"address":{"type":"absolute","value":1698546821}},{"address":{"type":"absolute","value":1698546960}},{"address":{"type":"absolute","value":1698547091}},{"address":{"type":"absolute","value":1698547185}},{"address":{"type":"absolute","value":1698547198}},{"address":{"type":"absolute","value":1698547305}},{"address":{"type":"absolute","value":1698547486}},{"address":{"type":"absolute","value":1698547501}},{"address":{"type":"absolute","value":1698547661}},{"address":{"type":"absolute","value":1698547712}},{"address":{"type":"absolute","value":1698547773}},{"address":{"type":"absolute","value":1698548117}},{"address":{"type":"absolute","value":1698548406}},{"address":{"type":"absolute","value":1698548569}},{"address":{"type":"absolute","value":1698548833}},{"address":{"type":"absolute","value":1698548880}},{"address":{"type":"absolute","value":1698548895}},{"address":{"type":"absolute","value":1698548956}},{"address":{"type":"absolute","value":1698549039}},{"address":{"type":"absolute","value":1698549328}},{"address":{"type":"absolute","value":1698549461}},{"address":{"type":"absolute","value":1698549486}},{"address":{"type":"absolute","value":1698549502}},{"address":{"type":"absolute","value":1698549505}},{"address":{"type":"absolute","value":1698549770}},{"address":{"type":"absolute","value":1698549871}},{"address":{"type":"absolute","value":1698550431}},{"address":{"type":"absolute","value":1698550526}},{"address":{"type":"absolute","value":1698550717}},{"address":{"type":"absolute","value":1698551463}},{"address":{"type":"absolute","value":1698551502}},{"address":{"type":"absolute","value":1698551548}},{"address":{"type":"absolute","value":1698551582}}]},{"address":{"type":"absolute","value":1698551984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552059}}]},{"address":{"type":"absolute","value":1698552080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552152}}]},{"address":{"type":"absolute","value":1698552176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552218}}]},{"address":{"type":"absolute","value":1698552304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552519}},{"address":{"type":"absolute","value":1698552532}},{"address":{"type":"absolute","value":1698552604}},{"address":{"type":"absolute","value":1698552626}}]},{"address":{"type":"absolute","value":1698552640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552640}},{"address":{"type":"absolute","value":1698552674}},{"address":{"type":"absolute","value":1698552721}}]},{"address":{"type":"absolute","value":1698552736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552736}},{"address":{"type":"absolute","value":1698552773}},{"address":{"type":"absolute","value":1698552834}}]},{"address":{"type":"absolute","value":1698552848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552947}},{"address":{"type":"absolute","value":1698553384}}]},{"address":{"type":"absolute","value":1698553440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698553472}},{"address":{"type":"absolute","value":1698553490}},{"address":{"type":"absolute","value":1698553504}}]},{"address":{"type":"absolute","value":1698553520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698553816}},{"address":{"type":"absolute","value":1698554146}}]},{"address":{"type":"absolute","value":1698554240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698554240}},{"address":{"type":"absolute","value":1698554375}},{"address":{"type":"absolute","value":1698554524}},{"address":{"type":"absolute","value":1698554568}},{"address":{"type":"absolute","value":1698554624}},{"address":{"type":"absolute","value":1698554941}},{"address":{"type":"absolute","value":1698554964}},{"address":{"type":"absolute","value":1698555045}},{"address":{"type":"absolute","value":1698555072}},{"address":{"type":"absolute","value":1698555094}},{"address":{"type":"absolute","value":1698555193}},{"address":{"type":"absolute","value":1698555438}}]},{"address":{"type":"absolute","value":1698555792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698555792}},{"address":{"type":"absolute","value":1698556059}},{"address":{"type":"absolute","value":1698556508}},{"address":{"type":"absolute","value":1698556560}},{"address":{"type":"absolute","value":1698556577}},{"address":{"type":"absolute","value":1698556639}},{"address":{"type":"absolute","value":1698556757}},{"address":{"type":"absolute","value":1698556770}},{"address":{"type":"absolute","value":1698556787}},{"address":{"type":"absolute","value":1698556900}},{"address":{"type":"absolute","value":1698557446}}]},{"address":{"type":"absolute","value":1698557600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698557879}}]},{"address":{"type":"absolute","value":1698558112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698558211}},{"address":{"type":"absolute","value":1698558224}},{"address":{"type":"absolute","value":1698558236}},{"address":{"type":"absolute","value":1698558315}},{"address":{"type":"absolute","value":1698558341}},{"address":{"type":"absolute","value":1698558370}},{"address":{"type":"absolute","value":1698558384}},{"address":{"type":"absolute","value":1698558464}},{"address":{"type":"absolute","value":1698558509}}]},{"address":{"type":"absolute","value":1698558576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698558726}}]},{"address":{"type":"absolute","value":1698558800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698558800}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698558944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698559011}},{"address":{"type":"absolute","value":1698559143}}]},{"address":{"type":"absolute","value":1698559344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698559480}},{"address":{"type":"absolute","value":1698559536}},{"address":{"type":"absolute","value":1698560244}}]},{"address":{"type":"absolute","value":1698561040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698561068}}]},{"address":{"type":"absolute","value":1698561168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698561226}},{"address":{"type":"absolute","value":1698561290}}]},{"address":{"type":"absolute","value":1698561408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698561408}},{"address":{"type":"absolute","value":1698561571}},{"address":{"type":"absolute","value":1698561592}},{"address":{"type":"absolute","value":1698561621}},{"address":{"type":"absolute","value":1698561719}},{"address":{"type":"absolute","value":1698561797}},{"address":{"type":"absolute","value":1698561874}},{"address":{"type":"absolute","value":1698561885}},{"address":{"type":"absolute","value":1698561904}}]},{"address":{"type":"absolute","value":1698562080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698562080}},{"address":{"type":"absolute","value":1698562200}},{"address":{"type":"absolute","value":1698562217}},{"address":{"type":"absolute","value":1698562269}},{"address":{"type":"absolute","value":1698562319}},{"address":{"type":"absolute","value":1698562336}},{"address":{"type":"absolute","value":1698562351}},{"address":{"type":"absolute","value":1698562368}},{"address":{"type":"absolute","value":1698562400}},{"address":{"type":"absolute","value":1698562432}},{"address":{"type":"absolute","value":1698562464}}]},{"address":{"type":"absolute","value":1698562512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698562512}},{"address":{"type":"absolute","value":1698562668}},{"address":{"type":"absolute","value":1698562700}},{"address":{"type":"absolute","value":1698562837}}]},{"address":{"type":"absolute","value":1698563024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698563099}},{"address":{"type":"absolute","value":1698563231}},{"address":{"type":"absolute","value":1698563248}}]},{"address":{"type":"absolute","value":1698563392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698563392}},{"address":{"type":"absolute","value":1698563502}},{"address":{"type":"absolute","value":1698563566}},{"address":{"type":"absolute","value":1698563761}},{"address":{"type":"absolute","value":1698563958}},{"address":{"type":"absolute","value":1698563984}}]},{"address":{"type":"absolute","value":1698564176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698564176}},{"address":{"type":"absolute","value":1698564464}},{"address":{"type":"absolute","value":1698564544}},{"address":{"type":"absolute","value":1698564615}},{"address":{"type":"absolute","value":1698564672}},{"address":{"type":"absolute","value":1698564741}}]},{"address":{"type":"absolute","value":1698564960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698565127}},{"address":{"type":"absolute","value":1698565136}},{"address":{"type":"absolute","value":1698565148}},{"address":{"type":"absolute","value":1698565184}},{"address":{"type":"absolute","value":1698565330}},{"address":{"type":"absolute","value":1698565358}},{"address":{"type":"absolute","value":1698565361}},{"address":{"type":"absolute","value":1698565410}},{"address":{"type":"absolute","value":1698565472}},{"address":{"type":"absolute","value":1698565632}},{"address":{"type":"absolute","value":1698565796}}]},{"address":{"type":"absolute","value":1698565856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698565856}},{"address":{"type":"absolute","value":1698565946}},{"address":{"type":"absolute","value":1698566085}},{"address":{"type":"absolute","value":1698566117}},{"address":{"type":"absolute","value":1698566176}},{"address":{"type":"absolute","value":1698566208}},{"address":{"type":"absolute","value":1698566228}},{"address":{"type":"absolute","value":1698566295}},{"address":{"type":"absolute","value":1698566402}},{"address":{"type":"absolute","value":1698566427}},{"address":{"type":"absolute","value":1698566499}}]},{"address":{"type":"absolute","value":1698566768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698566864}},{"address":{"type":"absolute","value":1698566912}},{"address":{"type":"absolute","value":1698566923}},{"address":{"type":"absolute","value":1698566960}},{"address":{"type":"absolute","value":1698567011}},{"address":{"type":"absolute","value":1698567029}},{"address":{"type":"absolute","value":1698567056}}]},{"address":{"type":"absolute","value":1698567296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698567349}},{"address":{"type":"absolute","value":1698567364}},{"address":{"type":"absolute","value":1698567416}},{"address":{"type":"absolute","value":1698567425}}]},{"address":{"type":"absolute","value":1698567552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698567552}},{"address":{"type":"absolute","value":1698567632}},{"address":{"type":"absolute","value":1698567671}},{"address":{"type":"absolute","value":1698567776}},{"address":{"type":"absolute","value":1698567835}}]},{"address":{"type":"absolute","value":1698567872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698567872}},{"address":{"type":"absolute","value":1698567952}},{"address":{"type":"absolute","value":1698567987}},{"address":{"type":"absolute","value":1698568165}},{"address":{"type":"absolute","value":1698568179}}]},{"address":{"type":"absolute","value":1698568224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698568224}},{"address":{"type":"absolute","value":1698568304}},{"address":{"type":"absolute","value":1698568339}},{"address":{"type":"absolute","value":1698568416}},{"address":{"type":"absolute","value":1698568482}}]},{"address":{"type":"absolute","value":1698568512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698568575}},{"address":{"type":"absolute","value":1698568595}},{"address":{"type":"absolute","value":1698568626}},{"address":{"type":"absolute","value":1698568659}},{"address":{"type":"absolute","value":1698568677}},{"address":{"type":"absolute","value":1698568750}},{"address":{"type":"absolute","value":1698568819}},{"address":{"type":"absolute","value":1698568960}},{"address":{"type":"absolute","value":1698569175}},{"address":{"type":"absolute","value":1698569286}},{"address":{"type":"absolute","value":1698569318}},{"address":{"type":"absolute","value":1698569495}},{"address":{"type":"absolute","value":1698569607}},{"address":{"type":"absolute","value":1698569637}},{"address":{"type":"absolute","value":1698569815}},{"address":{"type":"absolute","value":1698569926}},{"address":{"type":"absolute","value":1698569958}},{"address":{"type":"absolute","value":1698570124}},{"address":{"type":"absolute","value":1698570246}},{"address":{"type":"absolute","value":1698570276}},{"address":{"type":"absolute","value":1698570304}},{"address":{"type":"absolute","value":1698570352}},{"address":{"type":"absolute","value":1698570960}},{"address":{"type":"absolute","value":1698570976}}]},{"address":{"type":"absolute","value":1698571360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698568575}},{"address":{"type":"absolute","value":1698568595}},{"address":{"type":"absolute","value":1698568659}},{"address":{"type":"absolute","value":1698568677}},{"address":{"type":"absolute","value":1698568750}},{"address":{"type":"absolute","value":1698568819}},{"address":{"type":"absolute","value":1698568960}},{"address":{"type":"absolute","value":1698569175}},{"address":{"type":"absolute","value":1698569286}},{"address":{"type":"absolute","value":1698569318}},{"address":{"type":"absolute","value":1698569495}},{"address":{"type":"absolute","value":1698569607}},{"address":{"type":"absolute","value":1698569637}},{"address":{"type":"absolute","value":1698569815}},{"address":{"type":"absolute","value":1698569926}},{"address":{"type":"absolute","value":1698569958}},{"address":{"type":"absolute","value":1698570124}},{"address":{"type":"absolute","value":1698570246}},{"address":{"type":"absolute","value":1698570276}},{"address":{"type":"absolute","value":1698570304}},{"address":{"type":"absolute","value":1698570352}},{"address":{"type":"absolute","value":1698570960}},{"address":{"type":"absolute","value":1698570976}}]},{"address":{"type":"absolute","value":1698571376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698571376}}]},{"address":{"type":"absolute","value":1698572368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698572368}}]},{"address":{"type":"absolute","value":1698573344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698573344}}]},{"address":{"type":"absolute","value":1698576792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698576792}}]},{"address":{"type":"absolute","value":1698582416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698582483}},{"address":{"type":"absolute","value":1698582592}},{"address":{"type":"absolute","value":1698582610}},{"address":{"type":"absolute","value":1698582628}},{"address":{"type":"absolute","value":1698582704}}]},{"address":{"type":"absolute","value":1698583136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698582483}},{"address":{"type":"absolute","value":1698582592}},{"address":{"type":"absolute","value":1698582610}},{"address":{"type":"absolute","value":1698582628}},{"address":{"type":"absolute","value":1698582704}}]},{"address":{"type":"absolute","value":1698583152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698583152}},{"address":{"type":"absolute","value":1698583232}},{"address":{"type":"absolute","value":1698583271}},{"address":{"type":"absolute","value":1698583376}},{"address":{"type":"absolute","value":1698583435}}]},{"address":{"type":"absolute","value":1698583472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698583472}},{"address":{"type":"absolute","value":1698583552}},{"address":{"type":"absolute","value":1698583587}},{"address":{"type":"absolute","value":1698583765}},{"address":{"type":"absolute","value":1698583779}}]},{"address":{"type":"absolute","value":1698583824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698583824}},{"address":{"type":"absolute","value":1698583904}},{"address":{"type":"absolute","value":1698583939}},{"address":{"type":"absolute","value":1698584016}},{"address":{"type":"absolute","value":1698584082}}]},{"address":{"type":"absolute","value":1698584112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698584112}}]},{"address":{"type":"absolute","value":1698585168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698585168}}]},{"address":{"type":"absolute","value":1698586232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698586232}}]},{"address":{"type":"absolute","value":1698590136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698590136}}]},{"address":{"type":"absolute","value":1698594056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698594056}}]},{"address":{"type":"absolute","value":1698594336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698594352}},{"address":{"type":"absolute","value":1698594416}},{"address":{"type":"absolute","value":1698594428}},{"address":{"type":"absolute","value":1698594441}},{"address":{"type":"absolute","value":1698594482}}]},{"address":{"type":"absolute","value":1698594624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698594624}},{"address":{"type":"absolute","value":1698595040}},{"address":{"type":"absolute","value":1698595048}}]},{"address":{"type":"absolute","value":1698595696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698595729}}]},{"address":{"type":"absolute","value":1698598064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598064}}]},{"address":{"type":"absolute","value":1698598112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598112}}]},{"address":{"type":"absolute","value":1698598144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598196}},{"address":{"type":"absolute","value":1698598275}},{"address":{"type":"absolute","value":1698598347}}]},{"address":{"type":"absolute","value":1698598432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598816}},{"address":{"type":"absolute","value":1698599143}},{"address":{"type":"absolute","value":1698599152}},{"address":{"type":"absolute","value":1698599202}},{"address":{"type":"absolute","value":1698599233}},{"address":{"type":"absolute","value":1698599328}},{"address":{"type":"absolute","value":1698599365}}]},{"address":{"type":"absolute","value":1698599616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599656}},{"address":{"type":"absolute","value":1698599701}},{"address":{"type":"absolute","value":1698599725}}]},{"address":{"type":"absolute","value":1698599792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599792}},{"address":{"type":"absolute","value":1698599817}},{"address":{"type":"absolute","value":1698599891}},{"address":{"type":"absolute","value":1698599920}}]},{"address":{"type":"absolute","value":1698599952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599792}},{"address":{"type":"absolute","value":1698599817}},{"address":{"type":"absolute","value":1698599891}},{"address":{"type":"absolute","value":1698599920}}]},{"address":{"type":"absolute","value":1698599984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599984}},{"address":{"type":"absolute","value":1698600002}},{"address":{"type":"absolute","value":1698600041}}]},{"address":{"type":"absolute","value":1698600080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600080}},{"address":{"type":"absolute","value":1698600149}},{"address":{"type":"absolute","value":1698600197}},{"address":{"type":"absolute","value":1698600240}},{"address":{"type":"absolute","value":1698600304}}]},{"address":{"type":"absolute","value":1698600352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600352}},{"address":{"type":"absolute","value":1698600416}},{"address":{"type":"absolute","value":1698600552}},{"address":{"type":"absolute","value":1698600581}}]},{"address":{"type":"absolute","value":1698600624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600624}},{"address":{"type":"absolute","value":1698600643}},{"address":{"type":"absolute","value":1698600678}},{"address":{"type":"absolute","value":1698600691}}]},{"address":{"type":"absolute","value":1698600720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600720}},{"address":{"type":"absolute","value":1698600784}},{"address":{"type":"absolute","value":1698600834}},{"address":{"type":"absolute","value":1698600896}}]},{"address":{"type":"absolute","value":1698600928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600928}}]},{"address":{"type":"absolute","value":1698606696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698606696}}]},{"address":{"type":"absolute","value":1698622672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698622672}}]},{"address":{"type":"absolute","value":1698627072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627088}}]},{"address":{"type":"absolute","value":1698627168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627088}}]},{"address":{"type":"absolute","value":1698627184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627088}}]},{"address":{"type":"absolute","value":1698627248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627278}}]},{"address":{"type":"absolute","value":1698627360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627384}},{"address":{"type":"absolute","value":1698627388}},{"address":{"type":"absolute","value":1698627395}},{"address":{"type":"absolute","value":1698627408}},{"address":{"type":"absolute","value":1698627520}},{"address":{"type":"absolute","value":1698628004}},{"address":{"type":"absolute","value":1698642496}}]},{"address":{"type":"absolute","value":1698628080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698628119}}]},{"address":{"type":"absolute","value":1698628160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698628160}},{"address":{"type":"absolute","value":1698628225}},{"address":{"type":"absolute","value":1698628292}},{"address":{"type":"absolute","value":1698628353}},{"address":{"type":"absolute","value":1698628388}},{"address":{"type":"absolute","value":1698628483}},{"address":{"type":"absolute","value":1698628551}},{"address":{"type":"absolute","value":1698628693}},{"address":{"type":"absolute","value":1698628736}}]},{"address":{"type":"absolute","value":1698628896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698629120}},{"address":{"type":"absolute","value":1698629303}},{"address":{"type":"absolute","value":1698629344}},{"address":{"type":"absolute","value":1698629392}},{"address":{"type":"absolute","value":1698629424}},{"address":{"type":"absolute","value":1698629446}},{"address":{"type":"absolute","value":1698629491}},{"address":{"type":"absolute","value":1698629568}},{"address":{"type":"absolute","value":1698629696}},{"address":{"type":"absolute","value":1698629727}},{"address":{"type":"absolute","value":1698629749}},{"address":{"type":"absolute","value":1698629794}},{"address":{"type":"absolute","value":1698629813}},{"address":{"type":"absolute","value":1698629920}},{"address":{"type":"absolute","value":1698629951}},{"address":{"type":"absolute","value":1698630184}},{"address":{"type":"absolute","value":1698630188}}]},{"address":{"type":"absolute","value":1698630528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698629120}},{"address":{"type":"absolute","value":1698629303}},{"address":{"type":"absolute","value":1698629344}},{"address":{"type":"absolute","value":1698629392}},{"address":{"type":"absolute","value":1698629424}},{"address":{"type":"absolute","value":1698629446}},{"address":{"type":"absolute","value":1698629491}},{"address":{"type":"absolute","value":1698629568}},{"address":{"type":"absolute","value":1698629696}},{"address":{"type":"absolute","value":1698629727}},{"address":{"type":"absolute","value":1698629749}},{"address":{"type":"absolute","value":1698629794}},{"address":{"type":"absolute","value":1698629813}},{"address":{"type":"absolute","value":1698629920}},{"address":{"type":"absolute","value":1698629951}},{"address":{"type":"absolute","value":1698630184}},{"address":{"type":"absolute","value":1698630188}}]},{"address":{"type":"absolute","value":1698630544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698630686}},{"address":{"type":"absolute","value":1698630704}}]},{"address":{"type":"absolute","value":1698630784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698630926}},{"address":{"type":"absolute","value":1698630944}}]},{"address":{"type":"absolute","value":1698631024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631166}},{"address":{"type":"absolute","value":1698631184}}]},{"address":{"type":"absolute","value":1698631264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631264}},{"address":{"type":"absolute","value":1698631292}},{"address":{"type":"absolute","value":1698631373}},{"address":{"type":"absolute","value":1698631420}},{"address":{"type":"absolute","value":1698631440}},{"address":{"type":"absolute","value":1698631493}}]},{"address":{"type":"absolute","value":1698631536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631648}},{"address":{"type":"absolute","value":1698631736}},{"address":{"type":"absolute","value":1698631783}},{"address":{"type":"absolute","value":1698631808}}]},{"address":{"type":"absolute","value":1698631904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631984}},{"address":{"type":"absolute","value":1698632057}},{"address":{"type":"absolute","value":1698632080}},{"address":{"type":"absolute","value":1698632117}},{"address":{"type":"absolute","value":1698644352}},{"address":{"type":"absolute","value":1698644391}},{"address":{"type":"absolute","value":1698652880}},{"address":{"type":"absolute","value":1698653338}},{"address":{"type":"absolute","value":1698653438}},{"address":{"type":"absolute","value":1698653463}},{"address":{"type":"absolute","value":1698653669}},{"address":{"type":"absolute","value":1698653708}}]},{"address":{"type":"absolute","value":1698632160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698632256}},{"address":{"type":"absolute","value":1698632303}},{"address":{"type":"absolute","value":1698632378}}]},{"address":{"type":"absolute","value":1698632464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698632544}},{"address":{"type":"absolute","value":1698632613}},{"address":{"type":"absolute","value":1698632626}},{"address":{"type":"absolute","value":1698632672}},{"address":{"type":"absolute","value":1698643152}},{"address":{"type":"absolute","value":1698643187}},{"address":{"type":"absolute","value":1698651191}}]},{"address":{"type":"absolute","value":1698632720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698632816}},{"address":{"type":"absolute","value":1698632880}},{"address":{"type":"absolute","value":1698632953}},{"address":{"type":"absolute","value":1698632976}},{"address":{"type":"absolute","value":1698643456}},{"address":{"type":"absolute","value":1698643502}},{"address":{"type":"absolute","value":1698651488}},{"address":{"type":"absolute","value":1698651526}}]},{"address":{"type":"absolute","value":1698633024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698633138}},{"address":{"type":"absolute","value":1698633429}},{"address":{"type":"absolute","value":1698633473}}]},{"address":{"type":"absolute","value":1698633696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698633792}},{"address":{"type":"absolute","value":1698633959}},{"address":{"type":"absolute","value":1698633996}},{"address":{"type":"absolute","value":1698634011}}]},{"address":{"type":"absolute","value":1698634064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698634064}},{"address":{"type":"absolute","value":1698636216}}]},{"address":{"type":"absolute","value":1698638088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698638088}},{"address":{"type":"absolute","value":1698638376}}]},{"address":{"type":"absolute","value":1698642096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642096}}]},{"address":{"type":"absolute","value":1698642128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642128}},{"address":{"type":"absolute","value":1698642313}}]},{"address":{"type":"absolute","value":1698642496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642496}}]},{"address":{"type":"absolute","value":1698642784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642784}}]},{"address":{"type":"absolute","value":1698643008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643152}},{"address":{"type":"absolute","value":1698643187}}]},{"address":{"type":"absolute","value":1698643312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643456}},{"address":{"type":"absolute","value":1698643502}}]},{"address":{"type":"absolute","value":1698643616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643812}},{"address":{"type":"absolute","value":1698643852}}]},{"address":{"type":"absolute","value":1698643968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643968}}]},{"address":{"type":"absolute","value":1698644208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698644352}},{"address":{"type":"absolute","value":1698644391}}]},{"address":{"type":"absolute","value":1698644512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698644656}},{"address":{"type":"absolute","value":1698644699}}]},{"address":{"type":"absolute","value":1698644832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698644997}},{"address":{"type":"absolute","value":1698645024}},{"address":{"type":"absolute","value":1698645089}},{"address":{"type":"absolute","value":1698645337}},{"address":{"type":"absolute","value":1698645360}}]},{"address":{"type":"absolute","value":1698645456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698645595}},{"address":{"type":"absolute","value":1698645616}},{"address":{"type":"absolute","value":1698645669}}]},{"address":{"type":"absolute","value":1698645968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698645968}}]},{"address":{"type":"absolute","value":1698646688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698647466}},{"address":{"type":"absolute","value":1698647488}}]},{"address":{"type":"absolute","value":1698647287},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698647305}},{"address":{"type":"absolute","value":1698647347}},{"address":{"type":"absolute","value":1698647430}}]},{"address":{"type":"absolute","value":1698648336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698648336}}]},{"address":{"type":"absolute","value":1698648368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698648368}},{"address":{"type":"absolute","value":1698648392}},{"address":{"type":"absolute","value":1698648919}},{"address":{"type":"absolute","value":1698648969}},{"address":{"type":"absolute","value":1698649680}}]},{"address":{"type":"absolute","value":1698650976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698651191}}]},{"address":{"type":"absolute","value":1698651248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698651488}},{"address":{"type":"absolute","value":1698651526}}]},{"address":{"type":"absolute","value":1698651568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698651568}},{"address":{"type":"absolute","value":1698652194}},{"address":{"type":"absolute","value":1698652294}},{"address":{"type":"absolute","value":1698652319}},{"address":{"type":"absolute","value":1698652571}},{"address":{"type":"absolute","value":1698652606}}]},{"address":{"type":"absolute","value":1698652880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698652880}},{"address":{"type":"absolute","value":1698653338}},{"address":{"type":"absolute","value":1698653438}},{"address":{"type":"absolute","value":1698653463}},{"address":{"type":"absolute","value":1698653669}},{"address":{"type":"absolute","value":1698653708}}]},{"address":{"type":"absolute","value":1698653760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698653760}},{"address":{"type":"absolute","value":1698654214}},{"address":{"type":"absolute","value":1698654314}},{"address":{"type":"absolute","value":1698654348}},{"address":{"type":"absolute","value":1698654566}},{"address":{"type":"absolute","value":1698654600}}]},{"address":{"type":"absolute","value":1698654656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698654778}},{"address":{"type":"absolute","value":1698654998}},{"address":{"type":"absolute","value":1698655029}},{"address":{"type":"absolute","value":1698655178}},{"address":{"type":"absolute","value":1698655394}},{"address":{"type":"absolute","value":1698655453}},{"address":{"type":"absolute","value":1698655488}},{"address":{"type":"absolute","value":1698655996}},{"address":{"type":"absolute","value":1698656105}},{"address":{"type":"absolute","value":1698656140}},{"address":{"type":"absolute","value":1698656354}},{"address":{"type":"absolute","value":1698656413}},{"address":{"type":"absolute","value":1698656448}},{"address":{"type":"absolute","value":1698656972}},{"address":{"type":"absolute","value":1698657065}},{"address":{"type":"absolute","value":1698657100}},{"address":{"type":"absolute","value":1698657318}}]},{"address":{"type":"absolute","value":1698657376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698657466}},{"address":{"type":"absolute","value":1698657680}},{"address":{"type":"absolute","value":1698657703}},{"address":{"type":"absolute","value":1698657789}},{"address":{"type":"absolute","value":1698657824}},{"address":{"type":"absolute","value":1698658313}},{"address":{"type":"absolute","value":1698658362}},{"address":{"type":"absolute","value":1698658394}},{"address":{"type":"absolute","value":1698658606}}]},{"address":{"type":"absolute","value":1698658768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698658768}}]},{"address":{"type":"absolute","value":1698658944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698659118}}]},{"address":{"type":"absolute","value":1698659472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698659556}},{"address":{"type":"absolute","value":1698660380}},{"address":{"type":"absolute","value":1698660448}},{"address":{"type":"absolute","value":1698660461}},{"address":{"type":"absolute","value":1698660611}},{"address":{"type":"absolute","value":1698660662}},{"address":{"type":"absolute","value":1698660931}},{"address":{"type":"absolute","value":1698661008}},{"address":{"type":"absolute","value":1698661034}},{"address":{"type":"absolute","value":1698661309}},{"address":{"type":"absolute","value":1698661440}},{"address":{"type":"absolute","value":1698662257}},{"address":{"type":"absolute","value":1698662270}},{"address":{"type":"absolute","value":1698662526}},{"address":{"type":"absolute","value":1698662585}},{"address":{"type":"absolute","value":1698663060}},{"address":{"type":"absolute","value":1698663136}},{"address":{"type":"absolute","value":1698663162}}]},{"address":{"type":"absolute","value":1698663648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698663891}},{"address":{"type":"absolute","value":1698663908}},{"address":{"type":"absolute","value":1698663968}},{"address":{"type":"absolute","value":1698664068}}]},{"address":{"type":"absolute","value":1698664208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698664451}},{"address":{"type":"absolute","value":1698664468}},{"address":{"type":"absolute","value":1698664553}},{"address":{"type":"absolute","value":1698664688}}]},{"address":{"type":"absolute","value":1698664832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698665059}},{"address":{"type":"absolute","value":1698665076}},{"address":{"type":"absolute","value":1698665122}},{"address":{"type":"absolute","value":1698665217}}]},{"address":{"type":"absolute","value":1698665328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698665533}},{"address":{"type":"absolute","value":1698665617}},{"address":{"type":"absolute","value":1698665802}},{"address":{"type":"absolute","value":1698665935}},{"address":{"type":"absolute","value":1698665991}},{"address":{"type":"absolute","value":1698666035}},{"address":{"type":"absolute","value":1698666161}}]},{"address":{"type":"absolute","value":1698666288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698666489}},{"address":{"type":"absolute","value":1698666573}},{"address":{"type":"absolute","value":1698666826}},{"address":{"type":"absolute","value":1698666880}},{"address":{"type":"absolute","value":1698667013}}]},{"address":{"type":"absolute","value":1698667136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698667136}}]},{"address":{"type":"absolute","value":1698669272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698669272}}]},{"address":{"type":"absolute","value":1698671408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698671408}}]},{"address":{"type":"absolute","value":1698678216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698678216}}]},{"address":{"type":"absolute","value":1698685088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685088}}]},{"address":{"type":"absolute","value":1698685312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685312}}]},{"address":{"type":"absolute","value":1698685504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685504}}]},{"address":{"type":"absolute","value":1698685688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685688}}]},{"address":{"type":"absolute","value":1698685952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685952}}]},{"address":{"type":"absolute","value":1698686232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698686232}}]},{"address":{"type":"absolute","value":1698704576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698704576}}]},{"address":{"type":"absolute","value":1698709200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698709200}}]},{"address":{"type":"absolute","value":1698713936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698713936}}]},{"address":{"type":"absolute","value":1698713968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698713968}}]},{"address":{"type":"absolute","value":1698714000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698714000}},{"address":{"type":"absolute","value":1698719643}},{"address":{"type":"absolute","value":1698719728}}]},{"address":{"type":"absolute","value":1698719792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698719980}},{"address":{"type":"absolute","value":1698720199}},{"address":{"type":"absolute","value":1698720211}},{"address":{"type":"absolute","value":1698720240}},{"address":{"type":"absolute","value":1698720259}},{"address":{"type":"absolute","value":1698720288}}]},{"address":{"type":"absolute","value":1698720320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698720356}},{"address":{"type":"absolute","value":1698720421}}]},{"address":{"type":"absolute","value":1698720448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698720594}},{"address":{"type":"absolute","value":1698720645}},{"address":{"type":"absolute","value":1698720736}},{"address":{"type":"absolute","value":1698720781}},{"address":{"type":"absolute","value":1698720827}},{"address":{"type":"absolute","value":1698720848}},{"address":{"type":"absolute","value":1698720924}}]},{"address":{"type":"absolute","value":1698721072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698721218}},{"address":{"type":"absolute","value":1698721269}},{"address":{"type":"absolute","value":1698721360}},{"address":{"type":"absolute","value":1698721405}},{"address":{"type":"absolute","value":1698721451}},{"address":{"type":"absolute","value":1698721472}},{"address":{"type":"absolute","value":1698721557}}]},{"address":{"type":"absolute","value":1698721712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698721856}},{"address":{"type":"absolute","value":1698721907}},{"address":{"type":"absolute","value":1698722000}},{"address":{"type":"absolute","value":1698722045}},{"address":{"type":"absolute","value":1698722091}},{"address":{"type":"absolute","value":1698722098}},{"address":{"type":"absolute","value":1698722167}}]},{"address":{"type":"absolute","value":1698722288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698722500}},{"address":{"type":"absolute","value":1698722757}},{"address":{"type":"absolute","value":1698722778}},{"address":{"type":"absolute","value":1698722848}},{"address":{"type":"absolute","value":1698722931}},{"address":{"type":"absolute","value":1698723156}},{"address":{"type":"absolute","value":1698723174}},{"address":{"type":"absolute","value":1698723178}},{"address":{"type":"absolute","value":1698723244}},{"address":{"type":"absolute","value":1698723262}},{"address":{"type":"absolute","value":1698723296}}]},{"address":{"type":"absolute","value":1698723440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698723642}},{"address":{"type":"absolute","value":1698723726}},{"address":{"type":"absolute","value":1698723857}},{"address":{"type":"absolute","value":1698723928}},{"address":{"type":"absolute","value":1698724000}},{"address":{"type":"absolute","value":1698724212}},{"address":{"type":"absolute","value":1698724216}},{"address":{"type":"absolute","value":1698724280}},{"address":{"type":"absolute","value":1698724317}}]},{"address":{"type":"absolute","value":1698724464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698724464}}]},{"address":{"type":"absolute","value":1698745032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698745032}}]},{"address":{"type":"absolute","value":1698766728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698766728}}]},{"address":{"type":"absolute","value":1698767272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698767272}}]},{"address":{"type":"absolute","value":1698767816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698767816}}]},{"address":{"type":"absolute","value":1698768192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698768192}}]},{"address":{"type":"absolute","value":1698784880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698784880}}]},{"address":{"type":"absolute","value":1698802608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698802608}}]},{"address":{"type":"absolute","value":1698803168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698803168}}]},{"address":{"type":"absolute","value":1698803728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698803728}}]},{"address":{"type":"absolute","value":1698804144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804224}},{"address":{"type":"absolute","value":1698804238}},{"address":{"type":"absolute","value":1698804383}}]},{"address":{"type":"absolute","value":1698804480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804480}}]},{"address":{"type":"absolute","value":1698804512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804592}},{"address":{"type":"absolute","value":1698804606}},{"address":{"type":"absolute","value":1698804737}}]},{"address":{"type":"absolute","value":1698804816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804816}}]},{"address":{"type":"absolute","value":1698804848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804961}},{"address":{"type":"absolute","value":1698804995}},{"address":{"type":"absolute","value":1698805026}},{"address":{"type":"absolute","value":1698805039}},{"address":{"type":"absolute","value":1698805088}},{"address":{"type":"absolute","value":1698805155}},{"address":{"type":"absolute","value":1698805179}}]},{"address":{"type":"absolute","value":1698805664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804961}},{"address":{"type":"absolute","value":1698804995}},{"address":{"type":"absolute","value":1698805026}},{"address":{"type":"absolute","value":1698805039}},{"address":{"type":"absolute","value":1698805088}},{"address":{"type":"absolute","value":1698805155}},{"address":{"type":"absolute","value":1698805179}}]},{"address":{"type":"absolute","value":1698805680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698805680}}]},{"address":{"type":"absolute","value":1698808128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698808128}}]},{"address":{"type":"absolute","value":1698808160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698808160}}]},{"address":{"type":"absolute","value":1698810608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698810608}}]},{"address":{"type":"absolute","value":1698810640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698810784}},{"address":{"type":"absolute","value":1698810831}},{"address":{"type":"absolute","value":1698810941}},{"address":{"type":"absolute","value":1698810985}}]},{"address":{"type":"absolute","value":1698811216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698811216}}]},{"address":{"type":"absolute","value":1698813712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698813712}}]},{"address":{"type":"absolute","value":1698817280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698817280}}]},{"address":{"type":"absolute","value":1698817344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698817344}}]},{"address":{"type":"absolute","value":1698819552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698819552}}]},{"address":{"type":"absolute","value":1698821760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698821760}}]},{"address":{"type":"absolute","value":1698824720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698824720}}]},{"address":{"type":"absolute","value":1698827680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698811216}},{"address":{"type":"absolute","value":1698813712}},{"address":{"type":"absolute","value":1698817280}}]},{"address":{"type":"absolute","value":1698827760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698827760}},{"address":{"type":"absolute","value":1698827865}}]},{"address":{"type":"absolute","value":1698827952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698827952}},{"address":{"type":"absolute","value":1698828057}}]},{"address":{"type":"absolute","value":1698828144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828144}}]},{"address":{"type":"absolute","value":1698828192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828192}}]},{"address":{"type":"absolute","value":1698828240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828398}}]},{"address":{"type":"absolute","value":1698828912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828912}},{"address":{"type":"absolute","value":1698829058}},{"address":{"type":"absolute","value":1698829136}}]},{"address":{"type":"absolute","value":1698829312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698829312}},{"address":{"type":"absolute","value":1698829472}},{"address":{"type":"absolute","value":1698829532}},{"address":{"type":"absolute","value":1698829600}},{"address":{"type":"absolute","value":1698829671}},{"address":{"type":"absolute","value":1698829728}},{"address":{"type":"absolute","value":1698829807}}]},{"address":{"type":"absolute","value":1698829936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698829936}},{"address":{"type":"absolute","value":1698830096}},{"address":{"type":"absolute","value":1698830156}},{"address":{"type":"absolute","value":1698830224}},{"address":{"type":"absolute","value":1698830285}},{"address":{"type":"absolute","value":1698830352}},{"address":{"type":"absolute","value":1698830441}}]},{"address":{"type":"absolute","value":1698830592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698830592}},{"address":{"type":"absolute","value":1698830739}},{"address":{"type":"absolute","value":1698830799}},{"address":{"type":"absolute","value":1698830864}},{"address":{"type":"absolute","value":1698830935}},{"address":{"type":"absolute","value":1698830992}},{"address":{"type":"absolute","value":1698831065}}]},{"address":{"type":"absolute","value":1698831184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698831184}},{"address":{"type":"absolute","value":1698831409}},{"address":{"type":"absolute","value":1698831493}},{"address":{"type":"absolute","value":1698831688}},{"address":{"type":"absolute","value":1698831709}},{"address":{"type":"absolute","value":1698831780}},{"address":{"type":"absolute","value":1698831929}},{"address":{"type":"absolute","value":1698832013}},{"address":{"type":"absolute","value":1698832151}},{"address":{"type":"absolute","value":1698832172}},{"address":{"type":"absolute","value":1698832176}},{"address":{"type":"absolute","value":1698832242}},{"address":{"type":"absolute","value":1698832291}}]},{"address":{"type":"absolute","value":1698832432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698832432}},{"address":{"type":"absolute","value":1698832643}},{"address":{"type":"absolute","value":1698832727}},{"address":{"type":"absolute","value":1698832898}},{"address":{"type":"absolute","value":1698832969}},{"address":{"type":"absolute","value":1698833099}},{"address":{"type":"absolute","value":1698833183}},{"address":{"type":"absolute","value":1698833296}},{"address":{"type":"absolute","value":1698833300}},{"address":{"type":"absolute","value":1698833367}},{"address":{"type":"absolute","value":1698833411}}]},{"address":{"type":"absolute","value":1698833800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698833800}},{"address":{"type":"absolute","value":1698852224}}]},{"address":{"type":"absolute","value":1698858208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698858747}},{"address":{"type":"absolute","value":1698876616}}]},{"address":{"type":"absolute","value":1698883416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698883416}}]},{"address":{"type":"absolute","value":1698885112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698885112}}]},{"address":{"type":"absolute","value":1698892616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698889168}}]},{"address":{"type":"absolute","value":1698892936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698892936}},{"address":{"type":"absolute","value":1698914560}}]},{"address":{"type":"absolute","value":1698921616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698922180}},{"address":{"type":"absolute","value":1698943224}}]},{"address":{"type":"absolute","value":1698950280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698950280}}]},{"address":{"type":"absolute","value":1698951696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698951696}}]},{"address":{"type":"absolute","value":1698953856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698953856}}]},{"address":{"type":"absolute","value":1698956128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956176}},{"address":{"type":"absolute","value":1698956199}}]},{"address":{"type":"absolute","value":1698956256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956361}},{"address":{"type":"absolute","value":1698956385}},{"address":{"type":"absolute","value":1698956427}},{"address":{"type":"absolute","value":1698956476}},{"address":{"type":"absolute","value":1698956487}},{"address":{"type":"absolute","value":1698956514}},{"address":{"type":"absolute","value":1698956556}},{"address":{"type":"absolute","value":1698956585}},{"address":{"type":"absolute","value":1698956635}},{"address":{"type":"absolute","value":1698956668}},{"address":{"type":"absolute","value":1698956746}}]},{"address":{"type":"absolute","value":1698956832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956832}}]},{"address":{"type":"absolute","value":1698956864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956864}},{"address":{"type":"absolute","value":1698956976}},{"address":{"type":"absolute","value":1698957059}},{"address":{"type":"absolute","value":1698957216}},{"address":{"type":"absolute","value":1698957232}}]},{"address":{"type":"absolute","value":1698957264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957290}}]},{"address":{"type":"absolute","value":1698957344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957427}},{"address":{"type":"absolute","value":1698957472}},{"address":{"type":"absolute","value":1698957552}},{"address":{"type":"absolute","value":1698957664}}]},{"address":{"type":"absolute","value":1698957856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957856}}]},{"address":{"type":"absolute","value":1698957888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957888}},{"address":{"type":"absolute","value":1698957929}}]},{"address":{"type":"absolute","value":1698958000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958000}}]},{"address":{"type":"absolute","value":1698958240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958240}}]},{"address":{"type":"absolute","value":1698958400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958400}}]},{"address":{"type":"absolute","value":1698958576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958710}},{"address":{"type":"absolute","value":1698958781}},{"address":{"type":"absolute","value":1698958816}},{"address":{"type":"absolute","value":1698958869}},{"address":{"type":"absolute","value":1698958953}},{"address":{"type":"absolute","value":1698958979}},{"address":{"type":"absolute","value":1698959005}},{"address":{"type":"absolute","value":1698959099}},{"address":{"type":"absolute","value":1698959173}}]},{"address":{"type":"absolute","value":1698959280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698959289}},{"address":{"type":"absolute","value":1698959296}}]},{"address":{"type":"absolute","value":1698959328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698959337}},{"address":{"type":"absolute","value":1698959344}}]},{"address":{"type":"absolute","value":1698959376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698959376}},{"address":{"type":"absolute","value":1698959509}},{"address":{"type":"absolute","value":1698959621}},{"address":{"type":"absolute","value":1698959856}},{"address":{"type":"absolute","value":1698959873}}]},{"address":{"type":"absolute","value":1698959904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698960027}}]},{"address":{"type":"absolute","value":1698960128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698960166}}]},{"address":{"type":"absolute","value":1698960344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698960344}},{"address":{"type":"absolute","value":1698960598}},{"address":{"type":"absolute","value":1698960840}},{"address":{"type":"absolute","value":1698962067}},{"address":{"type":"absolute","value":1698963474}},{"address":{"type":"absolute","value":1698964028}},{"address":{"type":"absolute","value":1698964329}},{"address":{"type":"absolute","value":1698964337}}]},{"address":{"type":"absolute","value":1698964368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698964368}}]},{"address":{"type":"absolute","value":1698964432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698964432}}]},{"address":{"type":"absolute","value":1698965072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965072}}]},{"address":{"type":"absolute","value":1698965152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965152}}]},{"address":{"type":"absolute","value":1698965792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965812}}]},{"address":{"type":"absolute","value":1698965856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965856}},{"address":{"type":"absolute","value":1698965880}},{"address":{"type":"absolute","value":1698965907}},{"address":{"type":"absolute","value":1698965935}},{"address":{"type":"absolute","value":1698965969}}]},{"address":{"type":"absolute","value":1698965984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965984}}]},{"address":{"type":"absolute","value":1698966080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698966138}},{"address":{"type":"absolute","value":1698966198}}]},{"address":{"type":"absolute","value":1698966320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698966448}},{"address":{"type":"absolute","value":1698966521}},{"address":{"type":"absolute","value":1698966560}},{"address":{"type":"absolute","value":1698966611}},{"address":{"type":"absolute","value":1698966627}},{"address":{"type":"absolute","value":1698966676}},{"address":{"type":"absolute","value":1698966788}},{"address":{"type":"absolute","value":1698966848}},{"address":{"type":"absolute","value":1698966870}},{"address":{"type":"absolute","value":1698966896}}]},{"address":{"type":"absolute","value":1698967040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698966448}},{"address":{"type":"absolute","value":1698966521}},{"address":{"type":"absolute","value":1698966560}},{"address":{"type":"absolute","value":1698966611}},{"address":{"type":"absolute","value":1698966627}},{"address":{"type":"absolute","value":1698966676}},{"address":{"type":"absolute","value":1698966788}},{"address":{"type":"absolute","value":1698966848}},{"address":{"type":"absolute","value":1698966870}},{"address":{"type":"absolute","value":1698966896}}]},{"address":{"type":"absolute","value":1698967072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698967219}},{"address":{"type":"absolute","value":1698967344}},{"address":{"type":"absolute","value":1698967552}},{"address":{"type":"absolute","value":1698967569}},{"address":{"type":"absolute","value":1698967648}},{"address":{"type":"absolute","value":1698967760}}]},{"address":{"type":"absolute","value":1698967808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698968043}}]},{"address":{"type":"absolute","value":1698968192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698968192}},{"address":{"type":"absolute","value":1698968512}},{"address":{"type":"absolute","value":1698968773}},{"address":{"type":"absolute","value":1698970142}},{"address":{"type":"absolute","value":1698970923}},{"address":{"type":"absolute","value":1698971012}},{"address":{"type":"absolute","value":1698971071}},{"address":{"type":"absolute","value":1698971328}},{"address":{"type":"absolute","value":1698971405}},{"address":{"type":"absolute","value":1698971424}}]},{"address":{"type":"absolute","value":1698971584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698971584}},{"address":{"type":"absolute","value":1698971972}},{"address":{"type":"absolute","value":1698972233}},{"address":{"type":"absolute","value":1698973418}},{"address":{"type":"absolute","value":1698974199}},{"address":{"type":"absolute","value":1698974300}},{"address":{"type":"absolute","value":1698974359}},{"address":{"type":"absolute","value":1698974580}},{"address":{"type":"absolute","value":1698974657}},{"address":{"type":"absolute","value":1698974676}}]},{"address":{"type":"absolute","value":1698979904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698979904}},{"address":{"type":"absolute","value":1698980169}},{"address":{"type":"absolute","value":1698980509}}]},{"address":{"type":"absolute","value":1698980856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698980915}},{"address":{"type":"absolute","value":1698980941}},{"address":{"type":"absolute","value":1698980964}},{"address":{"type":"absolute","value":1698980977}},{"address":{"type":"absolute","value":1698980986}},{"address":{"type":"absolute","value":1698981010}},{"address":{"type":"absolute","value":1698981230}}]},{"address":{"type":"absolute","value":1698981432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698981521}},{"address":{"type":"absolute","value":1698982110}},{"address":{"type":"absolute","value":1698984066}}]},{"address":{"type":"absolute","value":1698984576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698984826}},{"address":{"type":"absolute","value":1698985151}},{"address":{"type":"absolute","value":1698985540}},{"address":{"type":"absolute","value":1698985592}}]},{"address":{"type":"absolute","value":1698988256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698988256}},{"address":{"type":"absolute","value":1698988285}}]},{"address":{"type":"absolute","value":1698989376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698989464}}]},{"address":{"type":"absolute","value":1698989488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698989488}}]},{"address":{"type":"absolute","value":1698989792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698990131}},{"address":{"type":"absolute","value":1698990263}}]},{"address":{"type":"absolute","value":1698990304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698990304}},{"address":{"type":"absolute","value":1698990553}}]},{"address":{"type":"absolute","value":1698991040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698991462}}]},{"address":{"type":"absolute","value":1698991600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698991879}}]},{"address":{"type":"absolute","value":1698992320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698992516}}]},{"address":{"type":"absolute","value":1698992576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698992767}},{"address":{"type":"absolute","value":1698994280}},{"address":{"type":"absolute","value":1698994407}},{"address":{"type":"absolute","value":1698994864}},{"address":{"type":"absolute","value":1698994977}},{"address":{"type":"absolute","value":1698995073}},{"address":{"type":"absolute","value":1698995097}},{"address":{"type":"absolute","value":1698995440}},{"address":{"type":"absolute","value":1698996240}},{"address":{"type":"absolute","value":1698996956}},{"address":{"type":"absolute","value":1698997914}}]},{"address":{"type":"absolute","value":1698998096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698998183}},{"address":{"type":"absolute","value":1698998192}}]},{"address":{"type":"absolute","value":1698998224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698998360}}]},{"address":{"type":"absolute","value":1698998704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698998704}},{"address":{"type":"absolute","value":1698998731}}]},{"address":{"type":"absolute","value":1698999664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698999752}}]},{"address":{"type":"absolute","value":1698999776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698999776}},{"address":{"type":"absolute","value":1698999916}}]},{"address":{"type":"absolute","value":1699000112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699000112}}]},{"address":{"type":"absolute","value":1699000208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699000208}},{"address":{"type":"absolute","value":1699000226}},{"address":{"type":"absolute","value":1699000244}},{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699000320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699000524}},{"address":{"type":"absolute","value":1699000938}}]},{"address":{"type":"absolute","value":1699001248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699001413}}]},{"address":{"type":"absolute","value":1699001888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699001972}},{"address":{"type":"absolute","value":1699002042}},{"address":{"type":"absolute","value":1699002324}},{"address":{"type":"absolute","value":1699002425}},{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699002512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699002621}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699002736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699002736}},{"address":{"type":"absolute","value":1699003021}}]},{"address":{"type":"absolute","value":1699003744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699004073}}]},{"address":{"type":"absolute","value":1699004880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005164}}]},{"address":{"type":"absolute","value":1699005232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005232}},{"address":{"type":"absolute","value":1699005295}}]},{"address":{"type":"absolute","value":1699005360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005360}},{"address":{"type":"absolute","value":1699005426}}]},{"address":{"type":"absolute","value":1699005488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005628}},{"address":{"type":"absolute","value":1699005812}},{"address":{"type":"absolute","value":1699006109}},{"address":{"type":"absolute","value":1699006327}},{"address":{"type":"absolute","value":1699006385}},{"address":{"type":"absolute","value":1699007429}},{"address":{"type":"absolute","value":1699007487}},{"address":{"type":"absolute","value":1699008472}},{"address":{"type":"absolute","value":1699008507}},{"address":{"type":"absolute","value":1699008522}},{"address":{"type":"absolute","value":1699008656}},{"address":{"type":"absolute","value":1699008740}},{"address":{"type":"absolute","value":1699009480}},{"address":{"type":"absolute","value":1699010029}},{"address":{"type":"absolute","value":1699010925}}]},{"address":{"type":"absolute","value":1699011472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699011560}}]},{"address":{"type":"absolute","value":1699011584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699011814}},{"address":{"type":"absolute","value":1699011824}}]},{"address":{"type":"absolute","value":1699011856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699011957}},{"address":{"type":"absolute","value":1699012471}}]},{"address":{"type":"absolute","value":1699012656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699012656}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699012880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699012880}},{"address":{"type":"absolute","value":1699013096}}]},{"address":{"type":"absolute","value":1699013552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699013552}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699013664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699013858}}]},{"address":{"type":"absolute","value":1699014208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699014258}},{"address":{"type":"absolute","value":1699014273}}]},{"address":{"type":"absolute","value":1699014448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699014708}}]},{"address":{"type":"absolute","value":1699015168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699015168}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699015424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699015722}}]},{"address":{"type":"absolute","value":1699016448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699016680}},{"address":{"type":"absolute","value":1699016808}}]},{"address":{"type":"absolute","value":1699016976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699017086}},{"address":{"type":"absolute","value":1699017296}},{"address":{"type":"absolute","value":1699017319}},{"address":{"type":"absolute","value":1699017873}},{"address":{"type":"absolute","value":1699017953}},{"address":{"type":"absolute","value":1699017976}},{"address":{"type":"absolute","value":1699018131}},{"address":{"type":"absolute","value":1699018238}},{"address":{"type":"absolute","value":1699018496}},{"address":{"type":"absolute","value":1699018509}},{"address":{"type":"absolute","value":1699018640}},{"address":{"type":"absolute","value":1699018836}},{"address":{"type":"absolute","value":1699018880}},{"address":{"type":"absolute","value":1699018912}},{"address":{"type":"absolute","value":1699018960}}]},{"address":{"type":"absolute","value":1699019440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699019538}},{"address":{"type":"absolute","value":1699019650}}]},{"address":{"type":"absolute","value":1699019664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699020042}},{"address":{"type":"absolute","value":1699020232}},{"address":{"type":"absolute","value":1699021088}}]},{"address":{"type":"absolute","value":1699021664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699021664}},{"address":{"type":"absolute","value":1699021985}},{"address":{"type":"absolute","value":1699022034}},{"address":{"type":"absolute","value":1699022384}}]},{"address":{"type":"absolute","value":1699023184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699023672}},{"address":{"type":"absolute","value":1699025081}}]},{"address":{"type":"absolute","value":1699025232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699025868}},{"address":{"type":"absolute","value":1699026096}},{"address":{"type":"absolute","value":1699026116}},{"address":{"type":"absolute","value":1699026903}},{"address":{"type":"absolute","value":1699027048}}]},{"address":{"type":"absolute","value":1699027680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699027808}},{"address":{"type":"absolute","value":1699028153}},{"address":{"type":"absolute","value":1699029200}}]},{"address":{"type":"absolute","value":1699029984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699029984}},{"address":{"type":"absolute","value":1699030013}}]},{"address":{"type":"absolute","value":1699031104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699031104}}]},{"address":{"type":"absolute","value":1699031152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699031338}},{"address":{"type":"absolute","value":1699031588}},{"address":{"type":"absolute","value":1699031605}},{"address":{"type":"absolute","value":1699031744}},{"address":{"type":"absolute","value":1699031809}},{"address":{"type":"absolute","value":1699031929}},{"address":{"type":"absolute","value":1699031953}},{"address":{"type":"absolute","value":1699032050}},{"address":{"type":"absolute","value":1699032083}},{"address":{"type":"absolute","value":1699032149}},{"address":{"type":"absolute","value":1699032173}}]},{"address":{"type":"absolute","value":1699032416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699032416}},{"address":{"type":"absolute","value":1699032508}},{"address":{"type":"absolute","value":1699033407}},{"address":{"type":"absolute","value":1699034480}}]},{"address":{"type":"absolute","value":1699034832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699035087}},{"address":{"type":"absolute","value":1699036468}},{"address":{"type":"absolute","value":1699036550}},{"address":{"type":"absolute","value":1699037273}}]},{"address":{"type":"absolute","value":1699037472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699037472}},{"address":{"type":"absolute","value":1699037560}},{"address":{"type":"absolute","value":1699037745}},{"address":{"type":"absolute","value":1699037781}}]},{"address":{"type":"absolute","value":1699038096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699038134}}]},{"address":{"type":"absolute","value":1699038176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699038243}},{"address":{"type":"absolute","value":1699038256}}]},{"address":{"type":"absolute","value":1699038272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699038420}},{"address":{"type":"absolute","value":1699038715}},{"address":{"type":"absolute","value":1699038736}},{"address":{"type":"absolute","value":1699038754}}]},{"address":{"type":"absolute","value":1699038944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}}]},{"address":{"type":"absolute","value":1699039024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039058}},{"address":{"type":"absolute","value":1699039086}},{"address":{"type":"absolute","value":1699039136}},{"address":{"type":"absolute","value":1699039196}},{"address":{"type":"absolute","value":1699039212}}]},{"address":{"type":"absolute","value":1699039232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039336}},{"address":{"type":"absolute","value":1699039389}},{"address":{"type":"absolute","value":1699039505}},{"address":{"type":"absolute","value":1699039536}},{"address":{"type":"absolute","value":1699039603}}]},{"address":{"type":"absolute","value":1699039920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699040012}},{"address":{"type":"absolute","value":1699040481}},{"address":{"type":"absolute","value":1699040512}}]},{"address":{"type":"absolute","value":1699040544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699040880}},{"address":{"type":"absolute","value":1699041320}},{"address":{"type":"absolute","value":1699041360}}]},{"address":{"type":"absolute","value":1699041504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699041732}},{"address":{"type":"absolute","value":1699042010}}]},{"address":{"type":"absolute","value":1699043008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043181}},{"address":{"type":"absolute","value":1699043482}},{"address":{"type":"absolute","value":1699043504}}]},{"address":{"type":"absolute","value":1699043568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043593}},{"address":{"type":"absolute","value":1699043647}},{"address":{"type":"absolute","value":1699043664}},{"address":{"type":"absolute","value":1699043694}},{"address":{"type":"absolute","value":1699043729}},{"address":{"type":"absolute","value":1699043768}},{"address":{"type":"absolute","value":1699043798}},{"address":{"type":"absolute","value":1699044016}},{"address":{"type":"absolute","value":1699044099}},{"address":{"type":"absolute","value":1699044127}},{"address":{"type":"absolute","value":1699044242}}]},{"address":{"type":"absolute","value":1699044464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}},{"address":{"type":"absolute","value":1699044464}},{"address":{"type":"absolute","value":1699044512}},{"address":{"type":"absolute","value":1699044547}},{"address":{"type":"absolute","value":1699044586}}]},{"address":{"type":"absolute","value":1699044608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699044636}},{"address":{"type":"absolute","value":1699044667}},{"address":{"type":"absolute","value":1699044698}},{"address":{"type":"absolute","value":1699044729}},{"address":{"type":"absolute","value":1699044760}},{"address":{"type":"absolute","value":1699044800}},{"address":{"type":"absolute","value":1699044882}},{"address":{"type":"absolute","value":1699044896}},{"address":{"type":"absolute","value":1699044976}}]},{"address":{"type":"absolute","value":1699045216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045216}},{"address":{"type":"absolute","value":1699045259}},{"address":{"type":"absolute","value":1699045314}},{"address":{"type":"absolute","value":1699045328}}]},{"address":{"type":"absolute","value":1699045360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045360}}]},{"address":{"type":"absolute","value":1699045472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045472}}]},{"address":{"type":"absolute","value":1699045696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045719}}]},{"address":{"type":"absolute","value":1699045792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045898}},{"address":{"type":"absolute","value":1699045981}},{"address":{"type":"absolute","value":1699046016}},{"address":{"type":"absolute","value":1699046064}}]},{"address":{"type":"absolute","value":1699046160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046235}}]},{"address":{"type":"absolute","value":1699046272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046507}},{"address":{"type":"absolute","value":1699046587}},{"address":{"type":"absolute","value":1699046656}},{"address":{"type":"absolute","value":1699046677}},{"address":{"type":"absolute","value":1699046704}},{"address":{"type":"absolute","value":1699046736}}]},{"address":{"type":"absolute","value":1699046768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046820}},{"address":{"type":"absolute","value":1699046836}},{"address":{"type":"absolute","value":1699046882}}]},{"address":{"type":"absolute","value":1699047088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699047240}},{"address":{"type":"absolute","value":1699047251}},{"address":{"type":"absolute","value":1699047318}},{"address":{"type":"absolute","value":1699047386}},{"address":{"type":"absolute","value":1699047408}},{"address":{"type":"absolute","value":1699047456}}]},{"address":{"type":"absolute","value":1699047488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699047584}},{"address":{"type":"absolute","value":1699048388}},{"address":{"type":"absolute","value":1699048468}}]},{"address":{"type":"absolute","value":1699048640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049225}}]},{"address":{"type":"absolute","value":1699049408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049503}},{"address":{"type":"absolute","value":1699049552}}]},{"address":{"type":"absolute","value":1699049568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049606}}]},{"address":{"type":"absolute","value":1699049648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049648}},{"address":{"type":"absolute","value":1699050050}}]},{"address":{"type":"absolute","value":1699050320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699050453}},{"address":{"type":"absolute","value":1699050509}}]},{"address":{"type":"absolute","value":1699050576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699050618}},{"address":{"type":"absolute","value":1699050661}},{"address":{"type":"absolute","value":1699050672}},{"address":{"type":"absolute","value":1699050688}}]},{"address":{"type":"absolute","value":1699050944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049648}},{"address":{"type":"absolute","value":1699050050}}]},{"address":{"type":"absolute","value":1699050976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699051123}},{"address":{"type":"absolute","value":1699051212}},{"address":{"type":"absolute","value":1699051254}},{"address":{"type":"absolute","value":1699051360}},{"address":{"type":"absolute","value":1699051548}}]},{"address":{"type":"absolute","value":1699051824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699051824}},{"address":{"type":"absolute","value":1699051888}},{"address":{"type":"absolute","value":1699052017}},{"address":{"type":"absolute","value":1699052128}},{"address":{"type":"absolute","value":1699052157}}]},{"address":{"type":"absolute","value":1699052240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699052240}},{"address":{"type":"absolute","value":1699052456}},{"address":{"type":"absolute","value":1699052564}},{"address":{"type":"absolute","value":1699052591}}]},{"address":{"type":"absolute","value":1699052912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699053033}},{"address":{"type":"absolute","value":1699053270}},{"address":{"type":"absolute","value":1699053452}},{"address":{"type":"absolute","value":1699053501}},{"address":{"type":"absolute","value":1699053616}},{"address":{"type":"absolute","value":1699054016}}]},{"address":{"type":"absolute","value":1699054608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699054720}},{"address":{"type":"absolute","value":1699055157}},{"address":{"type":"absolute","value":1699055446}},{"address":{"type":"absolute","value":1699055491}},{"address":{"type":"absolute","value":1699055562}}]},{"address":{"type":"absolute","value":1699055984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699056572}}]},{"address":{"type":"absolute","value":1699056848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057445}}]},{"address":{"type":"absolute","value":1699057840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057840}}]},{"address":{"type":"absolute","value":1699057904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057904}}]},{"address":{"type":"absolute","value":1699057968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057968}}]},{"address":{"type":"absolute","value":1699058032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699058096}},{"address":{"type":"absolute","value":1699058324}},{"address":{"type":"absolute","value":1699058337}},{"address":{"type":"absolute","value":1699058411}},{"address":{"type":"absolute","value":1699058414}},{"address":{"type":"absolute","value":1699059072}},{"address":{"type":"absolute","value":1699059204}},{"address":{"type":"absolute","value":1699059290}},{"address":{"type":"absolute","value":1699059327}},{"address":{"type":"absolute","value":1699059408}},{"address":{"type":"absolute","value":1699059472}},{"address":{"type":"absolute","value":1699059596}},{"address":{"type":"absolute","value":1699059808}}]},{"address":{"type":"absolute","value":1699058496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699058560}},{"address":{"type":"absolute","value":1699058788}},{"address":{"type":"absolute","value":1699058801}},{"address":{"type":"absolute","value":1699058874}},{"address":{"type":"absolute","value":1699058877}},{"address":{"type":"absolute","value":1699060192}},{"address":{"type":"absolute","value":1699060437}},{"address":{"type":"absolute","value":1699060478}},{"address":{"type":"absolute","value":1699060576}},{"address":{"type":"absolute","value":1699060672}},{"address":{"type":"absolute","value":1699060820}},{"address":{"type":"absolute","value":1699060954}}]},{"address":{"type":"absolute","value":1699058960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699059072}},{"address":{"type":"absolute","value":1699059204}},{"address":{"type":"absolute","value":1699059290}},{"address":{"type":"absolute","value":1699059327}},{"address":{"type":"absolute","value":1699059408}},{"address":{"type":"absolute","value":1699059472}},{"address":{"type":"absolute","value":1699059596}},{"address":{"type":"absolute","value":1699059808}}]},{"address":{"type":"absolute","value":1699060064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699060192}},{"address":{"type":"absolute","value":1699060437}},{"address":{"type":"absolute","value":1699060478}},{"address":{"type":"absolute","value":1699060576}},{"address":{"type":"absolute","value":1699060672}},{"address":{"type":"absolute","value":1699060820}},{"address":{"type":"absolute","value":1699060954}}]},{"address":{"type":"absolute","value":1699061552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699061552}}]},{"address":{"type":"absolute","value":1699061584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699061584}},{"address":{"type":"absolute","value":1699061842}},{"address":{"type":"absolute","value":1699061935}},{"address":{"type":"absolute","value":1699062270}},{"address":{"type":"absolute","value":1699062874}},{"address":{"type":"absolute","value":1699062976}},{"address":{"type":"absolute","value":1699063184}}]},{"address":{"type":"absolute","value":1699063456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699063483}},{"address":{"type":"absolute","value":1699063539}},{"address":{"type":"absolute","value":1699063568}},{"address":{"type":"absolute","value":1699063596}},{"address":{"type":"absolute","value":1699063648}},{"address":{"type":"absolute","value":1699063689}},{"address":{"type":"absolute","value":1699063702}},{"address":{"type":"absolute","value":1699063808}},{"address":{"type":"absolute","value":1699063858}}]},{"address":{"type":"absolute","value":1699063920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699063970}},{"address":{"type":"absolute","value":1699064016}},{"address":{"type":"absolute","value":1699064052}},{"address":{"type":"absolute","value":1699064062}}]},{"address":{"type":"absolute","value":1699065232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065264}},{"address":{"type":"absolute","value":1699065364}},{"address":{"type":"absolute","value":1699065401}},{"address":{"type":"absolute","value":1699065649}},{"address":{"type":"absolute","value":1699065655}},{"address":{"type":"absolute","value":1699065664}},{"address":{"type":"absolute","value":1699065697}},{"address":{"type":"absolute","value":1699065708}},{"address":{"type":"absolute","value":1699065729}}]},{"address":{"type":"absolute","value":1699065760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065776}},{"address":{"type":"absolute","value":1699065803}}]},{"address":{"type":"absolute","value":1699065856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065856}}]},{"address":{"type":"absolute","value":1699065936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065936}}]},{"address":{"type":"absolute","value":1699066096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699066096}},{"address":{"type":"absolute","value":1699066219}},{"address":{"type":"absolute","value":1699066240}},{"address":{"type":"absolute","value":1699066368}},{"address":{"type":"absolute","value":1699066739}},{"address":{"type":"absolute","value":1699066776}}]},{"address":{"type":"absolute","value":1699067200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699067250}},{"address":{"type":"absolute","value":1699067270}}]},{"address":{"type":"absolute","value":1699068688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699068704}},{"address":{"type":"absolute","value":1699068725}}]},{"address":{"type":"absolute","value":1699068752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699068752}},{"address":{"type":"absolute","value":1699068856}},{"address":{"type":"absolute","value":1699068884}},{"address":{"type":"absolute","value":1699068906}},{"address":{"type":"absolute","value":1699068976}}]},{"address":{"type":"absolute","value":1699069168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699069232}},{"address":{"type":"absolute","value":1699069252}}]},{"address":{"type":"absolute","value":1699071328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699071344}},{"address":{"type":"absolute","value":1699071365}}]},{"address":{"type":"absolute","value":1699071392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699071392}},{"address":{"type":"absolute","value":1699071496}},{"address":{"type":"absolute","value":1699071524}},{"address":{"type":"absolute","value":1699071546}},{"address":{"type":"absolute","value":1699071616}}]},{"address":{"type":"absolute","value":1699071824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699071856}},{"address":{"type":"absolute","value":1699071876}}]},{"address":{"type":"absolute","value":1699077520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699077536}},{"address":{"type":"absolute","value":1699077557}}]},{"address":{"type":"absolute","value":1699077584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699077584}},{"address":{"type":"absolute","value":1699077692}},{"address":{"type":"absolute","value":1699077728}},{"address":{"type":"absolute","value":1699077750}},{"address":{"type":"absolute","value":1699077824}}]},{"address":{"type":"absolute","value":1699077920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699077920}}]},{"address":{"type":"absolute","value":1699078112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699078112}}]},{"address":{"type":"absolute","value":1699078336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699078336}}]},{"address":{"type":"absolute","value":1699078560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699078560}},{"address":{"type":"absolute","value":1699078674}},{"address":{"type":"absolute","value":1699078888}},{"address":{"type":"absolute","value":1699078904}}]},{"address":{"type":"absolute","value":1699079040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699079183}},{"address":{"type":"absolute","value":1699079344}},{"address":{"type":"absolute","value":1699090156}},{"address":{"type":"absolute","value":1699090261}},{"address":{"type":"absolute","value":1699090304}},{"address":{"type":"absolute","value":1699090352}}]},{"address":{"type":"absolute","value":1699090400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699090400}},{"address":{"type":"absolute","value":1699090511}},{"address":{"type":"absolute","value":1699090532}},{"address":{"type":"absolute","value":1699090554}},{"address":{"type":"absolute","value":1699090704}}]},{"address":{"type":"absolute","value":1699090800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699090800}}]},{"address":{"type":"absolute","value":1699090896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699090935}},{"address":{"type":"absolute","value":1699090949}},{"address":{"type":"absolute","value":1699090978}}]},{"address":{"type":"absolute","value":1699091024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699091046}},{"address":{"type":"absolute","value":1699091184}},{"address":{"type":"absolute","value":1699093506}},{"address":{"type":"absolute","value":1699093513}},{"address":{"type":"absolute","value":1699094307}},{"address":{"type":"absolute","value":1699094437}}]},{"address":{"type":"absolute","value":1699094768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699094793}},{"address":{"type":"absolute","value":1699094912}},{"address":{"type":"absolute","value":1699097114}},{"address":{"type":"absolute","value":1699097121}},{"address":{"type":"absolute","value":1699097963}},{"address":{"type":"absolute","value":1699098039}}]},{"address":{"type":"absolute","value":1699098368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699098435}},{"address":{"type":"absolute","value":1699098564}},{"address":{"type":"absolute","value":1699098592}},{"address":{"type":"absolute","value":1699100810}},{"address":{"type":"absolute","value":1699101647}},{"address":{"type":"absolute","value":1699101744}},{"address":{"type":"absolute","value":1699102551}},{"address":{"type":"absolute","value":1699102692}}]},{"address":{"type":"absolute","value":1699103440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699103440}}]},{"address":{"type":"absolute","value":1699103728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699103728}}]},{"address":{"type":"absolute","value":1699104016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699104016}},{"address":{"type":"absolute","value":1699104131}},{"address":{"type":"absolute","value":1699104207}},{"address":{"type":"absolute","value":1699104248}}]},{"address":{"type":"absolute","value":1699104512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699104658}},{"address":{"type":"absolute","value":1699104912}},{"address":{"type":"absolute","value":1699105477}},{"address":{"type":"absolute","value":1699108897}},{"address":{"type":"absolute","value":1699111086}},{"address":{"type":"absolute","value":1699111200}},{"address":{"type":"absolute","value":1699111233}},{"address":{"type":"absolute","value":1699111280}}]},{"address":{"type":"absolute","value":1699111328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699111328}},{"address":{"type":"absolute","value":1699111444}},{"address":{"type":"absolute","value":1699111472}},{"address":{"type":"absolute","value":1699111494}},{"address":{"type":"absolute","value":1699111657}},{"address":{"type":"absolute","value":1699111680}},{"address":{"type":"absolute","value":1699111702}}]},{"address":{"type":"absolute","value":1699111760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699111760}}]},{"address":{"type":"absolute","value":1699111872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699111911}},{"address":{"type":"absolute","value":1699111925}},{"address":{"type":"absolute","value":1699111954}}]},{"address":{"type":"absolute","value":1699112016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699112075}},{"address":{"type":"absolute","value":1699125415}}]},{"address":{"type":"absolute","value":1699126160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699126222}},{"address":{"type":"absolute","value":1699139594}}]},{"address":{"type":"absolute","value":1699140352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699140435}},{"address":{"type":"absolute","value":1699140544}},{"address":{"type":"absolute","value":1699142983}},{"address":{"type":"absolute","value":1699142992}},{"address":{"type":"absolute","value":1699143842}}]},{"address":{"type":"absolute","value":1699144704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699144704}},{"address":{"type":"absolute","value":1699144727}},{"address":{"type":"absolute","value":1699144752}}]},{"address":{"type":"absolute","value":1699144784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699145105}},{"address":{"type":"absolute","value":1699146992}}]},{"address":{"type":"absolute","value":1699147264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699147339}},{"address":{"type":"absolute","value":1699147696}},{"address":{"type":"absolute","value":1699147726}},{"address":{"type":"absolute","value":1699148544}}]},{"address":{"type":"absolute","value":1699148608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699148948}},{"address":{"type":"absolute","value":1699150844}}]},{"address":{"type":"absolute","value":1699151120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699151195}},{"address":{"type":"absolute","value":1699151552}},{"address":{"type":"absolute","value":1699151582}},{"address":{"type":"absolute","value":1699152400}}]},{"address":{"type":"absolute","value":1699152464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699152799}},{"address":{"type":"absolute","value":1699154533}}]},{"address":{"type":"absolute","value":1699154816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699154891}},{"address":{"type":"absolute","value":1699155248}},{"address":{"type":"absolute","value":1699155278}},{"address":{"type":"absolute","value":1699156096}}]},{"address":{"type":"absolute","value":1699156176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699156176}},{"address":{"type":"absolute","value":1699156211}},{"address":{"type":"absolute","value":1699156241}},{"address":{"type":"absolute","value":1699156345}},{"address":{"type":"absolute","value":1699156516}}]},{"address":{"type":"absolute","value":1699156672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699156672}},{"address":{"type":"absolute","value":1699156862}},{"address":{"type":"absolute","value":1699156942}}]},{"address":{"type":"absolute","value":1699156960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699157045}},{"address":{"type":"absolute","value":1699157173}},{"address":{"type":"absolute","value":1699157264}},{"address":{"type":"absolute","value":1699157370}}]},{"address":{"type":"absolute","value":1699157456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699157584}},{"address":{"type":"absolute","value":1699157665}},{"address":{"type":"absolute","value":1699157761}},{"address":{"type":"absolute","value":1699157838}},{"address":{"type":"absolute","value":1699158013}},{"address":{"type":"absolute","value":1699158096}},{"address":{"type":"absolute","value":1699158154}}]},{"address":{"type":"absolute","value":1699158304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158935},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158935}},{"address":{"type":"absolute","value":1699158994}},{"address":{"type":"absolute","value":1699162583}},{"address":{"type":"absolute","value":1699162607}}]},{"address":{"type":"absolute","value":1699162633},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699162633}},{"address":{"type":"absolute","value":1699162766}},{"address":{"type":"absolute","value":1699162793}},{"address":{"type":"absolute","value":1699162840}},{"address":{"type":"absolute","value":1699163017}}]},{"address":{"type":"absolute","value":1699163060},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163060}}]},{"address":{"type":"absolute","value":1699163328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163328}}]},{"address":{"type":"absolute","value":1699163504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163504}},{"address":{"type":"absolute","value":1699163663}},{"address":{"type":"absolute","value":1699163680}},{"address":{"type":"absolute","value":1699163694}},{"address":{"type":"absolute","value":1699163729}},{"address":{"type":"absolute","value":1699163920}},{"address":{"type":"absolute","value":1699163967}},{"address":{"type":"absolute","value":1699163984}},{"address":{"type":"absolute","value":1699164016}},{"address":{"type":"absolute","value":1699164050}}]},{"address":{"type":"absolute","value":1699164256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163504}},{"address":{"type":"absolute","value":1699163663}},{"address":{"type":"absolute","value":1699163680}},{"address":{"type":"absolute","value":1699163694}},{"address":{"type":"absolute","value":1699163729}},{"address":{"type":"absolute","value":1699163920}},{"address":{"type":"absolute","value":1699163967}},{"address":{"type":"absolute","value":1699163984}},{"address":{"type":"absolute","value":1699164016}},{"address":{"type":"absolute","value":1699164050}},{"address":{"type":"absolute","value":1699164275}},{"address":{"type":"absolute","value":1699164309}}]},{"address":{"type":"absolute","value":1699164368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699164392}},{"address":{"type":"absolute","value":1699164500}},{"address":{"type":"absolute","value":1699164528}},{"address":{"type":"absolute","value":1699164574}},{"address":{"type":"absolute","value":1699164608}},{"address":{"type":"absolute","value":1699164635}},{"address":{"type":"absolute","value":1699164704}},{"address":{"type":"absolute","value":1699164727}},{"address":{"type":"absolute","value":1699164784}},{"address":{"type":"absolute","value":1699164787}},{"address":{"type":"absolute","value":1699164836}},{"address":{"type":"absolute","value":1699164848}},{"address":{"type":"absolute","value":1699164876}},{"address":{"type":"absolute","value":1699164928}},{"address":{"type":"absolute","value":1699164951}}]},{"address":{"type":"absolute","value":1699164960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699164960}}]},{"address":{"type":"absolute","value":1699165136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699165207}},{"address":{"type":"absolute","value":1699165464}},{"address":{"type":"absolute","value":1699167624}}]},{"address":{"type":"absolute","value":1699167664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699167872}},{"address":{"type":"absolute","value":1699173696}}]},{"address":{"type":"absolute","value":1699173744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699173789}},{"address":{"type":"absolute","value":1699173888}},{"address":{"type":"absolute","value":1699178297}}]},{"address":{"type":"absolute","value":1699178336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699178336}},{"address":{"type":"absolute","value":1699178395}},{"address":{"type":"absolute","value":1699178464}},{"address":{"type":"absolute","value":1699178498}},{"address":{"type":"absolute","value":1699178512}},{"address":{"type":"absolute","value":1699178528}},{"address":{"type":"absolute","value":1699178566}},{"address":{"type":"absolute","value":1699178608}},{"address":{"type":"absolute","value":1699178644}},{"address":{"type":"absolute","value":1699178704}},{"address":{"type":"absolute","value":1699178755}}]},{"address":{"type":"absolute","value":1699178864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699178864}},{"address":{"type":"absolute","value":1699178907}},{"address":{"type":"absolute","value":1699178963}},{"address":{"type":"absolute","value":1699178993}},{"address":{"type":"absolute","value":1699179008}},{"address":{"type":"absolute","value":1699179024}},{"address":{"type":"absolute","value":1699179065}},{"address":{"type":"absolute","value":1699179104}},{"address":{"type":"absolute","value":1699179144}},{"address":{"type":"absolute","value":1699179202}},{"address":{"type":"absolute","value":1699179246}},{"address":{"type":"absolute","value":1699179268}},{"address":{"type":"absolute","value":1699179316}}]},{"address":{"type":"absolute","value":1699179392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179392}},{"address":{"type":"absolute","value":1699179463}},{"address":{"type":"absolute","value":1699179519}},{"address":{"type":"absolute","value":1699179605}},{"address":{"type":"absolute","value":1699179634}}]},{"address":{"type":"absolute","value":1699179712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179764}}]},{"address":{"type":"absolute","value":1699179776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179825}}]},{"address":{"type":"absolute","value":1699179840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179840}},{"address":{"type":"absolute","value":1699179972}},{"address":{"type":"absolute","value":1699179995}}]},{"address":{"type":"absolute","value":1699180048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180048}},{"address":{"type":"absolute","value":1699180180}},{"address":{"type":"absolute","value":1699180203}}]},{"address":{"type":"absolute","value":1699180256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180256}},{"address":{"type":"absolute","value":1699180388}},{"address":{"type":"absolute","value":1699180411}}]},{"address":{"type":"absolute","value":1699180464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180464}},{"address":{"type":"absolute","value":1699180596}},{"address":{"type":"absolute","value":1699180619}}]},{"address":{"type":"absolute","value":1699180672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180672}},{"address":{"type":"absolute","value":1699180856}},{"address":{"type":"absolute","value":1699180880}},{"address":{"type":"absolute","value":1699180901}}]},{"address":{"type":"absolute","value":1699180912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180912}},{"address":{"type":"absolute","value":1699181096}},{"address":{"type":"absolute","value":1699181120}},{"address":{"type":"absolute","value":1699181141}}]},{"address":{"type":"absolute","value":1699181152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699181152}},{"address":{"type":"absolute","value":1699181336}},{"address":{"type":"absolute","value":1699181360}},{"address":{"type":"absolute","value":1699181381}}]},{"address":{"type":"absolute","value":1699181392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699181392}},{"address":{"type":"absolute","value":1699181576}},{"address":{"type":"absolute","value":1699181600}},{"address":{"type":"absolute","value":1699181621}}]},{"address":{"type":"absolute","value":1699181632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699181831}},{"address":{"type":"absolute","value":1699182017}},{"address":{"type":"absolute","value":1699182199}},{"address":{"type":"absolute","value":1699182471}},{"address":{"type":"absolute","value":1699182746}},{"address":{"type":"absolute","value":1699182928}},{"address":{"type":"absolute","value":1699183120}},{"address":{"type":"absolute","value":1699183172}},{"address":{"type":"absolute","value":1699183181}},{"address":{"type":"absolute","value":1699183245}}]},{"address":{"type":"absolute","value":1699183344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699183588}},{"address":{"type":"absolute","value":1699183618}},{"address":{"type":"absolute","value":1699183761}},{"address":{"type":"absolute","value":1699183988}},{"address":{"type":"absolute","value":1699184016}},{"address":{"type":"absolute","value":1699184276}},{"address":{"type":"absolute","value":1699184304}},{"address":{"type":"absolute","value":1699184541}},{"address":{"type":"absolute","value":1699184817}},{"address":{"type":"absolute","value":1699185061}},{"address":{"type":"absolute","value":1699185136}},{"address":{"type":"absolute","value":1699185145}},{"address":{"type":"absolute","value":1699185209}}]},{"address":{"type":"absolute","value":1699185280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699185280}},{"address":{"type":"absolute","value":1699185320}}]},{"address":{"type":"absolute","value":1699187520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699187520}}]},{"address":{"type":"absolute","value":1699187712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699187712}},{"address":{"type":"absolute","value":1699187734}},{"address":{"type":"absolute","value":1699187807}},{"address":{"type":"absolute","value":1699187844}},{"address":{"type":"absolute","value":1699187856}},{"address":{"type":"absolute","value":1699187914}}]},{"address":{"type":"absolute","value":1699187984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699188121}},{"address":{"type":"absolute","value":1699188240}},{"address":{"type":"absolute","value":1699192884}},{"address":{"type":"absolute","value":1699192992}},{"address":{"type":"absolute","value":1699193025}},{"address":{"type":"absolute","value":1699193072}}]},{"address":{"type":"absolute","value":1699193120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193120}},{"address":{"type":"absolute","value":1699193231}},{"address":{"type":"absolute","value":1699193252}},{"address":{"type":"absolute","value":1699193274}},{"address":{"type":"absolute","value":1699193392}}]},{"address":{"type":"absolute","value":1699193488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699187520}}]},{"address":{"type":"absolute","value":1699193504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193504}}]},{"address":{"type":"absolute","value":1699193584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193584}}]},{"address":{"type":"absolute","value":1699193680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193719}},{"address":{"type":"absolute","value":1699193733}},{"address":{"type":"absolute","value":1699193762}}]},{"address":{"type":"absolute","value":1699193888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699194072}},{"address":{"type":"absolute","value":1699196907}},{"address":{"type":"absolute","value":1699197456}}]},{"address":{"type":"absolute","value":1699198016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699198184}},{"address":{"type":"absolute","value":1699200882}},{"address":{"type":"absolute","value":1699201440}}]},{"address":{"type":"absolute","value":1699202000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699202168}},{"address":{"type":"absolute","value":1699205054}},{"address":{"type":"absolute","value":1699205648}}]},{"address":{"type":"absolute","value":1699206160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699206160}},{"address":{"type":"absolute","value":1699206320}},{"address":{"type":"absolute","value":1699206352}},{"address":{"type":"absolute","value":1699206496}},{"address":{"type":"absolute","value":1699206888}},{"address":{"type":"absolute","value":1699207009}},{"address":{"type":"absolute","value":1699207015}},{"address":{"type":"absolute","value":1699207028}},{"address":{"type":"absolute","value":1699207106}},{"address":{"type":"absolute","value":1699207156}},{"address":{"type":"absolute","value":1699207251}}]},{"address":{"type":"absolute","value":1699207280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699207438}},{"address":{"type":"absolute","value":1699207794}},{"address":{"type":"absolute","value":1699207907}},{"address":{"type":"absolute","value":1699207939}},{"address":{"type":"absolute","value":1699207971}},{"address":{"type":"absolute","value":1699207991}},{"address":{"type":"absolute","value":1699208016}},{"address":{"type":"absolute","value":1699208096}}]},{"address":{"type":"absolute","value":1699208304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208359}},{"address":{"type":"absolute","value":1699208384}},{"address":{"type":"absolute","value":1699208405}},{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}},{"address":{"type":"absolute","value":1699224292}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1699208448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208488}}]},{"address":{"type":"absolute","value":1699208496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208496}},{"address":{"type":"absolute","value":1699208608}},{"address":{"type":"absolute","value":1699208690}},{"address":{"type":"absolute","value":1699208757}},{"address":{"type":"absolute","value":1699208816}}]},{"address":{"type":"absolute","value":1699208848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208879}}]},{"address":{"type":"absolute","value":1699208928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208974}},{"address":{"type":"absolute","value":1699208992}},{"address":{"type":"absolute","value":1699209008}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699210681}},{"address":{"type":"absolute","value":1699210747}},{"address":{"type":"absolute","value":1699223534}}]},{"address":{"type":"absolute","value":1699209024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209067}},{"address":{"type":"absolute","value":1699209076}},{"address":{"type":"absolute","value":1699209088}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699212704}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226256}}]},{"address":{"type":"absolute","value":1699209104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209137}},{"address":{"type":"absolute","value":1699209152}},{"address":{"type":"absolute","value":1699209166}}]},{"address":{"type":"absolute","value":1699209184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209197}},{"address":{"type":"absolute","value":1699209216}},{"address":{"type":"absolute","value":1699230294}}]},{"address":{"type":"absolute","value":1699209232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209245}},{"address":{"type":"absolute","value":1699209250}}]},{"address":{"type":"absolute","value":1699209264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209277}},{"address":{"type":"absolute","value":1699209282}}]},{"address":{"type":"absolute","value":1699209296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209313}},{"address":{"type":"absolute","value":1699209328}}]},{"address":{"type":"absolute","value":1699209344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209360}},{"address":{"type":"absolute","value":1699209376}}]},{"address":{"type":"absolute","value":1699209392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209405}},{"address":{"type":"absolute","value":1699209424}},{"address":{"type":"absolute","value":1699212960}}]},{"address":{"type":"absolute","value":1699209440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209491}},{"address":{"type":"absolute","value":1699209504}}]},{"address":{"type":"absolute","value":1699209536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209536}}]},{"address":{"type":"absolute","value":1699209584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209584}}]},{"address":{"type":"absolute","value":1699209632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208359}},{"address":{"type":"absolute","value":1699208384}},{"address":{"type":"absolute","value":1699208405}},{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}},{"address":{"type":"absolute","value":1699224292}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1699209648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209689}},{"address":{"type":"absolute","value":1699209696}},{"address":{"type":"absolute","value":1699214352}},{"address":{"type":"absolute","value":1699214366}}]},{"address":{"type":"absolute","value":1699209712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699209749}},{"address":{"type":"absolute","value":1699209760}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214528}},{"address":{"type":"absolute","value":1699214553}},{"address":{"type":"absolute","value":1699214729}},{"address":{"type":"absolute","value":1699214795}}]},{"address":{"type":"absolute","value":1699209776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209813}},{"address":{"type":"absolute","value":1699209824}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214909}}]},{"address":{"type":"absolute","value":1699209840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210038}},{"address":{"type":"absolute","value":1699210052}},{"address":{"type":"absolute","value":1699210080}},{"address":{"type":"absolute","value":1699210176}},{"address":{"type":"absolute","value":1699210234}},{"address":{"type":"absolute","value":1699210257}},{"address":{"type":"absolute","value":1699224292}}]},{"address":{"type":"absolute","value":1699210384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210401}},{"address":{"type":"absolute","value":1699210416}},{"address":{"type":"absolute","value":1699225329}},{"address":{"type":"absolute","value":1699225483}},{"address":{"type":"absolute","value":1699225537}},{"address":{"type":"absolute","value":1699225637}},{"address":{"type":"absolute","value":1699225652}},{"address":{"type":"absolute","value":1699225668}},{"address":{"type":"absolute","value":1699225701}}]},{"address":{"type":"absolute","value":1699210432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210452}}]},{"address":{"type":"absolute","value":1699210496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210533}}]},{"address":{"type":"absolute","value":1699210576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}}]},{"address":{"type":"absolute","value":1699210640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699210681}},{"address":{"type":"absolute","value":1699210747}}]},{"address":{"type":"absolute","value":1699210832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699211078}},{"address":{"type":"absolute","value":1699211136}},{"address":{"type":"absolute","value":1699211176}},{"address":{"type":"absolute","value":1699211223}}]},{"address":{"type":"absolute","value":1699211312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699211343}},{"address":{"type":"absolute","value":1699211360}},{"address":{"type":"absolute","value":1699211374}},{"address":{"type":"absolute","value":1699211425}},{"address":{"type":"absolute","value":1699211440}},{"address":{"type":"absolute","value":1699211477}},{"address":{"type":"absolute","value":1699211528}}]},{"address":{"type":"absolute","value":1699211584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699211922}},{"address":{"type":"absolute","value":1699211952}},{"address":{"type":"absolute","value":1699212017}},{"address":{"type":"absolute","value":1699212032}},{"address":{"type":"absolute","value":1699212112}}]},{"address":{"type":"absolute","value":1699212384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212403}},{"address":{"type":"absolute","value":1699212422}},{"address":{"type":"absolute","value":1699212459}}]},{"address":{"type":"absolute","value":1699212656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699210681}},{"address":{"type":"absolute","value":1699210747}}]},{"address":{"type":"absolute","value":1699212704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699212704}}]},{"address":{"type":"absolute","value":1699212736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212736}}]},{"address":{"type":"absolute","value":1699212960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212960}}]},{"address":{"type":"absolute","value":1699212992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212992}},{"address":{"type":"absolute","value":1699213118}},{"address":{"type":"absolute","value":1699213131}},{"address":{"type":"absolute","value":1699213168}}]},{"address":{"type":"absolute","value":1699213184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}}]},{"address":{"type":"absolute","value":1699214352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699214352}},{"address":{"type":"absolute","value":1699214366}}]},{"address":{"type":"absolute","value":1699214416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214528}},{"address":{"type":"absolute","value":1699214553}},{"address":{"type":"absolute","value":1699214729}},{"address":{"type":"absolute","value":1699214795}}]},{"address":{"type":"absolute","value":1699214864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214909}}]},{"address":{"type":"absolute","value":1699214928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699214960}},{"address":{"type":"absolute","value":1699215008}}]},{"address":{"type":"absolute","value":1699215056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215069}},{"address":{"type":"absolute","value":1699215153}}]},{"address":{"type":"absolute","value":1699215168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215213}},{"address":{"type":"absolute","value":1699215232}}]},{"address":{"type":"absolute","value":1699215248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}},{"address":{"type":"absolute","value":1699215272}}]},{"address":{"type":"absolute","value":1699215296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1699215312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215353}}]},{"address":{"type":"absolute","value":1699215360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215360}},{"address":{"type":"absolute","value":1699215404}}]},{"address":{"type":"absolute","value":1699215424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215424}},{"address":{"type":"absolute","value":1699215775}},{"address":{"type":"absolute","value":1699215800}},{"address":{"type":"absolute","value":1699215824}},{"address":{"type":"absolute","value":1699215876}}]},{"address":{"type":"absolute","value":1699215904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699216051}},{"address":{"type":"absolute","value":1699216064}}]},{"address":{"type":"absolute","value":1699216080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699216174}},{"address":{"type":"absolute","value":1699216218}}]},{"address":{"type":"absolute","value":1699216240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483598}},{"address":{"type":"absolute","value":1698483603}},{"address":{"type":"absolute","value":1698483632}},{"address":{"type":"absolute","value":1699216340}},{"address":{"type":"absolute","value":1699216386}},{"address":{"type":"absolute","value":1699216427}}]},{"address":{"type":"absolute","value":1699216464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}},{"address":{"type":"absolute","value":1698529936}},{"address":{"type":"absolute","value":1699216509}}]},{"address":{"type":"absolute","value":1699216560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699216560}},{"address":{"type":"absolute","value":1699216737}},{"address":{"type":"absolute","value":1699216988}},{"address":{"type":"absolute","value":1699216995}},{"address":{"type":"absolute","value":1699217133}},{"address":{"type":"absolute","value":1699217344}},{"address":{"type":"absolute","value":1699217530}}]},{"address":{"type":"absolute","value":1699217632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699217716}},{"address":{"type":"absolute","value":1699217769}},{"address":{"type":"absolute","value":1699217811}}]},{"address":{"type":"absolute","value":1699217840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699218102}},{"address":{"type":"absolute","value":1699218448}}]},{"address":{"type":"absolute","value":1699218464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699218678}},{"address":{"type":"absolute","value":1699218846}}]},{"address":{"type":"absolute","value":1699218976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699219145}},{"address":{"type":"absolute","value":1699219202}},{"address":{"type":"absolute","value":1699219224}},{"address":{"type":"absolute","value":1699219249}}]},{"address":{"type":"absolute","value":1699219296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699219445}},{"address":{"type":"absolute","value":1699219478}},{"address":{"type":"absolute","value":1699219501}},{"address":{"type":"absolute","value":1699219616}}]},{"address":{"type":"absolute","value":1699219744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699219766}},{"address":{"type":"absolute","value":1699220011}},{"address":{"type":"absolute","value":1699220069}},{"address":{"type":"absolute","value":1699220096}}]},{"address":{"type":"absolute","value":1699220112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220160}},{"address":{"type":"absolute","value":1699220176}},{"address":{"type":"absolute","value":1699220184}},{"address":{"type":"absolute","value":1699220311}},{"address":{"type":"absolute","value":1699220368}},{"address":{"type":"absolute","value":1699220454}}]},{"address":{"type":"absolute","value":1699220480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220568}},{"address":{"type":"absolute","value":1699220589}},{"address":{"type":"absolute","value":1699220624}}]},{"address":{"type":"absolute","value":1699220640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220568}},{"address":{"type":"absolute","value":1699220589}},{"address":{"type":"absolute","value":1699220624}},{"address":{"type":"absolute","value":1699220693}},{"address":{"type":"absolute","value":1699220736}},{"address":{"type":"absolute","value":1699220759}}]},{"address":{"type":"absolute","value":1699220784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220805}},{"address":{"type":"absolute","value":1699220871}}]},{"address":{"type":"absolute","value":1699220928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220987}},{"address":{"type":"absolute","value":1699221015}},{"address":{"type":"absolute","value":1699221127}},{"address":{"type":"absolute","value":1699221477}},{"address":{"type":"absolute","value":1699221523}},{"address":{"type":"absolute","value":1699221593}},{"address":{"type":"absolute","value":1699221628}},{"address":{"type":"absolute","value":1699221643}},{"address":{"type":"absolute","value":1699221690}},{"address":{"type":"absolute","value":1699221746}},{"address":{"type":"absolute","value":1699221893}},{"address":{"type":"absolute","value":1699221988}},{"address":{"type":"absolute","value":1699222022}},{"address":{"type":"absolute","value":1699222057}},{"address":{"type":"absolute","value":1699222260}},{"address":{"type":"absolute","value":1699222287}},{"address":{"type":"absolute","value":1699222452}},{"address":{"type":"absolute","value":1699222456}},{"address":{"type":"absolute","value":1699222832}},{"address":{"type":"absolute","value":1699222845}},{"address":{"type":"absolute","value":1699222976}},{"address":{"type":"absolute","value":1699223175}}]},{"address":{"type":"absolute","value":1699223280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220987}},{"address":{"type":"absolute","value":1699221015}},{"address":{"type":"absolute","value":1699221127}},{"address":{"type":"absolute","value":1699221477}},{"address":{"type":"absolute","value":1699221523}},{"address":{"type":"absolute","value":1699221593}},{"address":{"type":"absolute","value":1699221628}},{"address":{"type":"absolute","value":1699221643}},{"address":{"type":"absolute","value":1699221690}},{"address":{"type":"absolute","value":1699221746}},{"address":{"type":"absolute","value":1699221893}},{"address":{"type":"absolute","value":1699221988}},{"address":{"type":"absolute","value":1699222022}},{"address":{"type":"absolute","value":1699222057}},{"address":{"type":"absolute","value":1699222260}},{"address":{"type":"absolute","value":1699222287}},{"address":{"type":"absolute","value":1699222452}},{"address":{"type":"absolute","value":1699222456}},{"address":{"type":"absolute","value":1699222832}},{"address":{"type":"absolute","value":1699222845}},{"address":{"type":"absolute","value":1699222976}},{"address":{"type":"absolute","value":1699223175}},{"address":{"type":"absolute","value":1699223382}},{"address":{"type":"absolute","value":1699223408}},{"address":{"type":"absolute","value":1699223437}}]},{"address":{"type":"absolute","value":1699223488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699223534}}]},{"address":{"type":"absolute","value":1699223600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699223534}}]},{"address":{"type":"absolute","value":1699223648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699223687}},{"address":{"type":"absolute","value":1699223737}},{"address":{"type":"absolute","value":1699223824}}]},{"address":{"type":"absolute","value":1699223936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699224059}},{"address":{"type":"absolute","value":1699224068}}]},{"address":{"type":"absolute","value":1699224128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699224292}}]},{"address":{"type":"absolute","value":1699224576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699224656}},{"address":{"type":"absolute","value":1699224671}},{"address":{"type":"absolute","value":1699224686}}]},{"address":{"type":"absolute","value":1699225200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225231}},{"address":{"type":"absolute","value":1699225280}}]},{"address":{"type":"absolute","value":1699225296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225329}},{"address":{"type":"absolute","value":1699225483}},{"address":{"type":"absolute","value":1699225537}},{"address":{"type":"absolute","value":1699225637}},{"address":{"type":"absolute","value":1699225652}},{"address":{"type":"absolute","value":1699225668}},{"address":{"type":"absolute","value":1699225701}}]},{"address":{"type":"absolute","value":1699225904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225924}}]},{"address":{"type":"absolute","value":1699225968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225998}}]},{"address":{"type":"absolute","value":1699226032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226063}},{"address":{"type":"absolute","value":1699226101}},{"address":{"type":"absolute","value":1699226128}},{"address":{"type":"absolute","value":1699226133}}]},{"address":{"type":"absolute","value":1699226256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226256}}]},{"address":{"type":"absolute","value":1699226336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1699226598},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226598}}]},{"address":{"type":"absolute","value":1699226648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226648}},{"address":{"type":"absolute","value":1699226730}},{"address":{"type":"absolute","value":1699226771}},{"address":{"type":"absolute","value":1699226807}}]},{"address":{"type":"absolute","value":1699226814},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226814}}]},{"address":{"type":"absolute","value":1699226833},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226833}}]},{"address":{"type":"absolute","value":1699226871},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226871}},{"address":{"type":"absolute","value":1699226979}},{"address":{"type":"absolute","value":1699227034}}]},{"address":{"type":"absolute","value":1699227064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227064}},{"address":{"type":"absolute","value":1699227175}},{"address":{"type":"absolute","value":1699227334}},{"address":{"type":"absolute","value":1699227353}}]},{"address":{"type":"absolute","value":1699227374},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227374}},{"address":{"type":"absolute","value":1699227504}},{"address":{"type":"absolute","value":1699227597}},{"address":{"type":"absolute","value":1699227623}}]},{"address":{"type":"absolute","value":1699227629},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227629}},{"address":{"type":"absolute","value":1699227740}}]},{"address":{"type":"absolute","value":1699227746},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227746}},{"address":{"type":"absolute","value":1699227911}}]},{"address":{"type":"absolute","value":1699227920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228034}},{"address":{"type":"absolute","value":1699228065}}]},{"address":{"type":"absolute","value":1699228093},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228134}},{"address":{"type":"absolute","value":1699228189}}]},{"address":{"type":"absolute","value":1699228196},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228196}},{"address":{"type":"absolute","value":1699228363}}]},{"address":{"type":"absolute","value":1699228369},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228369}},{"address":{"type":"absolute","value":1699228477}},{"address":{"type":"absolute","value":1699228536}}]},{"address":{"type":"absolute","value":1699228542},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228542}},{"address":{"type":"absolute","value":1699228762}},{"address":{"type":"absolute","value":1699228772}},{"address":{"type":"absolute","value":1699228802}}]},{"address":{"type":"absolute","value":1699228808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228808}},{"address":{"type":"absolute","value":1699228887}}]},{"address":{"type":"absolute","value":1699228894},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229120}},{"address":{"type":"absolute","value":1699229151}},{"address":{"type":"absolute","value":1699229199}},{"address":{"type":"absolute","value":1699229222}},{"address":{"type":"absolute","value":1699229277}},{"address":{"type":"absolute","value":1699229291}},{"address":{"type":"absolute","value":1699229305}},{"address":{"type":"absolute","value":1699229328}},{"address":{"type":"absolute","value":1699229381}},{"address":{"type":"absolute","value":1699229409}}]},{"address":{"type":"absolute","value":1699229418},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229418}},{"address":{"type":"absolute","value":1699229472}}]},{"address":{"type":"absolute","value":1699229489},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229489}},{"address":{"type":"absolute","value":1699229553}}]},{"address":{"type":"absolute","value":1699229560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229560}}]},{"address":{"type":"absolute","value":1699229592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229592}},{"address":{"type":"absolute","value":1699229773}},{"address":{"type":"absolute","value":1699229845}},{"address":{"type":"absolute","value":1699230022}},{"address":{"type":"absolute","value":1699230063}}]},{"address":{"type":"absolute","value":1699230105},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230105}},{"address":{"type":"absolute","value":1699230228}}]},{"address":{"type":"absolute","value":1699230234},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230294}}]},{"address":{"type":"absolute","value":1699230544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230601}},{"address":{"type":"absolute","value":1699230611}},{"address":{"type":"absolute","value":1699230640}}]},{"address":{"type":"absolute","value":1699230672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230702}},{"address":{"type":"absolute","value":1699230728}}]},{"address":{"type":"absolute","value":1699230752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230785}}]},{"address":{"type":"absolute","value":1699230864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230913}}]},{"address":{"type":"absolute","value":1699231232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699231232}}]},{"address":{"type":"absolute","value":1699231280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699231472}},{"address":{"type":"absolute","value":1699231517}},{"address":{"type":"absolute","value":1699231772}},{"address":{"type":"absolute","value":1699231793}},{"address":{"type":"absolute","value":1699231874}},{"address":{"type":"absolute","value":1699232027}},{"address":{"type":"absolute","value":1699232109}},{"address":{"type":"absolute","value":1699232645}},{"address":{"type":"absolute","value":1699233082}},{"address":{"type":"absolute","value":1699233146}},{"address":{"type":"absolute","value":1699233364}},{"address":{"type":"absolute","value":1699233378}}]},{"address":{"type":"absolute","value":1699233856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234426}}]},{"address":{"type":"absolute","value":1699234544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234544}},{"address":{"type":"absolute","value":1699234597}},{"address":{"type":"absolute","value":1699234627}},{"address":{"type":"absolute","value":1699234699}},{"address":{"type":"absolute","value":1699234725}},{"address":{"type":"absolute","value":1699234797}},{"address":{"type":"absolute","value":1699234868}},{"address":{"type":"absolute","value":1699234912}}]},{"address":{"type":"absolute","value":1699234992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}}]},{"address":{"type":"absolute","value":1699235904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699235904}},{"address":{"type":"absolute","value":1699235962}},{"address":{"type":"absolute","value":1699235999}},{"address":{"type":"absolute","value":1699236072}},{"address":{"type":"absolute","value":1699236098}},{"address":{"type":"absolute","value":1699236173}},{"address":{"type":"absolute","value":1699236244}},{"address":{"type":"absolute","value":1699236276}}]},{"address":{"type":"absolute","value":1699236352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699236352}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699236432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699236480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236480}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699236528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236560}}]},{"address":{"type":"absolute","value":1699236608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236560}}]},{"address":{"type":"absolute","value":1699236640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236712}},{"address":{"type":"absolute","value":1699236720}}]},{"address":{"type":"absolute","value":1699236768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236811}},{"address":{"type":"absolute","value":1699236836}},{"address":{"type":"absolute","value":1699236868}},{"address":{"type":"absolute","value":1699236896}}]},{"address":{"type":"absolute","value":1699236912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236959}},{"address":{"type":"absolute","value":1699236992}},{"address":{"type":"absolute","value":1699237059}},{"address":{"type":"absolute","value":1699237082}},{"address":{"type":"absolute","value":1699237104}}]},{"address":{"type":"absolute","value":1699237120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237168}},{"address":{"type":"absolute","value":1699237188}}]},{"address":{"type":"absolute","value":1699237216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699237280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237312}}]},{"address":{"type":"absolute","value":1699237376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237616}},{"address":{"type":"absolute","value":1699237643}},{"address":{"type":"absolute","value":1699237808}},{"address":{"type":"absolute","value":1699237859}},{"address":{"type":"absolute","value":1699237877}}]},{"address":{"type":"absolute","value":1699238000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238080}},{"address":{"type":"absolute","value":1699238099}},{"address":{"type":"absolute","value":1699238112}}]},{"address":{"type":"absolute","value":1699238128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699238164}},{"address":{"type":"absolute","value":1699238288}},{"address":{"type":"absolute","value":1699238320}},{"address":{"type":"absolute","value":1699238337}},{"address":{"type":"absolute","value":1699238352}},{"address":{"type":"absolute","value":1699238368}}]},{"address":{"type":"absolute","value":1699238480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1699238912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238956}},{"address":{"type":"absolute","value":1699238970}},{"address":{"type":"absolute","value":1699238977}}]},{"address":{"type":"absolute","value":1699239008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1699239024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1699239040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239120}}]},{"address":{"type":"absolute","value":1699239136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}}]},{"address":{"type":"absolute","value":1699240240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699240240}},{"address":{"type":"absolute","value":1699240296}},{"address":{"type":"absolute","value":1699240358}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699240432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699240432}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699240496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}}]},{"address":{"type":"absolute","value":1699240512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699240720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699240720}},{"address":{"type":"absolute","value":1699240749}},{"address":{"type":"absolute","value":1699240768}},{"address":{"type":"absolute","value":1699240824}},{"address":{"type":"absolute","value":1699240835}}]},{"address":{"type":"absolute","value":1699240928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699240928}}]},{"address":{"type":"absolute","value":1699240976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699240240}},{"address":{"type":"absolute","value":1699240296}},{"address":{"type":"absolute","value":1699240358}},{"address":{"type":"absolute","value":1699240432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699241005}},{"address":{"type":"absolute","value":1699241036}},{"address":{"type":"absolute","value":1699241056}},{"address":{"type":"absolute","value":1699241106}},{"address":{"type":"absolute","value":1699241124}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699241168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241269}}]},{"address":{"type":"absolute","value":1699241328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241328}},{"address":{"type":"absolute","value":1699241363}},{"address":{"type":"absolute","value":1699241408}}]},{"address":{"type":"absolute","value":1699241456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241328}},{"address":{"type":"absolute","value":1699241363}},{"address":{"type":"absolute","value":1699241408}},{"address":{"type":"absolute","value":1699241490}},{"address":{"type":"absolute","value":1699241504}}]},{"address":{"type":"absolute","value":1699241552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241593}},{"address":{"type":"absolute","value":1699241632}}]},{"address":{"type":"absolute","value":1699241680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241593}},{"address":{"type":"absolute","value":1699241632}},{"address":{"type":"absolute","value":1699241714}},{"address":{"type":"absolute","value":1699241728}}]},{"address":{"type":"absolute","value":1699241776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241785}},{"address":{"type":"absolute","value":1699241810}},{"address":{"type":"absolute","value":1699241840}}]},{"address":{"type":"absolute","value":1699241856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241897}}]},{"address":{"type":"absolute","value":1699243120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243189}},{"address":{"type":"absolute","value":1699243251}}]},{"address":{"type":"absolute","value":1699243280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243410}},{"address":{"type":"absolute","value":1699243433}}]},{"address":{"type":"absolute","value":1699243568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699243568}},{"address":{"type":"absolute","value":1699243765}},{"address":{"type":"absolute","value":1699244162}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1699244400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699244400}}]},{"address":{"type":"absolute","value":1699244448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699244464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699244506}}]},{"address":{"type":"absolute","value":1699244640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699244701}},{"address":{"type":"absolute","value":1699244720}},{"address":{"type":"absolute","value":1699244736}}]},{"address":{"type":"absolute","value":1699244768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699245152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699245152}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699245200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699245200}},{"address":{"type":"absolute","value":1699245270}},{"address":{"type":"absolute","value":1699245327}}]},{"address":{"type":"absolute","value":1699245392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}}]},{"address":{"type":"absolute","value":1699250096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699250096}},{"address":{"type":"absolute","value":1699250139}},{"address":{"type":"absolute","value":1699250150}},{"address":{"type":"absolute","value":1699250181}},{"address":{"type":"absolute","value":1699250352}},{"address":{"type":"absolute","value":1699250418}},{"address":{"type":"absolute","value":1699250480}},{"address":{"type":"absolute","value":1699250497}}]},{"address":{"type":"absolute","value":1699250896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699250915}},{"address":{"type":"absolute","value":1699250930}},{"address":{"type":"absolute","value":1699250943}},{"address":{"type":"absolute","value":1699250954}}]},{"address":{"type":"absolute","value":1699250976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251025}},{"address":{"type":"absolute","value":1699251067}},{"address":{"type":"absolute","value":1699251088}},{"address":{"type":"absolute","value":1699251104}},{"address":{"type":"absolute","value":1699251136}}]},{"address":{"type":"absolute","value":1699251264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251300}},{"address":{"type":"absolute","value":1699251338}},{"address":{"type":"absolute","value":1699251401}},{"address":{"type":"absolute","value":1699251440}},{"address":{"type":"absolute","value":1699251573}},{"address":{"type":"absolute","value":1699251597}},{"address":{"type":"absolute","value":1699251664}},{"address":{"type":"absolute","value":1699251696}},{"address":{"type":"absolute","value":1699251728}},{"address":{"type":"absolute","value":1699251741}}]},{"address":{"type":"absolute","value":1699251776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237168}},{"address":{"type":"absolute","value":1699237188}},{"address":{"type":"absolute","value":1699251796}},{"address":{"type":"absolute","value":1699251842}},{"address":{"type":"absolute","value":1699251854}}]},{"address":{"type":"absolute","value":1699251888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251888}}]},{"address":{"type":"absolute","value":1699251936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251936}}]},{"address":{"type":"absolute","value":1699251968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251968}}]},{"address":{"type":"absolute","value":1699252016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699252096}},{"address":{"type":"absolute","value":1699252197}},{"address":{"type":"absolute","value":1699252237}},{"address":{"type":"absolute","value":1699252411}},{"address":{"type":"absolute","value":1699252464}}]},{"address":{"type":"absolute","value":1699252544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699252752}},{"address":{"type":"absolute","value":1699252851}},{"address":{"type":"absolute","value":1699252953}},{"address":{"type":"absolute","value":1699252982}},{"address":{"type":"absolute","value":1699253068}},{"address":{"type":"absolute","value":1699253125}},{"address":{"type":"absolute","value":1699253189}},{"address":{"type":"absolute","value":1699253232}},{"address":{"type":"absolute","value":1699253284}},{"address":{"type":"absolute","value":1699253610}},{"address":{"type":"absolute","value":1699253728}},{"address":{"type":"absolute","value":1699253828}},{"address":{"type":"absolute","value":1699253836}},{"address":{"type":"absolute","value":1699253856}}]},{"address":{"type":"absolute","value":1699254128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699254213}},{"address":{"type":"absolute","value":1699254245}},{"address":{"type":"absolute","value":1699254416}},{"address":{"type":"absolute","value":1699254520}},{"address":{"type":"absolute","value":1699254568}},{"address":{"type":"absolute","value":1699254646}},{"address":{"type":"absolute","value":1699254753}},{"address":{"type":"absolute","value":1699254770}},{"address":{"type":"absolute","value":1699254922}},{"address":{"type":"absolute","value":1699254960}},{"address":{"type":"absolute","value":1699255075}},{"address":{"type":"absolute","value":1699255149}},{"address":{"type":"absolute","value":1699255168}},{"address":{"type":"absolute","value":1699255184}},{"address":{"type":"absolute","value":1699255228}},{"address":{"type":"absolute","value":1699255297}},{"address":{"type":"absolute","value":1699255388}},{"address":{"type":"absolute","value":1699255413}}]},{"address":{"type":"absolute","value":1699255472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699255617}},{"address":{"type":"absolute","value":1699255648}}]},{"address":{"type":"absolute","value":1699255696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699255696}},{"address":{"type":"absolute","value":1699255853}}]},{"address":{"type":"absolute","value":1699256016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699256064}}]},{"address":{"type":"absolute","value":1699256096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699256096}},{"address":{"type":"absolute","value":1699256140}},{"address":{"type":"absolute","value":1699256169}},{"address":{"type":"absolute","value":1699256266}},{"address":{"type":"absolute","value":1699256285}},{"address":{"type":"absolute","value":1699256496}},{"address":{"type":"absolute","value":1699256527}},{"address":{"type":"absolute","value":1699256589}},{"address":{"type":"absolute","value":1699256629}},{"address":{"type":"absolute","value":1699256677}},{"address":{"type":"absolute","value":1699256699}},{"address":{"type":"absolute","value":1699256864}},{"address":{"type":"absolute","value":1699256877}},{"address":{"type":"absolute","value":1699256889}},{"address":{"type":"absolute","value":1699256972}},{"address":{"type":"absolute","value":1699257083}},{"address":{"type":"absolute","value":1699257140}}]},{"address":{"type":"absolute","value":1699257232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699257274}},{"address":{"type":"absolute","value":1699257296}}]},{"address":{"type":"absolute","value":1699257344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699257344}},{"address":{"type":"absolute","value":1699257409}},{"address":{"type":"absolute","value":1699257448}},{"address":{"type":"absolute","value":1699257479}},{"address":{"type":"absolute","value":1699257521}}]},{"address":{"type":"absolute","value":1699257616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699257695}},{"address":{"type":"absolute","value":1699257768}},{"address":{"type":"absolute","value":1699257952}},{"address":{"type":"absolute","value":1699258051}},{"address":{"type":"absolute","value":1699258131}},{"address":{"type":"absolute","value":1699258147}},{"address":{"type":"absolute","value":1699258232}},{"address":{"type":"absolute","value":1699258276}},{"address":{"type":"absolute","value":1699258304}},{"address":{"type":"absolute","value":1699258354}},{"address":{"type":"absolute","value":1699258400}},{"address":{"type":"absolute","value":1699258512}},{"address":{"type":"absolute","value":1699258573}},{"address":{"type":"absolute","value":1699258610}},{"address":{"type":"absolute","value":1699258640}},{"address":{"type":"absolute","value":1699258672}}]},{"address":{"type":"absolute","value":1699258800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699258800}},{"address":{"type":"absolute","value":1699258864}},{"address":{"type":"absolute","value":1699258923}},{"address":{"type":"absolute","value":1699258965}},{"address":{"type":"absolute","value":1699259028}}]},{"address":{"type":"absolute","value":1699259056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699259111}},{"address":{"type":"absolute","value":1699259181}},{"address":{"type":"absolute","value":1699259200}},{"address":{"type":"absolute","value":1699259312}},{"address":{"type":"absolute","value":1699259397}},{"address":{"type":"absolute","value":1699259414}},{"address":{"type":"absolute","value":1699259495}},{"address":{"type":"absolute","value":1699259552}},{"address":{"type":"absolute","value":1699259602}},{"address":{"type":"absolute","value":1699259636}},{"address":{"type":"absolute","value":1699259714}},{"address":{"type":"absolute","value":1699259782}},{"address":{"type":"absolute","value":1699259820}},{"address":{"type":"absolute","value":1699259842}},{"address":{"type":"absolute","value":1699259936}}]},{"address":{"type":"absolute","value":1699259952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699257344}},{"address":{"type":"absolute","value":1699257409}},{"address":{"type":"absolute","value":1699257448}},{"address":{"type":"absolute","value":1699257479}},{"address":{"type":"absolute","value":1699257521}},{"address":{"type":"absolute","value":1699258800}},{"address":{"type":"absolute","value":1699258864}},{"address":{"type":"absolute","value":1699258923}},{"address":{"type":"absolute","value":1699258965}},{"address":{"type":"absolute","value":1699259028}},{"address":{"type":"absolute","value":1699259952}},{"address":{"type":"absolute","value":1699260062}},{"address":{"type":"absolute","value":1699260080}},{"address":{"type":"absolute","value":1699260103}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1699260192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699260296}}]},{"address":{"type":"absolute","value":1699260304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699260304}},{"address":{"type":"absolute","value":1699260354}},{"address":{"type":"absolute","value":1699260416}},{"address":{"type":"absolute","value":1699260436}},{"address":{"type":"absolute","value":1699260562}},{"address":{"type":"absolute","value":1699260583}}]},{"address":{"type":"absolute","value":1699260720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699260814}},{"address":{"type":"absolute","value":1699260888}},{"address":{"type":"absolute","value":1699260996}},{"address":{"type":"absolute","value":1699261067}},{"address":{"type":"absolute","value":1699261172}},{"address":{"type":"absolute","value":1699261282}},{"address":{"type":"absolute","value":1699261328}},{"address":{"type":"absolute","value":1699261363}}]},{"address":{"type":"absolute","value":1699261616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261616}}]},{"address":{"type":"absolute","value":1699261648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261693}}]},{"address":{"type":"absolute","value":1699261712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261739}}]},{"address":{"type":"absolute","value":1699261792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261828}},{"address":{"type":"absolute","value":1699261885}}]},{"address":{"type":"absolute","value":1699261904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261931}}]},{"address":{"type":"absolute","value":1699261984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1699262080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262080}}]},{"address":{"type":"absolute","value":1699262128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262128}},{"address":{"type":"absolute","value":1699262158}},{"address":{"type":"absolute","value":1699262193}},{"address":{"type":"absolute","value":1699262211}},{"address":{"type":"absolute","value":1699262288}},{"address":{"type":"absolute","value":1699262304}}]},{"address":{"type":"absolute","value":1699262336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699262384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699262496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699262512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}}]},{"address":{"type":"absolute","value":1699262688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}},{"address":{"type":"absolute","value":1699262739}},{"address":{"type":"absolute","value":1699262797}}]},{"address":{"type":"absolute","value":1699262816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262836}}]},{"address":{"type":"absolute","value":1699262864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262898}},{"address":{"type":"absolute","value":1699262949}}]},{"address":{"type":"absolute","value":1699263008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263030}},{"address":{"type":"absolute","value":1699263085}},{"address":{"type":"absolute","value":1699263133}},{"address":{"type":"absolute","value":1699263220}}]},{"address":{"type":"absolute","value":1699263264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263290}}]},{"address":{"type":"absolute","value":1699263296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699263328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}},{"address":{"type":"absolute","value":1699263353}},{"address":{"type":"absolute","value":1699263395}},{"address":{"type":"absolute","value":1699263452}},{"address":{"type":"absolute","value":1699263488}}]},{"address":{"type":"absolute","value":1699263520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263601}},{"address":{"type":"absolute","value":1699263617}}]},{"address":{"type":"absolute","value":1699263648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}}]},{"address":{"type":"absolute","value":1699263824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699263824}},{"address":{"type":"absolute","value":1699263846}},{"address":{"type":"absolute","value":1699263878}}]},{"address":{"type":"absolute","value":1699263904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263904}},{"address":{"type":"absolute","value":1699263985}}]},{"address":{"type":"absolute","value":1699264048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}}]},{"address":{"type":"absolute","value":1699264224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264224}}]},{"address":{"type":"absolute","value":1699264336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264336}},{"address":{"type":"absolute","value":1699264437}}]},{"address":{"type":"absolute","value":1699264512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261739}},{"address":{"type":"absolute","value":1699264512}}]},{"address":{"type":"absolute","value":1699264528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261931}},{"address":{"type":"absolute","value":1699264528}}]},{"address":{"type":"absolute","value":1699264544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699264560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699264647}},{"address":{"type":"absolute","value":1699264688}}]},{"address":{"type":"absolute","value":1699264736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}},{"address":{"type":"absolute","value":1699264736}},{"address":{"type":"absolute","value":1699264813}},{"address":{"type":"absolute","value":1699264881}},{"address":{"type":"absolute","value":1699264896}},{"address":{"type":"absolute","value":1699264964}}]},{"address":{"type":"absolute","value":1699264992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264992}},{"address":{"type":"absolute","value":1699265024}},{"address":{"type":"absolute","value":1699265037}}]},{"address":{"type":"absolute","value":1699265088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265088}},{"address":{"type":"absolute","value":1699265099}},{"address":{"type":"absolute","value":1699265162}},{"address":{"type":"absolute","value":1699265200}},{"address":{"type":"absolute","value":1699265216}},{"address":{"type":"absolute","value":1699265232}},{"address":{"type":"absolute","value":1699265248}}]},{"address":{"type":"absolute","value":1699265264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265264}},{"address":{"type":"absolute","value":1699265291}}]},{"address":{"type":"absolute","value":1699265328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699265328}}]},{"address":{"type":"absolute","value":1699265392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265552}},{"address":{"type":"absolute","value":1699265574}},{"address":{"type":"absolute","value":1699265650}},{"address":{"type":"absolute","value":1699265673}}]},{"address":{"type":"absolute","value":1699265776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}},{"address":{"type":"absolute","value":1699265800}},{"address":{"type":"absolute","value":1699265808}}]},{"address":{"type":"absolute","value":1699265856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699265888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699265888}}]},{"address":{"type":"absolute","value":1699265936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699265936}}]},{"address":{"type":"absolute","value":1699265984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699266037}}]},{"address":{"type":"absolute","value":1699266048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699266048}},{"address":{"type":"absolute","value":1699266638}}]},{"address":{"type":"absolute","value":1699266816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262128}},{"address":{"type":"absolute","value":1699262158}},{"address":{"type":"absolute","value":1699262193}},{"address":{"type":"absolute","value":1699262211}},{"address":{"type":"absolute","value":1699262288}},{"address":{"type":"absolute","value":1699262304}},{"address":{"type":"absolute","value":1699266816}},{"address":{"type":"absolute","value":1699266863}}]},{"address":{"type":"absolute","value":1699266896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264336}},{"address":{"type":"absolute","value":1699264437}},{"address":{"type":"absolute","value":1699266896}},{"address":{"type":"absolute","value":1699266949}}]},{"address":{"type":"absolute","value":1699266976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699266976}}]},{"address":{"type":"absolute","value":1699267024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267024}}]},{"address":{"type":"absolute","value":1699267072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267072}}]},{"address":{"type":"absolute","value":1699267120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267120}}]},{"address":{"type":"absolute","value":1699267184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}}]},{"address":{"type":"absolute","value":1699267216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}}]},{"address":{"type":"absolute","value":1699267248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267339}},{"address":{"type":"absolute","value":1699267376}},{"address":{"type":"absolute","value":1699267393}}]},{"address":{"type":"absolute","value":1699267408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267454}}]},{"address":{"type":"absolute","value":1699267472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699267523}},{"address":{"type":"absolute","value":1699267552}}]},{"address":{"type":"absolute","value":1699267568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267568}}]},{"address":{"type":"absolute","value":1699267632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267692}},{"address":{"type":"absolute","value":1699267740}}]},{"address":{"type":"absolute","value":1699267808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267868}},{"address":{"type":"absolute","value":1699267916}}]},{"address":{"type":"absolute","value":1699268000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699268000}}]},{"address":{"type":"absolute","value":1699268112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699268261}},{"address":{"type":"absolute","value":1699268304}}]},{"address":{"type":"absolute","value":1699268336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699268349}},{"address":{"type":"absolute","value":1699268368}}]},{"address":{"type":"absolute","value":1699268384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043593}},{"address":{"type":"absolute","value":1699043647}},{"address":{"type":"absolute","value":1699043664}},{"address":{"type":"absolute","value":1699043694}},{"address":{"type":"absolute","value":1699043729}},{"address":{"type":"absolute","value":1699043768}},{"address":{"type":"absolute","value":1699043798}},{"address":{"type":"absolute","value":1699044016}},{"address":{"type":"absolute","value":1699044099}},{"address":{"type":"absolute","value":1699044127}},{"address":{"type":"absolute","value":1699044242}},{"address":{"type":"absolute","value":1699268384}}]},{"address":{"type":"absolute","value":1699268432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}},{"address":{"type":"absolute","value":1699044464}},{"address":{"type":"absolute","value":1699044512}},{"address":{"type":"absolute","value":1699044547}},{"address":{"type":"absolute","value":1699044586}},{"address":{"type":"absolute","value":1699268432}}]},{"address":{"type":"absolute","value":1699268480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699044636}},{"address":{"type":"absolute","value":1699044667}},{"address":{"type":"absolute","value":1699044698}},{"address":{"type":"absolute","value":1699044729}},{"address":{"type":"absolute","value":1699044760}},{"address":{"type":"absolute","value":1699044800}},{"address":{"type":"absolute","value":1699044882}},{"address":{"type":"absolute","value":1699044896}},{"address":{"type":"absolute","value":1699044976}},{"address":{"type":"absolute","value":1699268480}}]},{"address":{"type":"absolute","value":1699268528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045216}},{"address":{"type":"absolute","value":1699045259}},{"address":{"type":"absolute","value":1699045314}},{"address":{"type":"absolute","value":1699045328}},{"address":{"type":"absolute","value":1699268528}}]},{"address":{"type":"absolute","value":1699268576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046507}},{"address":{"type":"absolute","value":1699046587}},{"address":{"type":"absolute","value":1699046656}},{"address":{"type":"absolute","value":1699046677}},{"address":{"type":"absolute","value":1699046704}},{"address":{"type":"absolute","value":1699046736}},{"address":{"type":"absolute","value":1699047240}},{"address":{"type":"absolute","value":1699047251}},{"address":{"type":"absolute","value":1699047318}},{"address":{"type":"absolute","value":1699047386}},{"address":{"type":"absolute","value":1699047408}},{"address":{"type":"absolute","value":1699047456}},{"address":{"type":"absolute","value":1699268604}},{"address":{"type":"absolute","value":1699268624}},{"address":{"type":"absolute","value":1699268640}}]},{"address":{"type":"absolute","value":1699268672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699268730}},{"address":{"type":"absolute","value":1699268735}},{"address":{"type":"absolute","value":1699268850}},{"address":{"type":"absolute","value":1699269065}},{"address":{"type":"absolute","value":1699269125}}]},{"address":{"type":"absolute","value":1699269168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699269292}},{"address":{"type":"absolute","value":1699269315}},{"address":{"type":"absolute","value":1699269367}},{"address":{"type":"absolute","value":1699269390}},{"address":{"type":"absolute","value":1699269439}},{"address":{"type":"absolute","value":1699269486}},{"address":{"type":"absolute","value":1699269509}},{"address":{"type":"absolute","value":1699269562}},{"address":{"type":"absolute","value":1699269585}},{"address":{"type":"absolute","value":1699269653}},{"address":{"type":"absolute","value":1699269676}},{"address":{"type":"absolute","value":1699269728}},{"address":{"type":"absolute","value":1699269751}},{"address":{"type":"absolute","value":1699269808}}]},{"address":{"type":"absolute","value":1699269856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}}]},{"address":{"type":"absolute","value":1699271296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699266048}},{"address":{"type":"absolute","value":1699266638}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}},{"address":{"type":"absolute","value":1699271296}},{"address":{"type":"absolute","value":1699271336}},{"address":{"type":"absolute","value":1699271345}},{"address":{"type":"absolute","value":1699271472}},{"address":{"type":"absolute","value":1699271493}},{"address":{"type":"absolute","value":1699271894}},{"address":{"type":"absolute","value":1699271969}},{"address":{"type":"absolute","value":1699272000}},{"address":{"type":"absolute","value":1699272460}},{"address":{"type":"absolute","value":1699272473}},{"address":{"type":"absolute","value":1699272498}}]},{"address":{"type":"absolute","value":1699272640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}},{"address":{"type":"absolute","value":1699272640}},{"address":{"type":"absolute","value":1699272678}},{"address":{"type":"absolute","value":1699272752}},{"address":{"type":"absolute","value":1699272770}}]},{"address":{"type":"absolute","value":1699272848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699272848}},{"address":{"type":"absolute","value":1699273304}},{"address":{"type":"absolute","value":1699273631}},{"address":{"type":"absolute","value":1699273958}},{"address":{"type":"absolute","value":1699274827}},{"address":{"type":"absolute","value":1699274880}},{"address":{"type":"absolute","value":1699275381}}]},{"address":{"type":"absolute","value":1699275456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699275522}},{"address":{"type":"absolute","value":1699275621}},{"address":{"type":"absolute","value":1699276104}}]},{"address":{"type":"absolute","value":1699276464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276485}},{"address":{"type":"absolute","value":1699276496}},{"address":{"type":"absolute","value":1699276521}},{"address":{"type":"absolute","value":1699276533}}]},{"address":{"type":"absolute","value":1699276719},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276750}}]},{"address":{"type":"absolute","value":1699276800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276840}}]},{"address":{"type":"absolute","value":1699276960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276960}},{"address":{"type":"absolute","value":1699277031}}]},{"address":{"type":"absolute","value":1699277072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277072}},{"address":{"type":"absolute","value":1699277160}}]},{"address":{"type":"absolute","value":1699277360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277408}}]},{"address":{"type":"absolute","value":1699277424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277424}},{"address":{"type":"absolute","value":1699277472}},{"address":{"type":"absolute","value":1699277483}},{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1699277536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277424}},{"address":{"type":"absolute","value":1699277472}},{"address":{"type":"absolute","value":1699277483}},{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1699277568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277568}},{"address":{"type":"absolute","value":1699277609}},{"address":{"type":"absolute","value":1699277729}}]},{"address":{"type":"absolute","value":1699278048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278048}},{"address":{"type":"absolute","value":1699278061}},{"address":{"type":"absolute","value":1699278080}}]},{"address":{"type":"absolute","value":1699278096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278096}},{"address":{"type":"absolute","value":1699278114}},{"address":{"type":"absolute","value":1699278120}},{"address":{"type":"absolute","value":1699278130}},{"address":{"type":"absolute","value":1699278173}},{"address":{"type":"absolute","value":1699278182}},{"address":{"type":"absolute","value":1699278194}}]},{"address":{"type":"absolute","value":1699278272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278306}},{"address":{"type":"absolute","value":1699278328}},{"address":{"type":"absolute","value":1699278348}},{"address":{"type":"absolute","value":1699278379}},{"address":{"type":"absolute","value":1699278482}},{"address":{"type":"absolute","value":1699278508}},{"address":{"type":"absolute","value":1699278524}},{"address":{"type":"absolute","value":1699278544}},{"address":{"type":"absolute","value":1699278592}},{"address":{"type":"absolute","value":1699278612}}]},{"address":{"type":"absolute","value":1699278784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278835}},{"address":{"type":"absolute","value":1699278953}},{"address":{"type":"absolute","value":1699278992}},{"address":{"type":"absolute","value":1699278996}},{"address":{"type":"absolute","value":1699279056}},{"address":{"type":"absolute","value":1699279074}},{"address":{"type":"absolute","value":1699279088}},{"address":{"type":"absolute","value":1699279126}},{"address":{"type":"absolute","value":1699279167}},{"address":{"type":"absolute","value":1699279226}},{"address":{"type":"absolute","value":1699279256}},{"address":{"type":"absolute","value":1699279269}},{"address":{"type":"absolute","value":1699279292}},{"address":{"type":"absolute","value":1699279344}},{"address":{"type":"absolute","value":1699279397}}]},{"address":{"type":"absolute","value":1699279488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699279488}},{"address":{"type":"absolute","value":1699279587}},{"address":{"type":"absolute","value":1699279654}},{"address":{"type":"absolute","value":1699279713}},{"address":{"type":"absolute","value":1699279742}},{"address":{"type":"absolute","value":1699279780}}]},{"address":{"type":"absolute","value":1699279904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699279969}},{"address":{"type":"absolute","value":1699280037}}]},{"address":{"type":"absolute","value":1699280144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280144}},{"address":{"type":"absolute","value":1699280273}},{"address":{"type":"absolute","value":1699280354}},{"address":{"type":"absolute","value":1699280378}}]},{"address":{"type":"absolute","value":1699280640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280724}}]},{"address":{"type":"absolute","value":1699280752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280777}},{"address":{"type":"absolute","value":1699280811}}]},{"address":{"type":"absolute","value":1699280880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280897}},{"address":{"type":"absolute","value":1699280976}}]},{"address":{"type":"absolute","value":1699281040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281040}},{"address":{"type":"absolute","value":1699281056}},{"address":{"type":"absolute","value":1699281093}},{"address":{"type":"absolute","value":1699281210}}]},{"address":{"type":"absolute","value":1699281264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281264}}]},{"address":{"type":"absolute","value":1699281296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281264}}]},{"address":{"type":"absolute","value":1699281328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281328}},{"address":{"type":"absolute","value":1699281376}},{"address":{"type":"absolute","value":1699281384}}]},{"address":{"type":"absolute","value":1699281408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281408}},{"address":{"type":"absolute","value":1699281455}},{"address":{"type":"absolute","value":1699281493}},{"address":{"type":"absolute","value":1699281523}},{"address":{"type":"absolute","value":1699281536}}]},{"address":{"type":"absolute","value":1699281552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281552}},{"address":{"type":"absolute","value":1699281586}},{"address":{"type":"absolute","value":1699281644}},{"address":{"type":"absolute","value":1699281652}},{"address":{"type":"absolute","value":1699281663}}]},{"address":{"type":"absolute","value":1699281680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281680}},{"address":{"type":"absolute","value":1699281701}},{"address":{"type":"absolute","value":1699281724}}]},{"address":{"type":"absolute","value":1699281744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281744}},{"address":{"type":"absolute","value":1699281778}},{"address":{"type":"absolute","value":1699281839}},{"address":{"type":"absolute","value":1699281850}}]},{"address":{"type":"absolute","value":1699281856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281856}},{"address":{"type":"absolute","value":1699281874}},{"address":{"type":"absolute","value":1699281904}}]},{"address":{"type":"absolute","value":1699281920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281920}},{"address":{"type":"absolute","value":1699281944}},{"address":{"type":"absolute","value":1699281964}},{"address":{"type":"absolute","value":1699282028}},{"address":{"type":"absolute","value":1699282036}},{"address":{"type":"absolute","value":1699282045}},{"address":{"type":"absolute","value":1699282052}}]},{"address":{"type":"absolute","value":1699282080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282080}},{"address":{"type":"absolute","value":1699282114}},{"address":{"type":"absolute","value":1699282131}},{"address":{"type":"absolute","value":1699282172}},{"address":{"type":"absolute","value":1699282181}},{"address":{"type":"absolute","value":1699282190}},{"address":{"type":"absolute","value":1699282197}},{"address":{"type":"absolute","value":1699282208}},{"address":{"type":"absolute","value":1699282235}}]},{"address":{"type":"absolute","value":1699282272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282287}}]},{"address":{"type":"absolute","value":1699282368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282448}},{"address":{"type":"absolute","value":1699282496}},{"address":{"type":"absolute","value":1699282518}}]},{"address":{"type":"absolute","value":1699282592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282628}},{"address":{"type":"absolute","value":1699282651}},{"address":{"type":"absolute","value":1699282716}}]},{"address":{"type":"absolute","value":1699282752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282808}}]},{"address":{"type":"absolute","value":1699282832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282888}}]},{"address":{"type":"absolute","value":1699282912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283106}},{"address":{"type":"absolute","value":1699283189}}]},{"address":{"type":"absolute","value":1699283728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1699283936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699284001}},{"address":{"type":"absolute","value":1699284018}},{"address":{"type":"absolute","value":1699284037}}]},{"address":{"type":"absolute","value":1699284048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699284048}}]},{"address":{"type":"absolute","value":1699284592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699284592}}]},{"address":{"type":"absolute","value":1699284704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]}]},"feature_counts":{"file":21650,"functions":[{"address":{"type":"absolute","value":1698435072},"count":22},{"address":{"type":"absolute","value":1698435088},"count":69},{"address":{"type":"absolute","value":1698435584},"count":44},{"address":{"type":"absolute","value":1698435888},"count":58},{"address":{"type":"absolute","value":1698435968},"count":62},{"address":{"type":"absolute","value":1698435984},"count":63},{"address":{"type":"absolute","value":1698436000},"count":5},{"address":{"type":"absolute","value":1698436016},"count":8},{"address":{"type":"absolute","value":1698436032},"count":8},{"address":{"type":"absolute","value":1698436048},"count":8},{"address":{"type":"absolute","value":1698436064},"count":8},{"address":{"type":"absolute","value":1698436080},"count":26},{"address":{"type":"absolute","value":1698436128},"count":19},{"address":{"type":"absolute","value":1698436160},"count":49},{"address":{"type":"absolute","value":1698436176},"count":29},{"address":{"type":"absolute","value":1698436240},"count":19},{"address":{"type":"absolute","value":1698436272},"count":23},{"address":{"type":"absolute","value":1698436320},"count":18},{"address":{"type":"absolute","value":1698436352},"count":25},{"address":{"type":"absolute","value":1698436400},"count":18},{"address":{"type":"absolute","value":1698436432},"count":62},{"address":{"type":"absolute","value":1698436448},"count":30},{"address":{"type":"absolute","value":1698436512},"count":167},{"address":{"type":"absolute","value":1698436528},"count":86},{"address":{"type":"absolute","value":1698436544},"count":16},{"address":{"type":"absolute","value":1698436560},"count":16},{"address":{"type":"absolute","value":1698436576},"count":21},{"address":{"type":"absolute","value":1698436624},"count":16},{"address":{"type":"absolute","value":1698436640},"count":16},{"address":{"type":"absolute","value":1698436656},"count":62},{"address":{"type":"absolute","value":1698436672},"count":40},{"address":{"type":"absolute","value":1698436688},"count":63},{"address":{"type":"absolute","value":1698436704},"count":63},{"address":{"type":"absolute","value":1698436720},"count":51},{"address":{"type":"absolute","value":1698436736},"count":27},{"address":{"type":"absolute","value":1698436752},"count":42},{"address":{"type":"absolute","value":1698436768},"count":30},{"address":{"type":"absolute","value":1698436784},"count":40},{"address":{"type":"absolute","value":1698436800},"count":40},{"address":{"type":"absolute","value":1698436816},"count":25},{"address":{"type":"absolute","value":1698436864},"count":39},{"address":{"type":"absolute","value":1698436880},"count":43},{"address":{"type":"absolute","value":1698436896},"count":39},{"address":{"type":"absolute","value":1698436912},"count":67},{"address":{"type":"absolute","value":1698436928},"count":67},{"address":{"type":"absolute","value":1698436944},"count":51},{"address":{"type":"absolute","value":1698436960},"count":42},{"address":{"type":"absolute","value":1698436976},"count":18},{"address":{"type":"absolute","value":1698437008},"count":19},{"address":{"type":"absolute","value":1698437024},"count":21},{"address":{"type":"absolute","value":1698437040},"count":45},{"address":{"type":"absolute","value":1698437056},"count":38},{"address":{"type":"absolute","value":1698437072},"count":70},{"address":{"type":"absolute","value":1698437088},"count":40},{"address":{"type":"absolute","value":1698437104},"count":23},{"address":{"type":"absolute","value":1698437152},"count":23},{"address":{"type":"absolute","value":1698437200},"count":18},{"address":{"type":"absolute","value":1698437232},"count":55},{"address":{"type":"absolute","value":1698437248},"count":78},{"address":{"type":"absolute","value":1698437264},"count":70},{"address":{"type":"absolute","value":1698437280},"count":93},{"address":{"type":"absolute","value":1698437296},"count":44},{"address":{"type":"absolute","value":1698437312},"count":70},{"address":{"type":"absolute","value":1698437328},"count":93},{"address":{"type":"absolute","value":1698437344},"count":85},{"address":{"type":"absolute","value":1698437360},"count":43},{"address":{"type":"absolute","value":1698437376},"count":114},{"address":{"type":"absolute","value":1698437392},"count":59},{"address":{"type":"absolute","value":1698437408},"count":151},{"address":{"type":"absolute","value":1698437424},"count":93},{"address":{"type":"absolute","value":1698437440},"count":267},{"address":{"type":"absolute","value":1698437456},"count":28},{"address":{"type":"absolute","value":1698437472},"count":50},{"address":{"type":"absolute","value":1698437488},"count":18},{"address":{"type":"absolute","value":1698437504},"count":28},{"address":{"type":"absolute","value":1698437520},"count":20},{"address":{"type":"absolute","value":1698437536},"count":55},{"address":{"type":"absolute","value":1698437552},"count":32},{"address":{"type":"absolute","value":1698437568},"count":30},{"address":{"type":"absolute","value":1698437584},"count":30},{"address":{"type":"absolute","value":1698437600},"count":18},{"address":{"type":"absolute","value":1698437632},"count":87},{"address":{"type":"absolute","value":1698437648},"count":46},{"address":{"type":"absolute","value":1698437664},"count":18},{"address":{"type":"absolute","value":1698437696},"count":18},{"address":{"type":"absolute","value":1698437728},"count":24},{"address":{"type":"absolute","value":1698437808},"count":48},{"address":{"type":"absolute","value":1698437872},"count":142},{"address":{"type":"absolute","value":1698437920},"count":158},{"address":{"type":"absolute","value":1698437984},"count":48},{"address":{"type":"absolute","value":1698438048},"count":116},{"address":{"type":"absolute","value":1698438112},"count":56},{"address":{"type":"absolute","value":1698438160},"count":40},{"address":{"type":"absolute","value":1698438176},"count":25},{"address":{"type":"absolute","value":1698438192},"count":70},{"address":{"type":"absolute","value":1698438208},"count":50},{"address":{"type":"absolute","value":1698438224},"count":74},{"address":{"type":"absolute","value":1698438240},"count":60},{"address":{"type":"absolute","value":1698438256},"count":87},{"address":{"type":"absolute","value":1698438272},"count":90},{"address":{"type":"absolute","value":1698438288},"count":46},{"address":{"type":"absolute","value":1698438304},"count":60},{"address":{"type":"absolute","value":1698438320},"count":29},{"address":{"type":"absolute","value":1698438336},"count":89},{"address":{"type":"absolute","value":1698438352},"count":42},{"address":{"type":"absolute","value":1698438368},"count":64},{"address":{"type":"absolute","value":1698438384},"count":24},{"address":{"type":"absolute","value":1698438512},"count":29},{"address":{"type":"absolute","value":1698438608},"count":66},{"address":{"type":"absolute","value":1698438624},"count":24},{"address":{"type":"absolute","value":1698438704},"count":24},{"address":{"type":"absolute","value":1698438784},"count":24},{"address":{"type":"absolute","value":1698438864},"count":24},{"address":{"type":"absolute","value":1698438944},"count":24},{"address":{"type":"absolute","value":1698439024},"count":24},{"address":{"type":"absolute","value":1698439104},"count":24},{"address":{"type":"absolute","value":1698439184},"count":18},{"address":{"type":"absolute","value":1698439216},"count":24},{"address":{"type":"absolute","value":1698439296},"count":27},{"address":{"type":"absolute","value":1698439312},"count":35},{"address":{"type":"absolute","value":1698439328},"count":22},{"address":{"type":"absolute","value":1698439344},"count":31},{"address":{"type":"absolute","value":1698439472},"count":28},{"address":{"type":"absolute","value":1698439568},"count":32},{"address":{"type":"absolute","value":1698439584},"count":26},{"address":{"type":"absolute","value":1698439600},"count":24},{"address":{"type":"absolute","value":1698439680},"count":28},{"address":{"type":"absolute","value":1698439696},"count":35},{"address":{"type":"absolute","value":1698439712},"count":9},{"address":{"type":"absolute","value":1698439728},"count":32},{"address":{"type":"absolute","value":1698439744},"count":32},{"address":{"type":"absolute","value":1698439760},"count":29},{"address":{"type":"absolute","value":1698439856},"count":42},{"address":{"type":"absolute","value":1698439872},"count":24},{"address":{"type":"absolute","value":1698439952},"count":24},{"address":{"type":"absolute","value":1698440032},"count":24},{"address":{"type":"absolute","value":1698440112},"count":24},{"address":{"type":"absolute","value":1698440192},"count":24},{"address":{"type":"absolute","value":1698440272},"count":24},{"address":{"type":"absolute","value":1698440352},"count":29},{"address":{"type":"absolute","value":1698440448},"count":29},{"address":{"type":"absolute","value":1698440544},"count":29},{"address":{"type":"absolute","value":1698440640},"count":24},{"address":{"type":"absolute","value":1698440720},"count":24},{"address":{"type":"absolute","value":1698440784},"count":29},{"address":{"type":"absolute","value":1698440864},"count":18},{"address":{"type":"absolute","value":1698440896},"count":24},{"address":{"type":"absolute","value":1698440976},"count":50},{"address":{"type":"absolute","value":1698440992},"count":25},{"address":{"type":"absolute","value":1698441008},"count":32},{"address":{"type":"absolute","value":1698441056},"count":96},{"address":{"type":"absolute","value":1698441120},"count":41},{"address":{"type":"absolute","value":1698441184},"count":46},{"address":{"type":"absolute","value":1698441232},"count":29},{"address":{"type":"absolute","value":1698441328},"count":29},{"address":{"type":"absolute","value":1698441424},"count":67},{"address":{"type":"absolute","value":1698441440},"count":24},{"address":{"type":"absolute","value":1698441504},"count":29},{"address":{"type":"absolute","value":1698441584},"count":57},{"address":{"type":"absolute","value":1698441600},"count":24},{"address":{"type":"absolute","value":1698441680},"count":58},{"address":{"type":"absolute","value":1698441744},"count":48},{"address":{"type":"absolute","value":1698441760},"count":18},{"address":{"type":"absolute","value":1698441792},"count":69},{"address":{"type":"absolute","value":1698441888},"count":34},{"address":{"type":"absolute","value":1698442016},"count":47},{"address":{"type":"absolute","value":1698442096},"count":29},{"address":{"type":"absolute","value":1698442112},"count":31},{"address":{"type":"absolute","value":1698442160},"count":18},{"address":{"type":"absolute","value":1698442176},"count":24},{"address":{"type":"absolute","value":1698442256},"count":18},{"address":{"type":"absolute","value":1698442288},"count":27},{"address":{"type":"absolute","value":1698442304},"count":46},{"address":{"type":"absolute","value":1698442320},"count":24},{"address":{"type":"absolute","value":1698442400},"count":66},{"address":{"type":"absolute","value":1698442416},"count":39},{"address":{"type":"absolute","value":1698442512},"count":165},{"address":{"type":"absolute","value":1698442624},"count":24},{"address":{"type":"absolute","value":1698442704},"count":30},{"address":{"type":"absolute","value":1698442816},"count":30},{"address":{"type":"absolute","value":1698442928},"count":61},{"address":{"type":"absolute","value":1698442944},"count":105},{"address":{"type":"absolute","value":1698443056},"count":35},{"address":{"type":"absolute","value":1698443136},"count":18},{"address":{"type":"absolute","value":1698443168},"count":36},{"address":{"type":"absolute","value":1698443184},"count":18},{"address":{"type":"absolute","value":1698443216},"count":55},{"address":{"type":"absolute","value":1698443232},"count":26},{"address":{"type":"absolute","value":1698443280},"count":71},{"address":{"type":"absolute","value":1698443296},"count":55},{"address":{"type":"absolute","value":1698443312},"count":75},{"address":{"type":"absolute","value":1698443376},"count":76},{"address":{"type":"absolute","value":1698443392},"count":121},{"address":{"type":"absolute","value":1698443408},"count":16},{"address":{"type":"absolute","value":1698443424},"count":22},{"address":{"type":"absolute","value":1698443440},"count":34},{"address":{"type":"absolute","value":1698443456},"count":7},{"address":{"type":"absolute","value":1698443472},"count":7},{"address":{"type":"absolute","value":1698443488},"count":7},{"address":{"type":"absolute","value":1698443504},"count":21},{"address":{"type":"absolute","value":1698443520},"count":35},{"address":{"type":"absolute","value":1698443536},"count":22},{"address":{"type":"absolute","value":1698443552},"count":37},{"address":{"type":"absolute","value":1698443568},"count":36},{"address":{"type":"absolute","value":1698443584},"count":45},{"address":{"type":"absolute","value":1698443600},"count":32},{"address":{"type":"absolute","value":1698443616},"count":31},{"address":{"type":"absolute","value":1698443632},"count":36},{"address":{"type":"absolute","value":1698443648},"count":31},{"address":{"type":"absolute","value":1698443664},"count":36},{"address":{"type":"absolute","value":1698443680},"count":35},{"address":{"type":"absolute","value":1698443696},"count":26},{"address":{"type":"absolute","value":1698443712},"count":39},{"address":{"type":"absolute","value":1698443728},"count":23},{"address":{"type":"absolute","value":1698443776},"count":24},{"address":{"type":"absolute","value":1698443824},"count":7},{"address":{"type":"absolute","value":1698443840},"count":10},{"address":{"type":"absolute","value":1698443872},"count":7},{"address":{"type":"absolute","value":1698443888},"count":37},{"address":{"type":"absolute","value":1698444032},"count":7},{"address":{"type":"absolute","value":1698444048},"count":6},{"address":{"type":"absolute","value":1698444064},"count":9},{"address":{"type":"absolute","value":1698444080},"count":65},{"address":{"type":"absolute","value":1698444496},"count":23},{"address":{"type":"absolute","value":1698444544},"count":17},{"address":{"type":"absolute","value":1698444592},"count":19},{"address":{"type":"absolute","value":1698444640},"count":27},{"address":{"type":"absolute","value":1698444688},"count":27},{"address":{"type":"absolute","value":1698444736},"count":23},{"address":{"type":"absolute","value":1698444784},"count":23},{"address":{"type":"absolute","value":1698444832},"count":27},{"address":{"type":"absolute","value":1698444880},"count":28},{"address":{"type":"absolute","value":1698444944},"count":72},{"address":{"type":"absolute","value":1698445344},"count":72},{"address":{"type":"absolute","value":1698445376},"count":56},{"address":{"type":"absolute","value":1698445728},"count":77},{"address":{"type":"absolute","value":1698446304},"count":91},{"address":{"type":"absolute","value":1698446864},"count":58},{"address":{"type":"absolute","value":1698446992},"count":20},{"address":{"type":"absolute","value":1698447040},"count":57},{"address":{"type":"absolute","value":1698447424},"count":35},{"address":{"type":"absolute","value":1698447600},"count":54},{"address":{"type":"absolute","value":1698447808},"count":27},{"address":{"type":"absolute","value":1698447888},"count":37},{"address":{"type":"absolute","value":1698448032},"count":33},{"address":{"type":"absolute","value":1698448080},"count":50},{"address":{"type":"absolute","value":1698448288},"count":122},{"address":{"type":"absolute","value":1698449552},"count":36},{"address":{"type":"absolute","value":1698451312},"count":23},{"address":{"type":"absolute","value":1698451424},"count":35},{"address":{"type":"absolute","value":1698451520},"count":21},{"address":{"type":"absolute","value":1698451568},"count":22},{"address":{"type":"absolute","value":1698451616},"count":40},{"address":{"type":"absolute","value":1698451728},"count":46},{"address":{"type":"absolute","value":1698451856},"count":6},{"address":{"type":"absolute","value":1698451872},"count":37},{"address":{"type":"absolute","value":1698451888},"count":27},{"address":{"type":"absolute","value":1698451920},"count":35},{"address":{"type":"absolute","value":1698452048},"count":37},{"address":{"type":"absolute","value":1698452176},"count":46},{"address":{"type":"absolute","value":1698452192},"count":33},{"address":{"type":"absolute","value":1698452320},"count":37},{"address":{"type":"absolute","value":1698452448},"count":37},{"address":{"type":"absolute","value":1698452592},"count":31},{"address":{"type":"absolute","value":1698452688},"count":31},{"address":{"type":"absolute","value":1698452784},"count":36},{"address":{"type":"absolute","value":1698452960},"count":9},{"address":{"type":"absolute","value":1698452992},"count":9},{"address":{"type":"absolute","value":1698453024},"count":20},{"address":{"type":"absolute","value":1698453072},"count":17},{"address":{"type":"absolute","value":1698453136},"count":43},{"address":{"type":"absolute","value":1698453312},"count":21},{"address":{"type":"absolute","value":1698453344},"count":70},{"address":{"type":"absolute","value":1698453792},"count":45},{"address":{"type":"absolute","value":1698453936},"count":87},{"address":{"type":"absolute","value":1698454496},"count":63},{"address":{"type":"absolute","value":1698454672},"count":31},{"address":{"type":"absolute","value":1698454736},"count":290},{"address":{"type":"absolute","value":1698460704},"count":29},{"address":{"type":"absolute","value":1698460768},"count":64},{"address":{"type":"absolute","value":1698461184},"count":52},{"address":{"type":"absolute","value":1698461472},"count":16},{"address":{"type":"absolute","value":1698461504},"count":16},{"address":{"type":"absolute","value":1698461536},"count":21},{"address":{"type":"absolute","value":1698461584},"count":16},{"address":{"type":"absolute","value":1698461616},"count":16},{"address":{"type":"absolute","value":1698461648},"count":63},{"address":{"type":"absolute","value":1698461984},"count":41},{"address":{"type":"absolute","value":1698462112},"count":64},{"address":{"type":"absolute","value":1698462144},"count":64},{"address":{"type":"absolute","value":1698462176},"count":43},{"address":{"type":"absolute","value":1698462192},"count":31},{"address":{"type":"absolute","value":1698462304},"count":41},{"address":{"type":"absolute","value":1698462416},"count":41},{"address":{"type":"absolute","value":1698462624},"count":52},{"address":{"type":"absolute","value":1698462656},"count":28},{"address":{"type":"absolute","value":1698462736},"count":33},{"address":{"type":"absolute","value":1698462832},"count":27},{"address":{"type":"absolute","value":1698462912},"count":23},{"address":{"type":"absolute","value":1698462992},"count":20},{"address":{"type":"absolute","value":1698463024},"count":168},{"address":{"type":"absolute","value":1698464512},"count":86},{"address":{"type":"absolute","value":1698465008},"count":58},{"address":{"type":"absolute","value":1698465264},"count":125},{"address":{"type":"absolute","value":1698466688},"count":20},{"address":{"type":"absolute","value":1698466720},"count":74},{"address":{"type":"absolute","value":1698466992},"count":7},{"address":{"type":"absolute","value":1698467008},"count":30},{"address":{"type":"absolute","value":1698467072},"count":65},{"address":{"type":"absolute","value":1698467408},"count":48},{"address":{"type":"absolute","value":1698467504},"count":8},{"address":{"type":"absolute","value":1698467520},"count":50},{"address":{"type":"absolute","value":1698467616},"count":52},{"address":{"type":"absolute","value":1698467712},"count":49},{"address":{"type":"absolute","value":1698467744},"count":26},{"address":{"type":"absolute","value":1698467824},"count":82},{"address":{"type":"absolute","value":1698468096},"count":35},{"address":{"type":"absolute","value":1698468304},"count":60},{"address":{"type":"absolute","value":1698468496},"count":84},{"address":{"type":"absolute","value":1698469008},"count":31},{"address":{"type":"absolute","value":1698469040},"count":55},{"address":{"type":"absolute","value":1698469184},"count":67},{"address":{"type":"absolute","value":1698469776},"count":33},{"address":{"type":"absolute","value":1698469856},"count":40},{"address":{"type":"absolute","value":1698469984},"count":33},{"address":{"type":"absolute","value":1698470096},"count":23},{"address":{"type":"absolute","value":1698470160},"count":7},{"address":{"type":"absolute","value":1698470176},"count":20},{"address":{"type":"absolute","value":1698470240},"count":24},{"address":{"type":"absolute","value":1698470304},"count":33},{"address":{"type":"absolute","value":1698470448},"count":29},{"address":{"type":"absolute","value":1698470512},"count":74},{"address":{"type":"absolute","value":1698471072},"count":66},{"address":{"type":"absolute","value":1698471344},"count":27},{"address":{"type":"absolute","value":1698471392},"count":21},{"address":{"type":"absolute","value":1698471456},"count":21},{"address":{"type":"absolute","value":1698471520},"count":62},{"address":{"type":"absolute","value":1698472000},"count":10},{"address":{"type":"absolute","value":1698472016},"count":10},{"address":{"type":"absolute","value":1698472048},"count":8},{"address":{"type":"absolute","value":1698472064},"count":18},{"address":{"type":"absolute","value":1698472112},"count":26},{"address":{"type":"absolute","value":1698472176},"count":28},{"address":{"type":"absolute","value":1698472256},"count":12},{"address":{"type":"absolute","value":1698472288},"count":39},{"address":{"type":"absolute","value":1698473280},"count":57},{"address":{"type":"absolute","value":1698474016},"count":30},{"address":{"type":"absolute","value":1698474112},"count":49},{"address":{"type":"absolute","value":1698474336},"count":43},{"address":{"type":"absolute","value":1698474496},"count":72},{"address":{"type":"absolute","value":1698475088},"count":125},{"address":{"type":"absolute","value":1698475616},"count":42},{"address":{"type":"absolute","value":1698475680},"count":74},{"address":{"type":"absolute","value":1698476064},"count":119},{"address":{"type":"absolute","value":1698476416},"count":106},{"address":{"type":"absolute","value":1698476928},"count":51},{"address":{"type":"absolute","value":1698477120},"count":47},{"address":{"type":"absolute","value":1698477472},"count":48},{"address":{"type":"absolute","value":1698477568},"count":36},{"address":{"type":"absolute","value":1698477648},"count":40},{"address":{"type":"absolute","value":1698477728},"count":56},{"address":{"type":"absolute","value":1698477840},"count":132},{"address":{"type":"absolute","value":1698478560},"count":58},{"address":{"type":"absolute","value":1698478848},"count":52},{"address":{"type":"absolute","value":1698479024},"count":36},{"address":{"type":"absolute","value":1698479136},"count":36},{"address":{"type":"absolute","value":1698479248},"count":35},{"address":{"type":"absolute","value":1698479408},"count":22},{"address":{"type":"absolute","value":1698479456},"count":28},{"address":{"type":"absolute","value":1698479536},"count":209},{"address":{"type":"absolute","value":1698480768},"count":37},{"address":{"type":"absolute","value":1698480848},"count":67},{"address":{"type":"absolute","value":1698481024},"count":93},{"address":{"type":"absolute","value":1698482016},"count":327},{"address":{"type":"absolute","value":1698482784},"count":79},{"address":{"type":"absolute","value":1698483136},"count":323},{"address":{"type":"absolute","value":1698483440},"count":37},{"address":{"type":"absolute","value":1698483568},"count":30},{"address":{"type":"absolute","value":1698483648},"count":283},{"address":{"type":"absolute","value":1698483792},"count":228},{"address":{"type":"absolute","value":1698483936},"count":225},{"address":{"type":"absolute","value":1698484080},"count":29},{"address":{"type":"absolute","value":1698485552},"count":48},{"address":{"type":"absolute","value":1698485696},"count":75},{"address":{"type":"absolute","value":1698485952},"count":32},{"address":{"type":"absolute","value":1698486000},"count":26},{"address":{"type":"absolute","value":1698486048},"count":42},{"address":{"type":"absolute","value":1698486144},"count":51},{"address":{"type":"absolute","value":1698486368},"count":121},{"address":{"type":"absolute","value":1698487168},"count":153},{"address":{"type":"absolute","value":1698488592},"count":100},{"address":{"type":"absolute","value":1698489552},"count":100},{"address":{"type":"absolute","value":1698490544},"count":81},{"address":{"type":"absolute","value":1698490800},"count":81},{"address":{"type":"absolute","value":1698491056},"count":104},{"address":{"type":"absolute","value":1698491888},"count":138},{"address":{"type":"absolute","value":1698492736},"count":115},{"address":{"type":"absolute","value":1698493136},"count":130},{"address":{"type":"absolute","value":1698493632},"count":108},{"address":{"type":"absolute","value":1698494208},"count":96},{"address":{"type":"absolute","value":1698494544},"count":145},{"address":{"type":"absolute","value":1698495024},"count":47},{"address":{"type":"absolute","value":1698495136},"count":98},{"address":{"type":"absolute","value":1698495504},"count":98},{"address":{"type":"absolute","value":1698495520},"count":98},{"address":{"type":"absolute","value":1698495536},"count":161},{"address":{"type":"absolute","value":1698495744},"count":62},{"address":{"type":"absolute","value":1698495904},"count":108},{"address":{"type":"absolute","value":1698496368},"count":142},{"address":{"type":"absolute","value":1698497376},"count":43},{"address":{"type":"absolute","value":1698497504},"count":58},{"address":{"type":"absolute","value":1698497680},"count":84},{"address":{"type":"absolute","value":1698497936},"count":71},{"address":{"type":"absolute","value":1698498240},"count":75},{"address":{"type":"absolute","value":1698498752},"count":137},{"address":{"type":"absolute","value":1698499424},"count":65},{"address":{"type":"absolute","value":1698499824},"count":154},{"address":{"type":"absolute","value":1698500224},"count":128},{"address":{"type":"absolute","value":1698500704},"count":95},{"address":{"type":"absolute","value":1698501104},"count":132},{"address":{"type":"absolute","value":1698501536},"count":85},{"address":{"type":"absolute","value":1698501776},"count":137},{"address":{"type":"absolute","value":1698501808},"count":137},{"address":{"type":"absolute","value":1698501824},"count":10},{"address":{"type":"absolute","value":1698501840},"count":11},{"address":{"type":"absolute","value":1698501856},"count":77},{"address":{"type":"absolute","value":1698502768},"count":134},{"address":{"type":"absolute","value":1698503872},"count":40},{"address":{"type":"absolute","value":1698503952},"count":102},{"address":{"type":"absolute","value":1698504240},"count":92},{"address":{"type":"absolute","value":1698504656},"count":73},{"address":{"type":"absolute","value":1698504896},"count":88},{"address":{"type":"absolute","value":1698505216},"count":88},{"address":{"type":"absolute","value":1698505536},"count":92},{"address":{"type":"absolute","value":1698505552},"count":92},{"address":{"type":"absolute","value":1698505568},"count":22},{"address":{"type":"absolute","value":1698505616},"count":109},{"address":{"type":"absolute","value":1698505648},"count":37},{"address":{"type":"absolute","value":1698505696},"count":74},{"address":{"type":"absolute","value":1698505984},"count":127},{"address":{"type":"absolute","value":1698506528},"count":187},{"address":{"type":"absolute","value":1698508336},"count":203},{"address":{"type":"absolute","value":1698509296},"count":134},{"address":{"type":"absolute","value":1698510512},"count":22},{"address":{"type":"absolute","value":1698510560},"count":21},{"address":{"type":"absolute","value":1698510608},"count":79},{"address":{"type":"absolute","value":1698510864},"count":55},{"address":{"type":"absolute","value":1698511040},"count":173},{"address":{"type":"absolute","value":1698512416},"count":36},{"address":{"type":"absolute","value":1698512480},"count":130},{"address":{"type":"absolute","value":1698513520},"count":128},{"address":{"type":"absolute","value":1698514576},"count":148},{"address":{"type":"absolute","value":1698516064},"count":37},{"address":{"type":"absolute","value":1698516192},"count":33},{"address":{"type":"absolute","value":1698516400},"count":24},{"address":{"type":"absolute","value":1698516448},"count":25},{"address":{"type":"absolute","value":1698516496},"count":51},{"address":{"type":"absolute","value":1698516624},"count":37},{"address":{"type":"absolute","value":1698516752},"count":38},{"address":{"type":"absolute","value":1698516880},"count":38},{"address":{"type":"absolute","value":1698517008},"count":32},{"address":{"type":"absolute","value":1698517136},"count":33},{"address":{"type":"absolute","value":1698517248},"count":36},{"address":{"type":"absolute","value":1698517504},"count":29},{"address":{"type":"absolute","value":1698517568},"count":95},{"address":{"type":"absolute","value":1698518256},"count":39},{"address":{"type":"absolute","value":1698518416},"count":45},{"address":{"type":"absolute","value":1698518512},"count":62},{"address":{"type":"absolute","value":1698518688},"count":31},{"address":{"type":"absolute","value":1698519808},"count":94},{"address":{"type":"absolute","value":1698519936},"count":38},{"address":{"type":"absolute","value":1698520032},"count":76},{"address":{"type":"absolute","value":1698520384},"count":25},{"address":{"type":"absolute","value":1698520432},"count":61},{"address":{"type":"absolute","value":1698520624},"count":65},{"address":{"type":"absolute","value":1698521824},"count":41},{"address":{"type":"absolute","value":1698522000},"count":43},{"address":{"type":"absolute","value":1698522176},"count":66},{"address":{"type":"absolute","value":1698522624},"count":113},{"address":{"type":"absolute","value":1698523424},"count":55},{"address":{"type":"absolute","value":1698523520},"count":29},{"address":{"type":"absolute","value":1698523536},"count":131},{"address":{"type":"absolute","value":1698526688},"count":57},{"address":{"type":"absolute","value":1698526960},"count":43},{"address":{"type":"absolute","value":1698527072},"count":68},{"address":{"type":"absolute","value":1698527328},"count":78},{"address":{"type":"absolute","value":1698527648},"count":90},{"address":{"type":"absolute","value":1698527968},"count":61},{"address":{"type":"absolute","value":1698528288},"count":47},{"address":{"type":"absolute","value":1698528432},"count":24},{"address":{"type":"absolute","value":1698528480},"count":50},{"address":{"type":"absolute","value":1698528640},"count":47},{"address":{"type":"absolute","value":1698528992},"count":28},{"address":{"type":"absolute","value":1698529072},"count":32},{"address":{"type":"absolute","value":1698529136},"count":78},{"address":{"type":"absolute","value":1698529152},"count":69},{"address":{"type":"absolute","value":1698529632},"count":57},{"address":{"type":"absolute","value":1698529792},"count":68},{"address":{"type":"absolute","value":1698529808},"count":57},{"address":{"type":"absolute","value":1698529824},"count":27},{"address":{"type":"absolute","value":1698529904},"count":67},{"address":{"type":"absolute","value":1698529936},"count":49},{"address":{"type":"absolute","value":1698529968},"count":47},{"address":{"type":"absolute","value":1698530160},"count":24},{"address":{"type":"absolute","value":1698530224},"count":63},{"address":{"type":"absolute","value":1698530672},"count":141},{"address":{"type":"absolute","value":1698531920},"count":86},{"address":{"type":"absolute","value":1698532496},"count":42},{"address":{"type":"absolute","value":1698532592},"count":30},{"address":{"type":"absolute","value":1698532656},"count":46},{"address":{"type":"absolute","value":1698532768},"count":42},{"address":{"type":"absolute","value":1698532864},"count":18},{"address":{"type":"absolute","value":1698532880},"count":23},{"address":{"type":"absolute","value":1698532944},"count":54},{"address":{"type":"absolute","value":1698533152},"count":76},{"address":{"type":"absolute","value":1698533568},"count":43},{"address":{"type":"absolute","value":1698533664},"count":36},{"address":{"type":"absolute","value":1698533760},"count":29},{"address":{"type":"absolute","value":1698533840},"count":80},{"address":{"type":"absolute","value":1698534208},"count":43},{"address":{"type":"absolute","value":1698534304},"count":16},{"address":{"type":"absolute","value":1698534352},"count":18},{"address":{"type":"absolute","value":1698534400},"count":18},{"address":{"type":"absolute","value":1698534448},"count":27},{"address":{"type":"absolute","value":1698534496},"count":18},{"address":{"type":"absolute","value":1698534544},"count":9},{"address":{"type":"absolute","value":1698534560},"count":33},{"address":{"type":"absolute","value":1698534640},"count":33},{"address":{"type":"absolute","value":1698534720},"count":23},{"address":{"type":"absolute","value":1698534768},"count":55},{"address":{"type":"absolute","value":1698534944},"count":39},{"address":{"type":"absolute","value":1698535056},"count":37},{"address":{"type":"absolute","value":1698535088},"count":44},{"address":{"type":"absolute","value":1698535232},"count":28},{"address":{"type":"absolute","value":1698535344},"count":16},{"address":{"type":"absolute","value":1698535376},"count":16},{"address":{"type":"absolute","value":1698535408},"count":140},{"address":{"type":"absolute","value":1698535424},"count":20},{"address":{"type":"absolute","value":1698535456},"count":45},{"address":{"type":"absolute","value":1698535552},"count":28},{"address":{"type":"absolute","value":1698535600},"count":28},{"address":{"type":"absolute","value":1698535648},"count":57},{"address":{"type":"absolute","value":1698535664},"count":49},{"address":{"type":"absolute","value":1698535696},"count":141},{"address":{"type":"absolute","value":1698535712},"count":33},{"address":{"type":"absolute","value":1698535744},"count":78},{"address":{"type":"absolute","value":1698535760},"count":20},{"address":{"type":"absolute","value":1698535792},"count":54},{"address":{"type":"absolute","value":1698535920},"count":28},{"address":{"type":"absolute","value":1698535968},"count":224},{"address":{"type":"absolute","value":1698535984},"count":227},{"address":{"type":"absolute","value":1698536032},"count":282},{"address":{"type":"absolute","value":1698536048},"count":33},{"address":{"type":"absolute","value":1698536080},"count":322},{"address":{"type":"absolute","value":1698536096},"count":78},{"address":{"type":"absolute","value":1698536112},"count":20},{"address":{"type":"absolute","value":1698536144},"count":50},{"address":{"type":"absolute","value":1698536272},"count":77},{"address":{"type":"absolute","value":1698536496},"count":53},{"address":{"type":"absolute","value":1698536640},"count":31},{"address":{"type":"absolute","value":1698536688},"count":140},{"address":{"type":"absolute","value":1698536832},"count":83},{"address":{"type":"absolute","value":1698537072},"count":92},{"address":{"type":"absolute","value":1698537408},"count":39},{"address":{"type":"absolute","value":1698537456},"count":53},{"address":{"type":"absolute","value":1698537632},"count":82},{"address":{"type":"absolute","value":1698538048},"count":66},{"address":{"type":"absolute","value":1698538256},"count":103},{"address":{"type":"absolute","value":1698538704},"count":42},{"address":{"type":"absolute","value":1698538832},"count":100},{"address":{"type":"absolute","value":1698539648},"count":109},{"address":{"type":"absolute","value":1698540464},"count":46},{"address":{"type":"absolute","value":1698541552},"count":43},{"address":{"type":"absolute","value":1698541872},"count":187},{"address":{"type":"absolute","value":1698543744},"count":88},{"address":{"type":"absolute","value":1698544480},"count":122},{"address":{"type":"absolute","value":1698545520},"count":52},{"address":{"type":"absolute","value":1698545968},"count":30},{"address":{"type":"absolute","value":1698546096},"count":39},{"address":{"type":"absolute","value":1698546224},"count":249},{"address":{"type":"absolute","value":1698551952},"count":7},{"address":{"type":"absolute","value":1698551968},"count":7},{"address":{"type":"absolute","value":1698551984},"count":32},{"address":{"type":"absolute","value":1698552080},"count":29},{"address":{"type":"absolute","value":1698552176},"count":47},{"address":{"type":"absolute","value":1698552304},"count":71},{"address":{"type":"absolute","value":1698552640},"count":44},{"address":{"type":"absolute","value":1698552736},"count":48},{"address":{"type":"absolute","value":1698552848},"count":68},{"address":{"type":"absolute","value":1698553440},"count":37},{"address":{"type":"absolute","value":1698553520},"count":60},{"address":{"type":"absolute","value":1698554240},"count":163},{"address":{"type":"absolute","value":1698555792},"count":196},{"address":{"type":"absolute","value":1698557600},"count":60},{"address":{"type":"absolute","value":1698558112},"count":68},{"address":{"type":"absolute","value":1698558576},"count":48},{"address":{"type":"absolute","value":1698558800},"count":61},{"address":{"type":"absolute","value":1698558944},"count":55},{"address":{"type":"absolute","value":1698559344},"count":107},{"address":{"type":"absolute","value":1698561040},"count":55},{"address":{"type":"absolute","value":1698561168},"count":49},{"address":{"type":"absolute","value":1698561408},"count":109},{"address":{"type":"absolute","value":1698562080},"count":70},{"address":{"type":"absolute","value":1698562512},"count":100},{"address":{"type":"absolute","value":1698563024},"count":88},{"address":{"type":"absolute","value":1698563392},"count":106},{"address":{"type":"absolute","value":1698564176},"count":96},{"address":{"type":"absolute","value":1698564960},"count":143},{"address":{"type":"absolute","value":1698565856},"count":127},{"address":{"type":"absolute","value":1698566736},"count":12},{"address":{"type":"absolute","value":1698566768},"count":95},{"address":{"type":"absolute","value":1698567296},"count":41},{"address":{"type":"absolute","value":1698567488},"count":15},{"address":{"type":"absolute","value":1698567520},"count":15},{"address":{"type":"absolute","value":1698567552},"count":96},{"address":{"type":"absolute","value":1698567872},"count":102},{"address":{"type":"absolute","value":1698568224},"count":83},{"address":{"type":"absolute","value":1698568512},"count":212},{"address":{"type":"absolute","value":1698571360},"count":184},{"address":{"type":"absolute","value":1698571376},"count":41},{"address":{"type":"absolute","value":1698572296},"count":18},{"address":{"type":"absolute","value":1698572336},"count":17},{"address":{"type":"absolute","value":1698572368},"count":46},{"address":{"type":"absolute","value":1698573344},"count":42},{"address":{"type":"absolute","value":1698576792},"count":44},{"address":{"type":"absolute","value":1698580304},"count":30},{"address":{"type":"absolute","value":1698580416},"count":25},{"address":{"type":"absolute","value":1698580504},"count":29},{"address":{"type":"absolute","value":1698580624},"count":15},{"address":{"type":"absolute","value":1698580656},"count":15},{"address":{"type":"absolute","value":1698580688},"count":69},{"address":{"type":"absolute","value":1698582416},"count":112},{"address":{"type":"absolute","value":1698583136},"count":110},{"address":{"type":"absolute","value":1698583152},"count":96},{"address":{"type":"absolute","value":1698583472},"count":102},{"address":{"type":"absolute","value":1698583824},"count":83},{"address":{"type":"absolute","value":1698584112},"count":75},{"address":{"type":"absolute","value":1698585168},"count":75},{"address":{"type":"absolute","value":1698586232},"count":71},{"address":{"type":"absolute","value":1698590136},"count":71},{"address":{"type":"absolute","value":1698594056},"count":45},{"address":{"type":"absolute","value":1698594152},"count":25},{"address":{"type":"absolute","value":1698594232},"count":26},{"address":{"type":"absolute","value":1698594336},"count":53},{"address":{"type":"absolute","value":1698594512},"count":18},{"address":{"type":"absolute","value":1698594544},"count":15},{"address":{"type":"absolute","value":1698594576},"count":19},{"address":{"type":"absolute","value":1698594624},"count":182},{"address":{"type":"absolute","value":1698595696},"count":139},{"address":{"type":"absolute","value":1698598064},"count":17},{"address":{"type":"absolute","value":1698598112},"count":16},{"address":{"type":"absolute","value":1698598144},"count":81},{"address":{"type":"absolute","value":1698598432},"count":162},{"address":{"type":"absolute","value":1698599616},"count":61},{"address":{"type":"absolute","value":1698599792},"count":41},{"address":{"type":"absolute","value":1698599952},"count":42},{"address":{"type":"absolute","value":1698599984},"count":39},{"address":{"type":"absolute","value":1698600080},"count":84},{"address":{"type":"absolute","value":1698600352},"count":83},{"address":{"type":"absolute","value":1698600624},"count":29},{"address":{"type":"absolute","value":1698600720},"count":63},{"address":{"type":"absolute","value":1698600928},"count":170},{"address":{"type":"absolute","value":1698606696},"count":162},{"address":{"type":"absolute","value":1698622528},"count":33},{"address":{"type":"absolute","value":1698622672},"count":49},{"address":{"type":"absolute","value":1698622824},"count":32},{"address":{"type":"absolute","value":1698627072},"count":46},{"address":{"type":"absolute","value":1698627168},"count":49},{"address":{"type":"absolute","value":1698627184},"count":49},{"address":{"type":"absolute","value":1698627200},"count":16},{"address":{"type":"absolute","value":1698627248},"count":21},{"address":{"type":"absolute","value":1698627312},"count":20},{"address":{"type":"absolute","value":1698627360},"count":213},{"address":{"type":"absolute","value":1698628080},"count":29},{"address":{"type":"absolute","value":1698628160},"count":82},{"address":{"type":"absolute","value":1698628896},"count":223},{"address":{"type":"absolute","value":1698630528},"count":222},{"address":{"type":"absolute","value":1698630544},"count":46},{"address":{"type":"absolute","value":1698630784},"count":46},{"address":{"type":"absolute","value":1698631024},"count":46},{"address":{"type":"absolute","value":1698631264},"count":52},{"address":{"type":"absolute","value":1698631536},"count":77},{"address":{"type":"absolute","value":1698631904},"count":149},{"address":{"type":"absolute","value":1698632160},"count":76},{"address":{"type":"absolute","value":1698632464},"count":118},{"address":{"type":"absolute","value":1698632720},"count":118},{"address":{"type":"absolute","value":1698633024},"count":107},{"address":{"type":"absolute","value":1698633696},"count":93},{"address":{"type":"absolute","value":1698634064},"count":171},{"address":{"type":"absolute","value":1698638088},"count":171},{"address":{"type":"absolute","value":1698642096},"count":21},{"address":{"type":"absolute","value":1698642128},"count":78},{"address":{"type":"absolute","value":1698642496},"count":82},{"address":{"type":"absolute","value":1698642784},"count":57},{"address":{"type":"absolute","value":1698643008},"count":69},{"address":{"type":"absolute","value":1698643312},"count":74},{"address":{"type":"absolute","value":1698643616},"count":78},{"address":{"type":"absolute","value":1698643968},"count":61},{"address":{"type":"absolute","value":1698644208},"count":70},{"address":{"type":"absolute","value":1698644512},"count":71},{"address":{"type":"absolute","value":1698644832},"count":87},{"address":{"type":"absolute","value":1698645456},"count":85},{"address":{"type":"absolute","value":1698645824},"count":23},{"address":{"type":"absolute","value":1698645891},"count":25},{"address":{"type":"absolute","value":1698645968},"count":47},{"address":{"type":"absolute","value":1698646304},"count":59},{"address":{"type":"absolute","value":1698646688},"count":90},{"address":{"type":"absolute","value":1698646946},"count":18},{"address":{"type":"absolute","value":1698647044},"count":32},{"address":{"type":"absolute","value":1698647077},"count":24},{"address":{"type":"absolute","value":1698647242},"count":19},{"address":{"type":"absolute","value":1698647287},"count":44},{"address":{"type":"absolute","value":1698648336},"count":21},{"address":{"type":"absolute","value":1698648368},"count":96},{"address":{"type":"absolute","value":1698650400},"count":96},{"address":{"type":"absolute","value":1698650768},"count":54},{"address":{"type":"absolute","value":1698650976},"count":67},{"address":{"type":"absolute","value":1698651248},"count":71},{"address":{"type":"absolute","value":1698651568},"count":135},{"address":{"type":"absolute","value":1698652656},"count":59},{"address":{"type":"absolute","value":1698652880},"count":106},{"address":{"type":"absolute","value":1698653760},"count":107},{"address":{"type":"absolute","value":1698654656},"count":112},{"address":{"type":"absolute","value":1698657376},"count":118},{"address":{"type":"absolute","value":1698658656},"count":37},{"address":{"type":"absolute","value":1698658768},"count":41},{"address":{"type":"absolute","value":1698658880},"count":15},{"address":{"type":"absolute","value":1698658912},"count":15},{"address":{"type":"absolute","value":1698658944},"count":70},{"address":{"type":"absolute","value":1698659472},"count":312},{"address":{"type":"absolute","value":1698663648},"count":115},{"address":{"type":"absolute","value":1698664208},"count":128},{"address":{"type":"absolute","value":1698664832},"count":105},{"address":{"type":"absolute","value":1698665328},"count":187},{"address":{"type":"absolute","value":1698666288},"count":180},{"address":{"type":"absolute","value":1698667136},"count":124},{"address":{"type":"absolute","value":1698669272},"count":124},{"address":{"type":"absolute","value":1698671408},"count":107},{"address":{"type":"absolute","value":1698678216},"count":107},{"address":{"type":"absolute","value":1698685088},"count":58},{"address":{"type":"absolute","value":1698685312},"count":44},{"address":{"type":"absolute","value":1698685504},"count":41},{"address":{"type":"absolute","value":1698685688},"count":38},{"address":{"type":"absolute","value":1698685952},"count":40},{"address":{"type":"absolute","value":1698686232},"count":38},{"address":{"type":"absolute","value":1698686432},"count":50},{"address":{"type":"absolute","value":1698694232},"count":51},{"address":{"type":"absolute","value":1698702032},"count":39},{"address":{"type":"absolute","value":1698702624},"count":25},{"address":{"type":"absolute","value":1698702808},"count":32},{"address":{"type":"absolute","value":1698702992},"count":72},{"address":{"type":"absolute","value":1698703568},"count":70},{"address":{"type":"absolute","value":1698704144},"count":63},{"address":{"type":"absolute","value":1698704576},"count":305},{"address":{"type":"absolute","value":1698709200},"count":303},{"address":{"type":"absolute","value":1698713936},"count":15},{"address":{"type":"absolute","value":1698713968},"count":15},{"address":{"type":"absolute","value":1698714000},"count":602},{"address":{"type":"absolute","value":1698719792},"count":77},{"address":{"type":"absolute","value":1698720320},"count":32},{"address":{"type":"absolute","value":1698720448},"count":130},{"address":{"type":"absolute","value":1698721072},"count":130},{"address":{"type":"absolute","value":1698721712},"count":119},{"address":{"type":"absolute","value":1698722288},"count":198},{"address":{"type":"absolute","value":1698723440},"count":187},{"address":{"type":"absolute","value":1698724464},"count":311},{"address":{"type":"absolute","value":1698745032},"count":311},{"address":{"type":"absolute","value":1698765496},"count":74},{"address":{"type":"absolute","value":1698766232},"count":35},{"address":{"type":"absolute","value":1698766480},"count":35},{"address":{"type":"absolute","value":1698766728},"count":52},{"address":{"type":"absolute","value":1698767272},"count":52},{"address":{"type":"absolute","value":1698767816},"count":46},{"address":{"type":"absolute","value":1698768192},"count":308},{"address":{"type":"absolute","value":1698784880},"count":308},{"address":{"type":"absolute","value":1698801576},"count":63},{"address":{"type":"absolute","value":1698802232},"count":55},{"address":{"type":"absolute","value":1698802424},"count":55},{"address":{"type":"absolute","value":1698802608},"count":82},{"address":{"type":"absolute","value":1698803168},"count":82},{"address":{"type":"absolute","value":1698803728},"count":68},{"address":{"type":"absolute","value":1698804144},"count":69},{"address":{"type":"absolute","value":1698804480},"count":15},{"address":{"type":"absolute","value":1698804512},"count":68},{"address":{"type":"absolute","value":1698804816},"count":15},{"address":{"type":"absolute","value":1698804848},"count":98},{"address":{"type":"absolute","value":1698805664},"count":96},{"address":{"type":"absolute","value":1698805680},"count":100},{"address":{"type":"absolute","value":1698808128},"count":15},{"address":{"type":"absolute","value":1698808160},"count":100},{"address":{"type":"absolute","value":1698810608},"count":15},{"address":{"type":"absolute","value":1698810640},"count":88},{"address":{"type":"absolute","value":1698811216},"count":224},{"address":{"type":"absolute","value":1698813712},"count":283},{"address":{"type":"absolute","value":1698817280},"count":30},{"address":{"type":"absolute","value":1698817344},"count":141},{"address":{"type":"absolute","value":1698819552},"count":141},{"address":{"type":"absolute","value":1698821760},"count":173},{"address":{"type":"absolute","value":1698824720},"count":173},{"address":{"type":"absolute","value":1698827680},"count":302},{"address":{"type":"absolute","value":1698827760},"count":55},{"address":{"type":"absolute","value":1698827952},"count":55},{"address":{"type":"absolute","value":1698828144},"count":17},{"address":{"type":"absolute","value":1698828192},"count":17},{"address":{"type":"absolute","value":1698828240},"count":74},{"address":{"type":"absolute","value":1698828912},"count":95},{"address":{"type":"absolute","value":1698829312},"count":153},{"address":{"type":"absolute","value":1698829936},"count":158},{"address":{"type":"absolute","value":1698830592},"count":147},{"address":{"type":"absolute","value":1698831184},"count":224},{"address":{"type":"absolute","value":1698832432},"count":205},{"address":{"type":"absolute","value":1698833800},"count":154},{"address":{"type":"absolute","value":1698858208},"count":148},{"address":{"type":"absolute","value":1698882600},"count":81},{"address":{"type":"absolute","value":1698883416},"count":90},{"address":{"type":"absolute","value":1698883824},"count":73},{"address":{"type":"absolute","value":1698884192},"count":115},{"address":{"type":"absolute","value":1698885112},"count":125},{"address":{"type":"absolute","value":1698886056},"count":87},{"address":{"type":"absolute","value":1698892616},"count":196},{"address":{"type":"absolute","value":1698892936},"count":165},{"address":{"type":"absolute","value":1698921616},"count":157},{"address":{"type":"absolute","value":1698950280},"count":101},{"address":{"type":"absolute","value":1698951696},"count":123},{"address":{"type":"absolute","value":1698952160},"count":107},{"address":{"type":"absolute","value":1698952576},"count":152},{"address":{"type":"absolute","value":1698953856},"count":164},{"address":{"type":"absolute","value":1698955192},"count":126},{"address":{"type":"absolute","value":1698956128},"count":27},{"address":{"type":"absolute","value":1698956256},"count":77},{"address":{"type":"absolute","value":1698956832},"count":15},{"address":{"type":"absolute","value":1698956864},"count":108},{"address":{"type":"absolute","value":1698957264},"count":33},{"address":{"type":"absolute","value":1698957344},"count":106},{"address":{"type":"absolute","value":1698957856},"count":17},{"address":{"type":"absolute","value":1698957888},"count":41},{"address":{"type":"absolute","value":1698958000},"count":64},{"address":{"type":"absolute","value":1698958240},"count":47},{"address":{"type":"absolute","value":1698958400},"count":49},{"address":{"type":"absolute","value":1698958576},"count":117},{"address":{"type":"absolute","value":1698959280},"count":20},{"address":{"type":"absolute","value":1698959328},"count":20},{"address":{"type":"absolute","value":1698959376},"count":73},{"address":{"type":"absolute","value":1698959904},"count":52},{"address":{"type":"absolute","value":1698960128},"count":60},{"address":{"type":"absolute","value":1698960304},"count":21},{"address":{"type":"absolute","value":1698960344},"count":299},{"address":{"type":"absolute","value":1698964368},"count":31},{"address":{"type":"absolute","value":1698964432},"count":40},{"address":{"type":"absolute","value":1698965072},"count":36},{"address":{"type":"absolute","value":1698965152},"count":41},{"address":{"type":"absolute","value":1698965792},"count":36},{"address":{"type":"absolute","value":1698965856},"count":55},{"address":{"type":"absolute","value":1698965984},"count":37},{"address":{"type":"absolute","value":1698966080},"count":59},{"address":{"type":"absolute","value":1698966320},"count":116},{"address":{"type":"absolute","value":1698967040},"count":115},{"address":{"type":"absolute","value":1698967072},"count":74},{"address":{"type":"absolute","value":1698967808},"count":87},{"address":{"type":"absolute","value":1698968192},"count":214},{"address":{"type":"absolute","value":1698971584},"count":208},{"address":{"type":"absolute","value":1698979904},"count":150},{"address":{"type":"absolute","value":1698980856},"count":129},{"address":{"type":"absolute","value":1698981432},"count":233},{"address":{"type":"absolute","value":1698984576},"count":184},{"address":{"type":"absolute","value":1698988256},"count":89},{"address":{"type":"absolute","value":1698989376},"count":25},{"address":{"type":"absolute","value":1698989488},"count":71},{"address":{"type":"absolute","value":1698989792},"count":87},{"address":{"type":"absolute","value":1698990304},"count":89},{"address":{"type":"absolute","value":1698991040},"count":66},{"address":{"type":"absolute","value":1698991600},"count":76},{"address":{"type":"absolute","value":1698992320},"count":50},{"address":{"type":"absolute","value":1698992576},"count":317},{"address":{"type":"absolute","value":1698998080},"count":7},{"address":{"type":"absolute","value":1698998096},"count":27},{"address":{"type":"absolute","value":1698998224},"count":72},{"address":{"type":"absolute","value":1698998704},"count":88},{"address":{"type":"absolute","value":1698999664},"count":25},{"address":{"type":"absolute","value":1698999776},"count":79},{"address":{"type":"absolute","value":1699000112},"count":20},{"address":{"type":"absolute","value":1699000208},"count":286},{"address":{"type":"absolute","value":1699000320},"count":75},{"address":{"type":"absolute","value":1699001248},"count":78},{"address":{"type":"absolute","value":1699001888},"count":301},{"address":{"type":"absolute","value":1699002512},"count":46},{"address":{"type":"absolute","value":1699002736},"count":126},{"address":{"type":"absolute","value":1699003744},"count":123},{"address":{"type":"absolute","value":1699004880},"count":39},{"address":{"type":"absolute","value":1699005232},"count":32},{"address":{"type":"absolute","value":1699005360},"count":36},{"address":{"type":"absolute","value":1699005488},"count":285},{"address":{"type":"absolute","value":1699011472},"count":25},{"address":{"type":"absolute","value":1699011584},"count":64},{"address":{"type":"absolute","value":1699011856},"count":84},{"address":{"type":"absolute","value":1699012656},"count":49},{"address":{"type":"absolute","value":1699012880},"count":76},{"address":{"type":"absolute","value":1699013552},"count":44},{"address":{"type":"absolute","value":1699013664},"count":67},{"address":{"type":"absolute","value":1699014208},"count":56},{"address":{"type":"absolute","value":1699014448},"count":79},{"address":{"type":"absolute","value":1699015168},"count":48},{"address":{"type":"absolute","value":1699015424},"count":116},{"address":{"type":"absolute","value":1699016448},"count":74},{"address":{"type":"absolute","value":1699016976},"count":182},{"address":{"type":"absolute","value":1699019424},"count":7},{"address":{"type":"absolute","value":1699019440},"count":32},{"address":{"type":"absolute","value":1699019664},"count":191},{"address":{"type":"absolute","value":1699021664},"count":155},{"address":{"type":"absolute","value":1699023184},"count":179},{"address":{"type":"absolute","value":1699025232},"count":181},{"address":{"type":"absolute","value":1699027680},"count":181},{"address":{"type":"absolute","value":1699029984},"count":90},{"address":{"type":"absolute","value":1699031104},"count":24},{"address":{"type":"absolute","value":1699031152},"count":178},{"address":{"type":"absolute","value":1699032416},"count":180},{"address":{"type":"absolute","value":1699034832},"count":229},{"address":{"type":"absolute","value":1699037456},"count":5},{"address":{"type":"absolute","value":1699037472},"count":82},{"address":{"type":"absolute","value":1699038096},"count":28},{"address":{"type":"absolute","value":1699038176},"count":35},{"address":{"type":"absolute","value":1699038272},"count":64},{"address":{"type":"absolute","value":1699038944},"count":25},{"address":{"type":"absolute","value":1699039024},"count":52},{"address":{"type":"absolute","value":1699039232},"count":106},{"address":{"type":"absolute","value":1699039920},"count":88},{"address":{"type":"absolute","value":1699040544},"count":128},{"address":{"type":"absolute","value":1699041504},"count":98},{"address":{"type":"absolute","value":1699043008},"count":89},{"address":{"type":"absolute","value":1699043568},"count":84},{"address":{"type":"absolute","value":1699044464},"count":45},{"address":{"type":"absolute","value":1699044608},"count":81},{"address":{"type":"absolute","value":1699045216},"count":39},{"address":{"type":"absolute","value":1699045360},"count":36},{"address":{"type":"absolute","value":1699045472},"count":56},{"address":{"type":"absolute","value":1699045696},"count":24},{"address":{"type":"absolute","value":1699045744},"count":19},{"address":{"type":"absolute","value":1699045792},"count":59},{"address":{"type":"absolute","value":1699046160},"count":19},{"address":{"type":"absolute","value":1699046272},"count":71},{"address":{"type":"absolute","value":1699046768},"count":58},{"address":{"type":"absolute","value":1699047088},"count":76},{"address":{"type":"absolute","value":1699047488},"count":129},{"address":{"type":"absolute","value":1699048640},"count":78},{"address":{"type":"absolute","value":1699049408},"count":45},{"address":{"type":"absolute","value":1699049568},"count":28},{"address":{"type":"absolute","value":1699049648},"count":44},{"address":{"type":"absolute","value":1699050320},"count":46},{"address":{"type":"absolute","value":1699050576},"count":84},{"address":{"type":"absolute","value":1699050944},"count":48},{"address":{"type":"absolute","value":1699050976},"count":112},{"address":{"type":"absolute","value":1699051824},"count":108},{"address":{"type":"absolute","value":1699052240},"count":119},{"address":{"type":"absolute","value":1699052912},"count":177},{"address":{"type":"absolute","value":1699054608},"count":167},{"address":{"type":"absolute","value":1699055984},"count":105},{"address":{"type":"absolute","value":1699056848},"count":86},{"address":{"type":"absolute","value":1699057792},"count":15},{"address":{"type":"absolute","value":1699057808},"count":14},{"address":{"type":"absolute","value":1699057824},"count":11},{"address":{"type":"absolute","value":1699057840},"count":34},{"address":{"type":"absolute","value":1699057904},"count":33},{"address":{"type":"absolute","value":1699057968},"count":33},{"address":{"type":"absolute","value":1699058032},"count":173},{"address":{"type":"absolute","value":1699058496},"count":170},{"address":{"type":"absolute","value":1699058960},"count":148},{"address":{"type":"absolute","value":1699060064},"count":150},{"address":{"type":"absolute","value":1699061328},"count":10},{"address":{"type":"absolute","value":1699061344},"count":49},{"address":{"type":"absolute","value":1699061552},"count":17},{"address":{"type":"absolute","value":1699061584},"count":221},{"address":{"type":"absolute","value":1699063456},"count":101},{"address":{"type":"absolute","value":1699063920},"count":54},{"address":{"type":"absolute","value":1699064080},"count":67},{"address":{"type":"absolute","value":1699065232},"count":126},{"address":{"type":"absolute","value":1699065760},"count":27},{"address":{"type":"absolute","value":1699065856},"count":45},{"address":{"type":"absolute","value":1699065936},"count":63},{"address":{"type":"absolute","value":1699066096},"count":143},{"address":{"type":"absolute","value":1699067104},"count":30},{"address":{"type":"absolute","value":1699067200},"count":101},{"address":{"type":"absolute","value":1699068688},"count":23},{"address":{"type":"absolute","value":1699068736},"count":6},{"address":{"type":"absolute","value":1699068752},"count":89},{"address":{"type":"absolute","value":1699069072},"count":30},{"address":{"type":"absolute","value":1699069168},"count":241},{"address":{"type":"absolute","value":1699071328},"count":23},{"address":{"type":"absolute","value":1699071376},"count":6},{"address":{"type":"absolute","value":1699071392},"count":89},{"address":{"type":"absolute","value":1699071712},"count":34},{"address":{"type":"absolute","value":1699071824},"count":126},{"address":{"type":"absolute","value":1699077520},"count":23},{"address":{"type":"absolute","value":1699077568},"count":6},{"address":{"type":"absolute","value":1699077584},"count":92},{"address":{"type":"absolute","value":1699077920},"count":54},{"address":{"type":"absolute","value":1699078096},"count":6},{"address":{"type":"absolute","value":1699078112},"count":74},{"address":{"type":"absolute","value":1699078336},"count":73},{"address":{"type":"absolute","value":1699078560},"count":56},{"address":{"type":"absolute","value":1699079040},"count":346},{"address":{"type":"absolute","value":1699090400},"count":111},{"address":{"type":"absolute","value":1699090800},"count":28},{"address":{"type":"absolute","value":1699090896},"count":46},{"address":{"type":"absolute","value":1699091024},"count":120},{"address":{"type":"absolute","value":1699094768},"count":125},{"address":{"type":"absolute","value":1699098368},"count":183},{"address":{"type":"absolute","value":1699103424},"count":6},{"address":{"type":"absolute","value":1699103440},"count":90},{"address":{"type":"absolute","value":1699103728},"count":89},{"address":{"type":"absolute","value":1699104016},"count":61},{"address":{"type":"absolute","value":1699104512},"count":329},{"address":{"type":"absolute","value":1699111328},"count":120},{"address":{"type":"absolute","value":1699111760},"count":34},{"address":{"type":"absolute","value":1699111872},"count":50},{"address":{"type":"absolute","value":1699112016},"count":322},{"address":{"type":"absolute","value":1699126160},"count":363},{"address":{"type":"absolute","value":1699140352},"count":152},{"address":{"type":"absolute","value":1699144704},"count":34},{"address":{"type":"absolute","value":1699144784},"count":157},{"address":{"type":"absolute","value":1699147264},"count":56},{"address":{"type":"absolute","value":1699148608},"count":170},{"address":{"type":"absolute","value":1699151120},"count":56},{"address":{"type":"absolute","value":1699152464},"count":170},{"address":{"type":"absolute","value":1699154816},"count":56},{"address":{"type":"absolute","value":1699156160},"count":6},{"address":{"type":"absolute","value":1699156176},"count":67},{"address":{"type":"absolute","value":1699156672},"count":72},{"address":{"type":"absolute","value":1699156960},"count":75},{"address":{"type":"absolute","value":1699157456},"count":87},{"address":{"type":"absolute","value":1699158304},"count":79},{"address":{"type":"absolute","value":1699158720},"count":80},{"address":{"type":"absolute","value":1699158736},"count":80},{"address":{"type":"absolute","value":1699158752},"count":80},{"address":{"type":"absolute","value":1699158768},"count":80},{"address":{"type":"absolute","value":1699158784},"count":80},{"address":{"type":"absolute","value":1699158800},"count":80},{"address":{"type":"absolute","value":1699158816},"count":36},{"address":{"type":"absolute","value":1699158935},"count":107},{"address":{"type":"absolute","value":1699162629},"count":6},{"address":{"type":"absolute","value":1699162633},"count":103},{"address":{"type":"absolute","value":1699163060},"count":39},{"address":{"type":"absolute","value":1699163179},"count":38},{"address":{"type":"absolute","value":1699163312},"count":6},{"address":{"type":"absolute","value":1699163328},"count":55},{"address":{"type":"absolute","value":1699163504},"count":122},{"address":{"type":"absolute","value":1699164256},"count":130},{"address":{"type":"absolute","value":1699164368},"count":99},{"address":{"type":"absolute","value":1699164960},"count":61},{"address":{"type":"absolute","value":1699165136},"count":94},{"address":{"type":"absolute","value":1699167664},"count":167},{"address":{"type":"absolute","value":1699173744},"count":175},{"address":{"type":"absolute","value":1699178336},"count":106},{"address":{"type":"absolute","value":1699178864},"count":97},{"address":{"type":"absolute","value":1699179392},"count":48},{"address":{"type":"absolute","value":1699179712},"count":34},{"address":{"type":"absolute","value":1699179776},"count":33},{"address":{"type":"absolute","value":1699179840},"count":67},{"address":{"type":"absolute","value":1699180048},"count":67},{"address":{"type":"absolute","value":1699180256},"count":67},{"address":{"type":"absolute","value":1699180464},"count":65},{"address":{"type":"absolute","value":1699180672},"count":80},{"address":{"type":"absolute","value":1699180912},"count":80},{"address":{"type":"absolute","value":1699181152},"count":78},{"address":{"type":"absolute","value":1699181392},"count":80},{"address":{"type":"absolute","value":1699181632},"count":167},{"address":{"type":"absolute","value":1699183344},"count":183},{"address":{"type":"absolute","value":1699185280},"count":36},{"address":{"type":"absolute","value":1699187504},"count":6},{"address":{"type":"absolute","value":1699187520},"count":70},{"address":{"type":"absolute","value":1699187712},"count":57},{"address":{"type":"absolute","value":1699187984},"count":178},{"address":{"type":"absolute","value":1699193120},"count":101},{"address":{"type":"absolute","value":1699193488},"count":72},{"address":{"type":"absolute","value":1699193504},"count":39},{"address":{"type":"absolute","value":1699193584},"count":28},{"address":{"type":"absolute","value":1699193680},"count":46},{"address":{"type":"absolute","value":1699193888},"count":114},{"address":{"type":"absolute","value":1699198016},"count":115},{"address":{"type":"absolute","value":1699202000},"count":116},{"address":{"type":"absolute","value":1699206160},"count":177},{"address":{"type":"absolute","value":1699207280},"count":163},{"address":{"type":"absolute","value":1699208304},"count":161},{"address":{"type":"absolute","value":1699208432},"count":7},{"address":{"type":"absolute","value":1699208448},"count":18},{"address":{"type":"absolute","value":1699208496},"count":74},{"address":{"type":"absolute","value":1699208848},"count":23},{"address":{"type":"absolute","value":1699208928},"count":45},{"address":{"type":"absolute","value":1699209024},"count":27},{"address":{"type":"absolute","value":1699209104},"count":34},{"address":{"type":"absolute","value":1699209184},"count":25},{"address":{"type":"absolute","value":1699209232},"count":18},{"address":{"type":"absolute","value":1699209264},"count":18},{"address":{"type":"absolute","value":1699209296},"count":18},{"address":{"type":"absolute","value":1699209344},"count":19},{"address":{"type":"absolute","value":1699209392},"count":19},{"address":{"type":"absolute","value":1699209440},"count":22},{"address":{"type":"absolute","value":1699209536},"count":16},{"address":{"type":"absolute","value":1699209584},"count":16},{"address":{"type":"absolute","value":1699209632},"count":161},{"address":{"type":"absolute","value":1699209648},"count":35},{"address":{"type":"absolute","value":1699209712},"count":88},{"address":{"type":"absolute","value":1699209776},"count":34},{"address":{"type":"absolute","value":1699209840},"count":101},{"address":{"type":"absolute","value":1699210384},"count":92},{"address":{"type":"absolute","value":1699210432},"count":23},{"address":{"type":"absolute","value":1699210496},"count":22},{"address":{"type":"absolute","value":1699210576},"count":23},{"address":{"type":"absolute","value":1699210640},"count":36},{"address":{"type":"absolute","value":1699210832},"count":88},{"address":{"type":"absolute","value":1699211312},"count":54},{"address":{"type":"absolute","value":1699211584},"count":88},{"address":{"type":"absolute","value":1699212384},"count":52},{"address":{"type":"absolute","value":1699212656},"count":36},{"address":{"type":"absolute","value":1699212704},"count":25},{"address":{"type":"absolute","value":1699212736},"count":41},{"address":{"type":"absolute","value":1699212896},"count":9},{"address":{"type":"absolute","value":1699212912},"count":9},{"address":{"type":"absolute","value":1699212928},"count":6},{"address":{"type":"absolute","value":1699212944},"count":7},{"address":{"type":"absolute","value":1699212992},"count":52},{"address":{"type":"absolute","value":1699213184},"count":118},{"address":{"type":"absolute","value":1699214352},"count":28},{"address":{"type":"absolute","value":1699214416},"count":88},{"address":{"type":"absolute","value":1699214864},"count":33},{"address":{"type":"absolute","value":1699214928},"count":41},{"address":{"type":"absolute","value":1699215056},"count":45},{"address":{"type":"absolute","value":1699215168},"count":28},{"address":{"type":"absolute","value":1699215248},"count":87},{"address":{"type":"absolute","value":1699215296},"count":67},{"address":{"type":"absolute","value":1699215312},"count":29},{"address":{"type":"absolute","value":1699215360},"count":32},{"address":{"type":"absolute","value":1699215424},"count":136},{"address":{"type":"absolute","value":1699215904},"count":48},{"address":{"type":"absolute","value":1699216080},"count":38},{"address":{"type":"absolute","value":1699216240},"count":53},{"address":{"type":"absolute","value":1699216464},"count":53},{"address":{"type":"absolute","value":1699216560},"count":93},{"address":{"type":"absolute","value":1699217632},"count":58},{"address":{"type":"absolute","value":1699217840},"count":57},{"address":{"type":"absolute","value":1699218464},"count":76},{"address":{"type":"absolute","value":1699218976},"count":60},{"address":{"type":"absolute","value":1699219296},"count":91},{"address":{"type":"absolute","value":1699219744},"count":75},{"address":{"type":"absolute","value":1699220112},"count":71},{"address":{"type":"absolute","value":1699220480},"count":56},{"address":{"type":"absolute","value":1699220640},"count":63},{"address":{"type":"absolute","value":1699220784},"count":35},{"address":{"type":"absolute","value":1699220928},"count":158},{"address":{"type":"absolute","value":1699223280},"count":161},{"address":{"type":"absolute","value":1699223488},"count":33},{"address":{"type":"absolute","value":1699223600},"count":35},{"address":{"type":"absolute","value":1699223648},"count":52},{"address":{"type":"absolute","value":1699223888},"count":6},{"address":{"type":"absolute","value":1699223904},"count":6},{"address":{"type":"absolute","value":1699223920},"count":7},{"address":{"type":"absolute","value":1699223936},"count":41},{"address":{"type":"absolute","value":1699224128},"count":58},{"address":{"type":"absolute","value":1699224576},"count":105},{"address":{"type":"absolute","value":1699225200},"count":27},{"address":{"type":"absolute","value":1699225296},"count":90},{"address":{"type":"absolute","value":1699225904},"count":23},{"address":{"type":"absolute","value":1699225968},"count":23},{"address":{"type":"absolute","value":1699226032},"count":38},{"address":{"type":"absolute","value":1699226224},"count":13},{"address":{"type":"absolute","value":1699226256},"count":25},{"address":{"type":"absolute","value":1699226288},"count":5},{"address":{"type":"absolute","value":1699226304},"count":6},{"address":{"type":"absolute","value":1699226320},"count":6},{"address":{"type":"absolute","value":1699226336},"count":52},{"address":{"type":"absolute","value":1699226544},"count":17},{"address":{"type":"absolute","value":1699226598},"count":23},{"address":{"type":"absolute","value":1699226648},"count":50},{"address":{"type":"absolute","value":1699226814},"count":16},{"address":{"type":"absolute","value":1699226833},"count":22},{"address":{"type":"absolute","value":1699226871},"count":42},{"address":{"type":"absolute","value":1699227064},"count":61},{"address":{"type":"absolute","value":1699227374},"count":59},{"address":{"type":"absolute","value":1699227629},"count":33},{"address":{"type":"absolute","value":1699227746},"count":35},{"address":{"type":"absolute","value":1699227920},"count":51},{"address":{"type":"absolute","value":1699228093},"count":44},{"address":{"type":"absolute","value":1699228196},"count":36},{"address":{"type":"absolute","value":1699228369},"count":37},{"address":{"type":"absolute","value":1699228542},"count":70},{"address":{"type":"absolute","value":1699228808},"count":34},{"address":{"type":"absolute","value":1699228894},"count":71},{"address":{"type":"absolute","value":1699229418},"count":35},{"address":{"type":"absolute","value":1699229489},"count":33},{"address":{"type":"absolute","value":1699229560},"count":22},{"address":{"type":"absolute","value":1699229592},"count":65},{"address":{"type":"absolute","value":1699230105},"count":32},{"address":{"type":"absolute","value":1699230234},"count":23},{"address":{"type":"absolute","value":1699230304},"count":17},{"address":{"type":"absolute","value":1699230544},"count":41},{"address":{"type":"absolute","value":1699230656},"count":7},{"address":{"type":"absolute","value":1699230672},"count":34},{"address":{"type":"absolute","value":1699230752},"count":24},{"address":{"type":"absolute","value":1699230864},"count":62},{"address":{"type":"absolute","value":1699231232},"count":24},{"address":{"type":"absolute","value":1699231280},"count":244},{"address":{"type":"absolute","value":1699233856},"count":115},{"address":{"type":"absolute","value":1699234544},"count":71},{"address":{"type":"absolute","value":1699234992},"count":79},{"address":{"type":"absolute","value":1699235904},"count":71},{"address":{"type":"absolute","value":1699236352},"count":45},{"address":{"type":"absolute","value":1699236432},"count":94},{"address":{"type":"absolute","value":1699236480},"count":94},{"address":{"type":"absolute","value":1699236528},"count":34},{"address":{"type":"absolute","value":1699236608},"count":38},{"address":{"type":"absolute","value":1699236640},"count":40},{"address":{"type":"absolute","value":1699236736},"count":25},{"address":{"type":"absolute","value":1699236768},"count":71},{"address":{"type":"absolute","value":1699236912},"count":75},{"address":{"type":"absolute","value":1699237120},"count":61},{"address":{"type":"absolute","value":1699237216},"count":51},{"address":{"type":"absolute","value":1699237280},"count":54},{"address":{"type":"absolute","value":1699237376},"count":88},{"address":{"type":"absolute","value":1699238000},"count":44},{"address":{"type":"absolute","value":1699238128},"count":91},{"address":{"type":"absolute","value":1699238480},"count":71},{"address":{"type":"absolute","value":1699238912},"count":41},{"address":{"type":"absolute","value":1699239008},"count":71},{"address":{"type":"absolute","value":1699239024},"count":71},{"address":{"type":"absolute","value":1699239040},"count":31},{"address":{"type":"absolute","value":1699239136},"count":113},{"address":{"type":"absolute","value":1699240240},"count":49},{"address":{"type":"absolute","value":1699240432},"count":42},{"address":{"type":"absolute","value":1699240496},"count":113},{"address":{"type":"absolute","value":1699240512},"count":94},{"address":{"type":"absolute","value":1699240720},"count":64},{"address":{"type":"absolute","value":1699240928},"count":21},{"address":{"type":"absolute","value":1699240976},"count":152},{"address":{"type":"absolute","value":1699241168},"count":29},{"address":{"type":"absolute","value":1699241328},"count":41},{"address":{"type":"absolute","value":1699241456},"count":52},{"address":{"type":"absolute","value":1699241552},"count":45},{"address":{"type":"absolute","value":1699241680},"count":56},{"address":{"type":"absolute","value":1699241776},"count":30},{"address":{"type":"absolute","value":1699241856},"count":51},{"address":{"type":"absolute","value":1699243120},"count":44},{"address":{"type":"absolute","value":1699243280},"count":60},{"address":{"type":"absolute","value":1699243568},"count":86},{"address":{"type":"absolute","value":1699244400},"count":115},{"address":{"type":"absolute","value":1699244448},"count":94},{"address":{"type":"absolute","value":1699244464},"count":43},{"address":{"type":"absolute","value":1699244640},"count":39},{"address":{"type":"absolute","value":1699244768},"count":110},{"address":{"type":"absolute","value":1699245152},"count":109},{"address":{"type":"absolute","value":1699245200},"count":45},{"address":{"type":"absolute","value":1699245392},"count":268},{"address":{"type":"absolute","value":1699250096},"count":110},{"address":{"type":"absolute","value":1699250896},"count":37},{"address":{"type":"absolute","value":1699250976},"count":77},{"address":{"type":"absolute","value":1699251264},"count":102},{"address":{"type":"absolute","value":1699251776},"count":78},{"address":{"type":"absolute","value":1699251888},"count":21},{"address":{"type":"absolute","value":1699251936},"count":22},{"address":{"type":"absolute","value":1699251968},"count":20},{"address":{"type":"absolute","value":1699252016},"count":138},{"address":{"type":"absolute","value":1699252544},"count":139},{"address":{"type":"absolute","value":1699254128},"count":126},{"address":{"type":"absolute","value":1699255472},"count":42},{"address":{"type":"absolute","value":1699255696},"count":53},{"address":{"type":"absolute","value":1699256016},"count":36},{"address":{"type":"absolute","value":1699256096},"count":104},{"address":{"type":"absolute","value":1699257232},"count":46},{"address":{"type":"absolute","value":1699257344},"count":58},{"address":{"type":"absolute","value":1699257616},"count":107},{"address":{"type":"absolute","value":1699258800},"count":54},{"address":{"type":"absolute","value":1699259056},"count":77},{"address":{"type":"absolute","value":1699259952},"count":76},{"address":{"type":"absolute","value":1699260192},"count":30},{"address":{"type":"absolute","value":1699260304},"count":80},{"address":{"type":"absolute","value":1699260720},"count":82},{"address":{"type":"absolute","value":1699261600},"count":8},{"address":{"type":"absolute","value":1699261616},"count":18},{"address":{"type":"absolute","value":1699261648},"count":31},{"address":{"type":"absolute","value":1699261712},"count":33},{"address":{"type":"absolute","value":1699261792},"count":48},{"address":{"type":"absolute","value":1699261904},"count":37},{"address":{"type":"absolute","value":1699261984},"count":49},{"address":{"type":"absolute","value":1699262080},"count":23},{"address":{"type":"absolute","value":1699262128},"count":48},{"address":{"type":"absolute","value":1699262336},"count":39},{"address":{"type":"absolute","value":1699262384},"count":40},{"address":{"type":"absolute","value":1699262496},"count":29},{"address":{"type":"absolute","value":1699262512},"count":47},{"address":{"type":"absolute","value":1699262688},"count":61},{"address":{"type":"absolute","value":1699262816},"count":29},{"address":{"type":"absolute","value":1699262864},"count":46},{"address":{"type":"absolute","value":1699263008},"count":68},{"address":{"type":"absolute","value":1699263264},"count":21},{"address":{"type":"absolute","value":1699263296},"count":39},{"address":{"type":"absolute","value":1699263328},"count":70},{"address":{"type":"absolute","value":1699263520},"count":68},{"address":{"type":"absolute","value":1699263648},"count":52},{"address":{"type":"absolute","value":1699263824},"count":46},{"address":{"type":"absolute","value":1699263904},"count":49},{"address":{"type":"absolute","value":1699264048},"count":43},{"address":{"type":"absolute","value":1699264176},"count":29},{"address":{"type":"absolute","value":1699264224},"count":32},{"address":{"type":"absolute","value":1699264288},"count":19},{"address":{"type":"absolute","value":1699264336},"count":53},{"address":{"type":"absolute","value":1699264512},"count":40},{"address":{"type":"absolute","value":1699264528},"count":44},{"address":{"type":"absolute","value":1699264544},"count":40},{"address":{"type":"absolute","value":1699264560},"count":62},{"address":{"type":"absolute","value":1699264736},"count":90},{"address":{"type":"absolute","value":1699264992},"count":42},{"address":{"type":"absolute","value":1699265088},"count":65},{"address":{"type":"absolute","value":1699265264},"count":27},{"address":{"type":"absolute","value":1699265328},"count":54},{"address":{"type":"absolute","value":1699265392},"count":98},{"address":{"type":"absolute","value":1699265776},"count":63},{"address":{"type":"absolute","value":1699265856},"count":110},{"address":{"type":"absolute","value":1699265888},"count":112},{"address":{"type":"absolute","value":1699265936},"count":112},{"address":{"type":"absolute","value":1699265984},"count":26},{"address":{"type":"absolute","value":1699266048},"count":128},{"address":{"type":"absolute","value":1699266816},"count":56},{"address":{"type":"absolute","value":1699266896},"count":57},{"address":{"type":"absolute","value":1699266976},"count":23},{"address":{"type":"absolute","value":1699267024},"count":24},{"address":{"type":"absolute","value":1699267072},"count":18},{"address":{"type":"absolute","value":1699267120},"count":28},{"address":{"type":"absolute","value":1699267184},"count":29},{"address":{"type":"absolute","value":1699267216},"count":29},{"address":{"type":"absolute","value":1699267248},"count":58},{"address":{"type":"absolute","value":1699267408},"count":20},{"address":{"type":"absolute","value":1699267472},"count":56},{"address":{"type":"absolute","value":1699267568},"count":33},{"address":{"type":"absolute","value":1699267632},"count":31},{"address":{"type":"absolute","value":1699267808},"count":31},{"address":{"type":"absolute","value":1699267984},"count":11},{"address":{"type":"absolute","value":1699268000},"count":30},{"address":{"type":"absolute","value":1699268112},"count":48},{"address":{"type":"absolute","value":1699268336},"count":29},{"address":{"type":"absolute","value":1699268384},"count":88},{"address":{"type":"absolute","value":1699268432},"count":47},{"address":{"type":"absolute","value":1699268480},"count":83},{"address":{"type":"absolute","value":1699268528},"count":42},{"address":{"type":"absolute","value":1699268576},"count":107},{"address":{"type":"absolute","value":1699268672},"count":46},{"address":{"type":"absolute","value":1699269168},"count":72},{"address":{"type":"absolute","value":1699269856},"count":143},{"address":{"type":"absolute","value":1699271296},"count":159},{"address":{"type":"absolute","value":1699272640},"count":49},{"address":{"type":"absolute","value":1699272848},"count":115},{"address":{"type":"absolute","value":1699275456},"count":55},{"address":{"type":"absolute","value":1699276464},"count":38},{"address":{"type":"absolute","value":1699276544},"count":5},{"address":{"type":"absolute","value":1699276560},"count":21},{"address":{"type":"absolute","value":1699276624},"count":22},{"address":{"type":"absolute","value":1699276719},"count":25},{"address":{"type":"absolute","value":1699276800},"count":24},{"address":{"type":"absolute","value":1699276880},"count":25},{"address":{"type":"absolute","value":1699276960},"count":32},{"address":{"type":"absolute","value":1699277072},"count":40},{"address":{"type":"absolute","value":1699277216},"count":8},{"address":{"type":"absolute","value":1699277232},"count":8},{"address":{"type":"absolute","value":1699277240},"count":8},{"address":{"type":"absolute","value":1699277248},"count":8},{"address":{"type":"absolute","value":1699277256},"count":8},{"address":{"type":"absolute","value":1699277272},"count":8},{"address":{"type":"absolute","value":1699277280},"count":8},{"address":{"type":"absolute","value":1699277288},"count":8},{"address":{"type":"absolute","value":1699277296},"count":8},{"address":{"type":"absolute","value":1699277304},"count":8},{"address":{"type":"absolute","value":1699277312},"count":8},{"address":{"type":"absolute","value":1699277328},"count":8},{"address":{"type":"absolute","value":1699277336},"count":8},{"address":{"type":"absolute","value":1699277344},"count":8},{"address":{"type":"absolute","value":1699277352},"count":8},{"address":{"type":"absolute","value":1699277360},"count":25},{"address":{"type":"absolute","value":1699277424},"count":78},{"address":{"type":"absolute","value":1699277536},"count":78},{"address":{"type":"absolute","value":1699277568},"count":49},{"address":{"type":"absolute","value":1699277792},"count":41},{"address":{"type":"absolute","value":1699278048},"count":23},{"address":{"type":"absolute","value":1699278096},"count":42},{"address":{"type":"absolute","value":1699278224},"count":6},{"address":{"type":"absolute","value":1699278240},"count":6},{"address":{"type":"absolute","value":1699278256},"count":6},{"address":{"type":"absolute","value":1699278272},"count":110},{"address":{"type":"absolute","value":1699278784},"count":111},{"address":{"type":"absolute","value":1699279488},"count":61},{"address":{"type":"absolute","value":1699279904},"count":57},{"address":{"type":"absolute","value":1699280144},"count":74},{"address":{"type":"absolute","value":1699280640},"count":37},{"address":{"type":"absolute","value":1699280752},"count":37},{"address":{"type":"absolute","value":1699280880},"count":31},{"address":{"type":"absolute","value":1699281040},"count":44},{"address":{"type":"absolute","value":1699281264},"count":23},{"address":{"type":"absolute","value":1699281296},"count":25},{"address":{"type":"absolute","value":1699281328},"count":43},{"address":{"type":"absolute","value":1699281408},"count":57},{"address":{"type":"absolute","value":1699281552},"count":53},{"address":{"type":"absolute","value":1699281680},"count":32},{"address":{"type":"absolute","value":1699281744},"count":52},{"address":{"type":"absolute","value":1699281856},"count":28},{"address":{"type":"absolute","value":1699281920},"count":58},{"address":{"type":"absolute","value":1699282080},"count":59},{"address":{"type":"absolute","value":1699282256},"count":7},{"address":{"type":"absolute","value":1699282272},"count":24},{"address":{"type":"absolute","value":1699282368},"count":42},{"address":{"type":"absolute","value":1699282592},"count":61},{"address":{"type":"absolute","value":1699282752},"count":41},{"address":{"type":"absolute","value":1699282832},"count":40},{"address":{"type":"absolute","value":1699282912},"count":76},{"address":{"type":"absolute","value":1699283232},"count":9},{"address":{"type":"absolute","value":1699283248},"count":8},{"address":{"type":"absolute","value":1699283256},"count":8},{"address":{"type":"absolute","value":1699283264},"count":8},{"address":{"type":"absolute","value":1699283272},"count":8},{"address":{"type":"absolute","value":1699283280},"count":8},{"address":{"type":"absolute","value":1699283288},"count":8},{"address":{"type":"absolute","value":1699283296},"count":8},{"address":{"type":"absolute","value":1699283304},"count":8},{"address":{"type":"absolute","value":1699283312},"count":8},{"address":{"type":"absolute","value":1699283320},"count":8},{"address":{"type":"absolute","value":1699283328},"count":8},{"address":{"type":"absolute","value":1699283336},"count":8},{"address":{"type":"absolute","value":1699283344},"count":8},{"address":{"type":"absolute","value":1699283352},"count":8},{"address":{"type":"absolute","value":1699283360},"count":8},{"address":{"type":"absolute","value":1699283368},"count":8},{"address":{"type":"absolute","value":1699283376},"count":8},{"address":{"type":"absolute","value":1699283384},"count":8},{"address":{"type":"absolute","value":1699283392},"count":8},{"address":{"type":"absolute","value":1699283400},"count":8},{"address":{"type":"absolute","value":1699283408},"count":8},{"address":{"type":"absolute","value":1699283416},"count":8},{"address":{"type":"absolute","value":1699283424},"count":8},{"address":{"type":"absolute","value":1699283432},"count":8},{"address":{"type":"absolute","value":1699283440},"count":8},{"address":{"type":"absolute","value":1699283448},"count":8},{"address":{"type":"absolute","value":1699283480},"count":8},{"address":{"type":"absolute","value":1699283488},"count":8},{"address":{"type":"absolute","value":1699283496},"count":8},{"address":{"type":"absolute","value":1699283504},"count":8},{"address":{"type":"absolute","value":1699283512},"count":8},{"address":{"type":"absolute","value":1699283528},"count":8},{"address":{"type":"absolute","value":1699283536},"count":8},{"address":{"type":"absolute","value":1699283544},"count":8},{"address":{"type":"absolute","value":1699283552},"count":8},{"address":{"type":"absolute","value":1699283560},"count":8},{"address":{"type":"absolute","value":1699283568},"count":8},{"address":{"type":"absolute","value":1699283576},"count":8},{"address":{"type":"absolute","value":1699283584},"count":8},{"address":{"type":"absolute","value":1699283592},"count":8},{"address":{"type":"absolute","value":1699283600},"count":8},{"address":{"type":"absolute","value":1699283608},"count":7},{"address":{"type":"absolute","value":1699283632},"count":8},{"address":{"type":"absolute","value":1699283640},"count":8},{"address":{"type":"absolute","value":1699283656},"count":7},{"address":{"type":"absolute","value":1699283672},"count":8},{"address":{"type":"absolute","value":1699283680},"count":21},{"address":{"type":"absolute","value":1699283728},"count":62},{"address":{"type":"absolute","value":1699283936},"count":41},{"address":{"type":"absolute","value":1699284048},"count":27},{"address":{"type":"absolute","value":1699284080},"count":8},{"address":{"type":"absolute","value":1699284088},"count":8},{"address":{"type":"absolute","value":1699284096},"count":8},{"address":{"type":"absolute","value":1699284592},"count":33},{"address":{"type":"absolute","value":1699284704},"count":62}]},"library_functions":[{"address":{"type":"absolute","value":1698465232},"name":"?CreateIndirect@CDialog@@UEAAHPEBUDLGTEMPLATE@@PEAVCWnd@@PEAX@Z"},{"address":{"type":"absolute","value":1698535904},"name":"?"},{"address":{"type":"absolute","value":1698536240},"name":"?"},{"address":{"type":"absolute","value":1698536256},"name":"?"},{"address":{"type":"absolute","value":1699057776},"name":"?"},{"address":{"type":"absolute","value":1699065824},"name":"?GetThreadProxyFactoryManager@ResourceManager@details@Concurrency@@QEAAPEAVThreadProxyFactoryManager@23@XZ"},{"address":{"type":"absolute","value":1699065840},"name":"?GetLocation@VirtualProcessor@details@Concurrency@@QEBAAEBVlocation@3@XZ"},{"address":{"type":"absolute","value":1699173728},"name":"?"},{"address":{"type":"absolute","value":1699178320},"name":"?"},{"address":{"type":"absolute","value":1699212960},"name":"__asan_should_detect_stack_use_after_return"},{"address":{"type":"absolute","value":1699282336},"name":"?"},{"address":{"type":"absolute","value":1699282352},"name":"?"}]}},"rules":{"calculate modulo 256 via x86 assembly":{"meta":{"name":"calculate modulo 256 via x86 assembly","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"instruction"},"attack":[],"mbc":[{"parts":["Data","Modulo"],"objective":"Data","behavior":"Modulo","method":"","id":"C0058"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4049A9"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: calculate modulo 256 via x86 assembly\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: instruction\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Data::Modulo [C0058]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9\r\n  features:\r\n    #  and ecx, 800000FFh\r\n    #  and ecx, 0FFh\r\n    - and:\r\n      - mnemonic: and\r\n      - or:\r\n        - number: 0x800000FF\r\n        - number: 0xFF\r\n","matches":[[{"type":"absolute","value":1698567325},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1698567325}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483903}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[{"type":"absolute","value":1698567325}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delay execution\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@ramen0x3f\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449770\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.Sleep\r\n          - api: kernel32.SleepEx\r\n          - api: kernel32.WaitForSingleObject\r\n          - api: kernel32.SignalObjectAndWait\r\n          - api: kernel32.WaitForSingleObjectEx\r\n          - api: kernel32.WaitForMultipleObjects\r\n          - api: kernel32.WaitForMultipleObjectsEx\r\n          - api: kernel32.RegisterWaitForSingleObject\r\n          - api: WaitOnAddress\r\n          - api: user32.MsgWaitForMultipleObjects\r\n          - api: user32.MsgWaitForMultipleObjectsEx\r\n          - api: NtDelayExecution\r\n          - api: KeWaitForSingleObject\r\n          - api: KeDelayExecutionThread\r\n      - and:\r\n        - os: linux\r\n        - or:\r\n          - api: sleep\r\n          - api: usleep\r\n","matches":[[{"type":"absolute","value":1698435154},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":1698435159}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698435289},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":1698435294}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open file\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Create File [C0016]\r\n    examples:\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\r\n  features:\r\n    - or:\r\n      - api: CreateFile\r\n      - api: CreateFileEx\r\n      - api: IoCreateFile\r\n      - api: IoCreateFileEx\r\n      - api: ZwOpenFile\r\n      - api: ZwCreateFile\r\n      - api: NtOpenFile\r\n      - api: NtCreateFile\r\n      - api: LZCreateFile\r\n      - api: LZOpenFile\r\n      - api: fopen\r\n      - api: fopen64\r\n      - api: fdopen\r\n      - api: freopen\r\n      - api: open\r\n      - api: openat\r\n","matches":[[{"type":"absolute","value":1698528533},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698528593}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698467136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698467150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698474628},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698474642}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698474800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698474814}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698477120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698477149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528533},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698528593}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528533},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698528593}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699208496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1699208532}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231793},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":1699231855}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using XOR":{"meta":{"name":"encode data using XOR","namespace":"data-manipulation/encoding/xor","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Standard Algorithm","id":"E1027.m02"},{"parts":["Data","Encode Data","XOR"],"objective":"Data","behavior":"Encode Data","method":"XOR","id":"C0026.002"}],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403D7E"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encode data using XOR\r\n    namespace: data-manipulation/encoding/xor\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires characteristic, Not features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]\r\n      - Data::Encode Data::XOR [C0026.002]\r\n    examples:\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403D7E\r\n  features:\r\n    - and:\r\n      - characteristic: tight loop\r\n      - characteristic: nzxor\r\n      - not:\r\n        - description: filter for potential false positives\r\n        - or:\r\n          - or:\r\n            - description: unsigned bitwise negation operation (~i)\r\n            - number: 0xFFFFFFFF = bitwise negation for unsigned 32 bits\r\n            - number: 0xFFFFFFFFFFFFFFFF = bitwise negation for unsigned 64 bits\r\n          - or:\r\n            - description: signed bitwise negation operation (~i)\r\n            - number: 0x0FFFFFFF = bitwise negation for signed 32 bits\r\n            - number: 0x0FFFFFFFFFFFFFFF = bitwise negation for signed 64 bits\r\n          - or:\r\n            - description: Magic constants used in the implementation of strings functions.\r\n            # such as `strlen` and `strcat` in the Windows standard library:\r\n            # (((i - 0x81010101) ^ ~i) & 0x81010100)\r\n            ## 32 bits\r\n            - number: 0x7EFEFEFF = optimized string constant for 32 bits\r\n            - number: 0x81010101 = -0x81010101 = 0x7EFEFEFF\r\n            - number: 0x81010100 = 0x81010100 = ~0x7EFEFEFF\r\n            ## 64 bits\r\n            - number: 0x7EFEFEFEFEFEFEFF = optimized string constant for 64 bits\r\n            - number: 0x8101010101010101 = -0x8101010101010101 = 0x7EFEFEFEFEFEFEFF\r\n            - number: 0x8101010101010100 = 0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF\r\n","matches":[[{"type":"absolute","value":1698475264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698475296},{"type":"absolute","value":1698475321},{"type":"absolute","value":1698475290},{"type":"absolute","value":1698475323}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698476722},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698476729},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487644}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487680},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487797},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487797}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487801}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488032},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488032}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698488044}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489884}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490018},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490018}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490030}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490090}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490161},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490161}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490173}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490273},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490273}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490281}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490336},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490435},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490435}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490443}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490484},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490484}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490494}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491268}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491477},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491477}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491482}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491586},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491586}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491590}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491637}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491764},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491768}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491808},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491808}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491813}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492117}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492448},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492448}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492452}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698508720},{"type":"absolute","value":1698508723}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486705},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698486705}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698486724}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486930},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698486930}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698486934}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487644}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487680},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487797},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487797}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487801}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488032},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488032}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698488044}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488912},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698488916}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489056},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489060}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489108},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489108}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489113}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489186},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489186}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489190}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489297},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489297}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489301}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489346},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489346}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489351}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489443},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489443}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489447}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489488},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489493}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489884}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490018},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490018}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490030}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490090}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490161},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490161}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490173}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490273},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490273}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490281}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490336},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490435},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490435}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490443}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490484},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490484}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490494}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491268}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491477},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491477}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491482}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491586},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491586}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491590}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491637}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491764},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491768}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491808},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491808}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491813}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492117}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492448},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492448}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492452}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698493872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698493872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698493878},{"type":"absolute","value":1698493895}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492117}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492448},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492448}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492452}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496092}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496128},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496128}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496141}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496192},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496200}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496243},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496243}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496256}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698500020},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698500020}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698500081},{"type":"absolute","value":1698500075}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698500160},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698500160}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698500163},{"type":"absolute","value":1698500173}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698502896},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698502896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698502976},{"type":"absolute","value":1698503106},{"type":"absolute","value":1698502981},{"type":"absolute","value":1698503110},{"type":"absolute","value":1698503369},{"type":"absolute","value":1698503373},{"type":"absolute","value":1698503183},{"type":"absolute","value":1698503377},{"type":"absolute","value":1698503187},{"type":"absolute","value":1698503316},{"type":"absolute","value":1698503381},{"type":"absolute","value":1698502998},{"type":"absolute","value":1698503191},{"type":"absolute","value":1698503320},{"type":"absolute","value":1698503385},{"type":"absolute","value":1698503003},{"type":"absolute","value":1698503200},{"type":"absolute","value":1698502945},{"type":"absolute","value":1698503204},{"type":"absolute","value":1698503141},{"type":"absolute","value":1698503146},{"type":"absolute","value":1698503338},{"type":"absolute","value":1698503020},{"type":"absolute","value":1698503150},{"type":"absolute","value":1698503025},{"type":"absolute","value":1698503092},{"type":"absolute","value":1698503222},{"type":"absolute","value":1698503097},{"type":"absolute","value":1698503226},{"type":"absolute","value":1698503102}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505664},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698505664},{"type":"absolute","value":1698505674}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505824},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505824}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698505856},{"type":"absolute","value":1698505859}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698507069},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698507069}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698507074}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698508720},{"type":"absolute","value":1698508723}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698512080},{"type":"absolute","value":1698512129},{"type":"absolute","value":1698512145},{"type":"absolute","value":1698512084},{"type":"absolute","value":1698512200}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512800},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512800}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698512804}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698512853}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513156}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513200},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513200}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513205}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513856},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513856}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513860}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513906},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513906}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513911}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698514212},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698514212}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698514217}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698514272},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698514272}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698514277}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698515312},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698515312}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698515316}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698515731},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698515731}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698515735}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698508720},{"type":"absolute","value":1698508723}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698554624},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698554624}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698554627}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698563761},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698563761}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698563766}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564464},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698564464}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698564473}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564544},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698564544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698564549}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698565632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698565632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698565637}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698566402},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698566402}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698566420}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567776},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698567817}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568416},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568416}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698568457}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568819},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568819}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698568890}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568819},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568819}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698568890}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583376},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698583417}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698584016},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698584016}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698584057}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627520},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627520}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698627841},{"type":"absolute","value":1698627937},{"type":"absolute","value":1698627747},{"type":"absolute","value":1698627813},{"type":"absolute","value":1698627725},{"type":"absolute","value":1698627981},{"type":"absolute","value":1698627631},{"type":"absolute","value":1698627697},{"type":"absolute","value":1698627965},{"type":"absolute","value":1698627863},{"type":"absolute","value":1698627609},{"type":"absolute","value":1698627581}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631648},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698631675},{"type":"absolute","value":1698631695}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631984},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631984}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698632010},{"type":"absolute","value":1698632028}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644352},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698644368}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632544},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698632544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698632563},{"type":"absolute","value":1698632582}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643164}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643456},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643461}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633138},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633138}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698633184},{"type":"absolute","value":1698633202},{"type":"absolute","value":1698633234},{"type":"absolute","value":1698633237},{"type":"absolute","value":1698633288},{"type":"absolute","value":1698633227},{"type":"absolute","value":1698633276},{"type":"absolute","value":1698633247}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633473},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633473}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698633600},{"type":"absolute","value":1698633588},{"type":"absolute","value":1698633557},{"type":"absolute","value":1698633525},{"type":"absolute","value":1698633543},{"type":"absolute","value":1698633621},{"type":"absolute","value":1698633561},{"type":"absolute","value":1698633628}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633792},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633792}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698633842},{"type":"absolute","value":1698633906},{"type":"absolute","value":1698633878},{"type":"absolute","value":1698633862},{"type":"absolute","value":1698633882},{"type":"absolute","value":1698633919}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643164}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643456},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643461}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644352},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698644368}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644656},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644656}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698644672}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645024},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645024}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698645048},{"type":"absolute","value":1698645056},{"type":"absolute","value":1698645052},{"type":"absolute","value":1698645068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698645384},{"type":"absolute","value":1698645404},{"type":"absolute","value":1698645388},{"type":"absolute","value":1698645400}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645616},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645616}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698645640},{"type":"absolute","value":1698645644},{"type":"absolute","value":1698645656}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698720848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698720848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698720896},{"type":"absolute","value":1698720878}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698722098},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698722098}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698722146},{"type":"absolute","value":1698722127}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698829728},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698829728}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698829787},{"type":"absolute","value":1698829765}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698830992},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698830992}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698831048},{"type":"absolute","value":1698831029}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698958816},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698958816}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698958821}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698959173},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698959173}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698959178}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698960840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698960840}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698961280},{"type":"absolute","value":1698961929},{"type":"absolute","value":1698961162},{"type":"absolute","value":1698961291},{"type":"absolute","value":1698960909},{"type":"absolute","value":1698961551},{"type":"absolute","value":1698961681},{"type":"absolute","value":1698961044},{"type":"absolute","value":1698961172},{"type":"absolute","value":1698961814},{"type":"absolute","value":1698960919},{"type":"absolute","value":1698961561},{"type":"absolute","value":1698961434},{"type":"absolute","value":1698961690},{"type":"absolute","value":1698961053},{"type":"absolute","value":1698961825},{"type":"absolute","value":1698961954},{"type":"absolute","value":1698961315},{"type":"absolute","value":1698961444},{"type":"absolute","value":1698961658},{"type":"absolute","value":1698961964},{"type":"absolute","value":1698961325},{"type":"absolute","value":1698960943},{"type":"absolute","value":1698961584},{"type":"absolute","value":1698961076},{"type":"absolute","value":1698961848},{"type":"absolute","value":1698960953},{"type":"absolute","value":1698961594},{"type":"absolute","value":1698961468},{"type":"absolute","value":1698961213},{"type":"absolute","value":1698961086},{"type":"absolute","value":1698961731},{"type":"absolute","value":1698961859},{"type":"absolute","value":1698961349},{"type":"absolute","value":1698961478},{"type":"absolute","value":1698961223},{"type":"absolute","value":1698961989},{"type":"absolute","value":1698961741},{"type":"absolute","value":1698961359},{"type":"absolute","value":1698960976},{"type":"absolute","value":1698961617},{"type":"absolute","value":1698961999},{"type":"absolute","value":1698960986},{"type":"absolute","value":1698961626},{"type":"absolute","value":1698961883},{"type":"absolute","value":1698961246},{"type":"absolute","value":1698961764},{"type":"absolute","value":1698961894},{"type":"absolute","value":1698961383},{"type":"absolute","value":1698962023},{"type":"absolute","value":1698961129},{"type":"absolute","value":1698961257},{"type":"absolute","value":1698960877},{"type":"absolute","value":1698961773},{"type":"absolute","value":1698961648},{"type":"absolute","value":1698961393},{"type":"absolute","value":1698961010},{"type":"absolute","value":1698961139},{"type":"absolute","value":1698961521},{"type":"absolute","value":1698962033},{"type":"absolute","value":1698960887},{"type":"absolute","value":1698961530},{"type":"absolute","value":1698961020},{"type":"absolute","value":1698961918}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698963474},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698963474}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698963840},{"type":"absolute","value":1698963905},{"type":"absolute","value":1698963526},{"type":"absolute","value":1698963975},{"type":"absolute","value":1698963596},{"type":"absolute","value":1698963661},{"type":"absolute","value":1698963535},{"type":"absolute","value":1698963731},{"type":"absolute","value":1698963796},{"type":"absolute","value":1698963605},{"type":"absolute","value":1698963670},{"type":"absolute","value":1698963866},{"type":"absolute","value":1698963931},{"type":"absolute","value":1698963740},{"type":"absolute","value":1698963805},{"type":"absolute","value":1698963875},{"type":"absolute","value":1698963940},{"type":"absolute","value":1698963496},{"type":"absolute","value":1698963561},{"type":"absolute","value":1698964009},{"type":"absolute","value":1698963500},{"type":"absolute","value":1698963631},{"type":"absolute","value":1698963696},{"type":"absolute","value":1698963570},{"type":"absolute","value":1698963635},{"type":"absolute","value":1698964018},{"type":"absolute","value":1698963766},{"type":"absolute","value":1698963831},{"type":"absolute","value":1698963705},{"type":"absolute","value":1698963770},{"type":"absolute","value":1698963901},{"type":"absolute","value":1698963966}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966560},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966565}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966853}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966896},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966902}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966560},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966565}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966853}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966896},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966902}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698968773},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698968773}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698969218},{"type":"absolute","value":1698969478},{"type":"absolute","value":1698969223},{"type":"absolute","value":1698968974},{"type":"absolute","value":1698969748},{"type":"absolute","value":1698969621},{"type":"absolute","value":1698969499},{"type":"absolute","value":1698969244},{"type":"absolute","value":1698969117},{"type":"absolute","value":1698968995},{"type":"absolute","value":1698969769},{"type":"absolute","value":1698969642},{"type":"absolute","value":1698969519},{"type":"absolute","value":1698969265},{"type":"absolute","value":1698969138},{"type":"absolute","value":1698969394},{"type":"absolute","value":1698969524},{"type":"absolute","value":1698969399},{"type":"absolute","value":1698969015},{"type":"absolute","value":1698968890},{"type":"absolute","value":1698969020},{"type":"absolute","value":1698968895},{"type":"absolute","value":1698969664},{"type":"absolute","value":1698969285},{"type":"absolute","value":1698969669},{"type":"absolute","value":1698969543},{"type":"absolute","value":1698969160},{"type":"absolute","value":1698969290},{"type":"absolute","value":1698969548},{"type":"absolute","value":1698968781},{"type":"absolute","value":1698969165},{"type":"absolute","value":1698969039},{"type":"absolute","value":1698968786},{"type":"absolute","value":1698969426},{"type":"absolute","value":1698969044},{"type":"absolute","value":1698968922},{"type":"absolute","value":1698969309},{"type":"absolute","value":1698969696},{"type":"absolute","value":1698969569},{"type":"absolute","value":1698969314},{"type":"absolute","value":1698968805},{"type":"absolute","value":1698969447},{"type":"absolute","value":1698969192},{"type":"absolute","value":1698969065},{"type":"absolute","value":1698968810},{"type":"absolute","value":1698969452},{"type":"absolute","value":1698968943},{"type":"absolute","value":1698969457},{"type":"absolute","value":1698968948},{"type":"absolute","value":1698969717},{"type":"absolute","value":1698969590},{"type":"absolute","value":1698968953},{"type":"absolute","value":1698969722},{"type":"absolute","value":1698969213},{"type":"absolute","value":1698969086},{"type":"absolute","value":1698969727}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698971071},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698971071}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698971234},{"type":"absolute","value":1698971075},{"type":"absolute","value":1698971142},{"type":"absolute","value":1698971111},{"type":"absolute","value":1698971208},{"type":"absolute","value":1698971270},{"type":"absolute","value":1698971178},{"type":"absolute","value":1698971119},{"type":"absolute","value":1698971155},{"type":"absolute","value":1698971093},{"type":"absolute","value":1698971190},{"type":"absolute","value":1698971257},{"type":"absolute","value":1698971226},{"type":"absolute","value":1698971293}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698972233},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698972233}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698972676},{"type":"absolute","value":1698972427},{"type":"absolute","value":1698972560},{"type":"absolute","value":1698972818},{"type":"absolute","value":1698972946},{"type":"absolute","value":1698972951},{"type":"absolute","value":1698972447},{"type":"absolute","value":1698972452},{"type":"absolute","value":1698972581},{"type":"absolute","value":1698972839},{"type":"absolute","value":1698972328},{"type":"absolute","value":1698972586},{"type":"absolute","value":1698972972},{"type":"absolute","value":1698972333},{"type":"absolute","value":1698972591},{"type":"absolute","value":1698972465},{"type":"absolute","value":1698972470},{"type":"absolute","value":1698972859},{"type":"absolute","value":1698972864},{"type":"absolute","value":1698972993},{"type":"absolute","value":1698972354},{"type":"absolute","value":1698972612},{"type":"absolute","value":1698972740},{"type":"absolute","value":1698972998},{"type":"absolute","value":1698972745},{"type":"absolute","value":1698973003},{"type":"absolute","value":1698972877},{"type":"absolute","value":1698972241},{"type":"absolute","value":1698972882},{"type":"absolute","value":1698972246},{"type":"absolute","value":1698972375},{"type":"absolute","value":1698972633},{"type":"absolute","value":1698972380},{"type":"absolute","value":1698972766},{"type":"absolute","value":1698973024},{"type":"absolute","value":1698972385},{"type":"absolute","value":1698972259},{"type":"absolute","value":1698972264},{"type":"absolute","value":1698972653},{"type":"absolute","value":1698972658},{"type":"absolute","value":1698972787},{"type":"absolute","value":1698973045},{"type":"absolute","value":1698972406},{"type":"absolute","value":1698972534},{"type":"absolute","value":1698972792},{"type":"absolute","value":1698972539},{"type":"absolute","value":1698972797},{"type":"absolute","value":1698972671}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698974359},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698974359}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698974402},{"type":"absolute","value":1698974469},{"type":"absolute","value":1698974376},{"type":"absolute","value":1698974541},{"type":"absolute","value":1698974448},{"type":"absolute","value":1698974518},{"type":"absolute","value":1698974487},{"type":"absolute","value":1698974456},{"type":"absolute","value":1698974425},{"type":"absolute","value":1698974394},{"type":"absolute","value":1698974363},{"type":"absolute","value":1698974495}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058096},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058096}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058145},{"type":"absolute","value":1699058178},{"type":"absolute","value":1699058245},{"type":"absolute","value":1699058186},{"type":"absolute","value":1699058123},{"type":"absolute","value":1699058283},{"type":"absolute","value":1699058223},{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058129},{"type":"absolute","value":1699058194},{"type":"absolute","value":1699058287},{"type":"absolute","value":1699058229},{"type":"absolute","value":1699058295},{"type":"absolute","value":1699058137},{"type":"absolute","value":1699058237},{"type":"absolute","value":1699058175}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058337},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058337}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058337},{"type":"absolute","value":1699058379},{"type":"absolute","value":1699058395},{"type":"absolute","value":1699058375}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058414},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058414}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058433},{"type":"absolute","value":1699058423}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059072},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059096},{"type":"absolute","value":1699059092}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059472},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059583}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058560},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058560}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058596},{"type":"absolute","value":1699058660},{"type":"absolute","value":1699058758},{"type":"absolute","value":1699058683},{"type":"absolute","value":1699058715},{"type":"absolute","value":1699058570},{"type":"absolute","value":1699058668},{"type":"absolute","value":1699058638},{"type":"absolute","value":1699058606},{"type":"absolute","value":1699058608},{"type":"absolute","value":1699058640},{"type":"absolute","value":1699058703},{"type":"absolute","value":1699058742},{"type":"absolute","value":1699058750},{"type":"absolute","value":1699058619},{"type":"absolute","value":1699058686}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058801},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058801}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058808},{"type":"absolute","value":1699058844},{"type":"absolute","value":1699058852},{"type":"absolute","value":1699058836}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058877},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058877}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058896},{"type":"absolute","value":1699058886}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060192},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060217},{"type":"absolute","value":1699060221}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060769},{"type":"absolute","value":1699060765},{"type":"absolute","value":1699060799},{"type":"absolute","value":1699060803},{"type":"absolute","value":1699060697},{"type":"absolute","value":1699060731},{"type":"absolute","value":1699060701},{"type":"absolute","value":1699060735}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059072},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059096},{"type":"absolute","value":1699059092}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059472},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059583}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060192},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060217},{"type":"absolute","value":1699060221}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060769},{"type":"absolute","value":1699060765},{"type":"absolute","value":1699060799},{"type":"absolute","value":1699060803},{"type":"absolute","value":1699060697},{"type":"absolute","value":1699060731},{"type":"absolute","value":1699060701},{"type":"absolute","value":1699060735}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699079344},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699079344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699086341},{"type":"absolute","value":1699086346},{"type":"absolute","value":1699088396},{"type":"absolute","value":1699086349},{"type":"absolute","value":1699080206},{"type":"absolute","value":1699088406},{"type":"absolute","value":1699080217},{"type":"absolute","value":1699082265},{"type":"absolute","value":1699084313},{"type":"absolute","value":1699084316},{"type":"absolute","value":1699084322},{"type":"absolute","value":1699082278},{"type":"absolute","value":1699080239},{"type":"absolute","value":1699088435},{"type":"absolute","value":1699086388},{"type":"absolute","value":1699080248},{"type":"absolute","value":1699082300},{"type":"absolute","value":1699086396},{"type":"absolute","value":1699080254},{"type":"absolute","value":1699088447},{"type":"absolute","value":1699084358},{"type":"absolute","value":1699082312},{"type":"absolute","value":1699088459},{"type":"absolute","value":1699084366},{"type":"absolute","value":1699082323},{"type":"absolute","value":1699086430},{"type":"absolute","value":1699080292},{"type":"absolute","value":1699088484},{"type":"absolute","value":1699084392},{"type":"absolute","value":1699086443},{"type":"absolute","value":1699086446},{"type":"absolute","value":1699084402},{"type":"absolute","value":1699082356},{"type":"absolute","value":1699080312},{"type":"absolute","value":1699084411},{"type":"absolute","value":1699088507},{"type":"absolute","value":1699082369},{"type":"absolute","value":1699088516},{"type":"absolute","value":1699082379},{"type":"absolute","value":1699080333},{"type":"absolute","value":1699080340},{"type":"absolute","value":1699086487},{"type":"absolute","value":1699086489},{"type":"absolute","value":1699088537},{"type":"absolute","value":1699082396},{"type":"absolute","value":1699084447},{"type":"absolute","value":1699080352},{"type":"absolute","value":1699088547},{"type":"absolute","value":1699080357},{"type":"absolute","value":1699082405},{"type":"absolute","value":1699084456},{"type":"absolute","value":1699088553},{"type":"absolute","value":1699080363},{"type":"absolute","value":1699082411},{"type":"absolute","value":1699084466},{"type":"absolute","value":1699086522},{"type":"absolute","value":1699086532},{"type":"absolute","value":1699088586},{"type":"absolute","value":1699080395},{"type":"absolute","value":1699082448},{"type":"absolute","value":1699086545},{"type":"absolute","value":1699080403},{"type":"absolute","value":1699084500},{"type":"absolute","value":1699088596},{"type":"absolute","value":1699084503},{"type":"absolute","value":1699082456},{"type":"absolute","value":1699084509},{"type":"absolute","value":1699086576},{"type":"absolute","value":1699088626},{"type":"absolute","value":1699082485},{"type":"absolute","value":1699086582},{"type":"absolute","value":1699080440},{"type":"absolute","value":1699088636},{"type":"absolute","value":1699082495},{"type":"absolute","value":1699080448},{"type":"absolute","value":1699084550},{"type":"absolute","value":1699088649},{"type":"absolute","value":1699080461},{"type":"absolute","value":1699082512},{"type":"absolute","value":1699084560},{"type":"absolute","value":1699086609},{"type":"absolute","value":1699086612},{"type":"absolute","value":1699080471},{"type":"absolute","value":1699080477},{"type":"absolute","value":1699088669},{"type":"absolute","value":1699086626},{"type":"absolute","value":1699082536},{"type":"absolute","value":1699088682},{"type":"absolute","value":1699084589},{"type":"absolute","value":1699088690},{"type":"absolute","value":1699082549},{"type":"absolute","value":1699084599},{"type":"absolute","value":1699084605},{"type":"absolute","value":1699082559},{"type":"absolute","value":1699086657},{"type":"absolute","value":1699088713},{"type":"absolute","value":1699086673},{"type":"absolute","value":1699080530},{"type":"absolute","value":1699088723},{"type":"absolute","value":1699082582},{"type":"absolute","value":1699084630},{"type":"absolute","value":1699088729},{"type":"absolute","value":1699086682},{"type":"absolute","value":1699082592},{"type":"absolute","value":1699080549},{"type":"absolute","value":1699082598},{"type":"absolute","value":1699084654},{"type":"absolute","value":1699080559},{"type":"absolute","value":1699086705},{"type":"absolute","value":1699084664},{"type":"absolute","value":1699088761},{"type":"absolute","value":1699080572},{"type":"absolute","value":1699086721},{"type":"absolute","value":1699082631},{"type":"absolute","value":1699086727},{"type":"absolute","value":1699088776},{"type":"absolute","value":1699082641},{"type":"absolute","value":1699084690},{"type":"absolute","value":1699084693},{"type":"absolute","value":1699080599},{"type":"absolute","value":1699080602},{"type":"absolute","value":1699084699},{"type":"absolute","value":1699086747},{"type":"absolute","value":1699080608},{"type":"absolute","value":1699088800},{"type":"absolute","value":1699086757},{"type":"absolute","value":1699082667},{"type":"absolute","value":1699088816},{"type":"absolute","value":1699082677},{"type":"absolute","value":1699088825},{"type":"absolute","value":1699082686},{"type":"absolute","value":1699086787},{"type":"absolute","value":1699088845},{"type":"absolute","value":1699080658},{"type":"absolute","value":1699086804},{"type":"absolute","value":1699082712},{"type":"absolute","value":1699084760},{"type":"absolute","value":1699088857},{"type":"absolute","value":1699084763},{"type":"absolute","value":1699086814},{"type":"absolute","value":1699088865},{"type":"absolute","value":1699080677},{"type":"absolute","value":1699082735},{"type":"absolute","value":1699084783},{"type":"absolute","value":1699080692},{"type":"absolute","value":1699088885},{"type":"absolute","value":1699086839},{"type":"absolute","value":1699082745},{"type":"absolute","value":1699084793},{"type":"absolute","value":1699080701},{"type":"absolute","value":1699084799},{"type":"absolute","value":1699088895},{"type":"absolute","value":1699088901},{"type":"absolute","value":1699086863},{"type":"absolute","value":1699082770},{"type":"absolute","value":1699080724},{"type":"absolute","value":1699086870},{"type":"absolute","value":1699082780},{"type":"absolute","value":1699080733},{"type":"absolute","value":1699084828},{"type":"absolute","value":1699080738},{"type":"absolute","value":1699082786},{"type":"absolute","value":1699088933},{"type":"absolute","value":1699084845},{"type":"absolute","value":1699084853},{"type":"absolute","value":1699088949},{"type":"absolute","value":1699086904},{"type":"absolute","value":1699086911},{"type":"absolute","value":1699082820},{"type":"absolute","value":1699080773},{"type":"absolute","value":1699086920},{"type":"absolute","value":1699084876},{"type":"absolute","value":1699088973},{"type":"absolute","value":1699082830},{"type":"absolute","value":1699084878},{"type":"absolute","value":1699084884},{"type":"absolute","value":1699088983},{"type":"absolute","value":1699080793},{"type":"absolute","value":1699088991},{"type":"absolute","value":1699080804},{"type":"absolute","value":1699082857},{"type":"absolute","value":1699080812},{"type":"absolute","value":1699086964},{"type":"absolute","value":1699082869},{"type":"absolute","value":1699089013},{"type":"absolute","value":1699082878},{"type":"absolute","value":1699086976},{"type":"absolute","value":1699089026},{"type":"absolute","value":1699084932},{"type":"absolute","value":1699086980},{"type":"absolute","value":1699080841},{"type":"absolute","value":1699089034},{"type":"absolute","value":1699080844},{"type":"absolute","value":1699084940},{"type":"absolute","value":1699080849},{"type":"absolute","value":1699086999},{"type":"absolute","value":1699082904},{"type":"absolute","value":1699087002},{"type":"absolute","value":1699089056},{"type":"absolute","value":1699089066},{"type":"absolute","value":1699084972},{"type":"absolute","value":1699082926},{"type":"absolute","value":1699087024},{"type":"absolute","value":1699089072},{"type":"absolute","value":1699084980},{"type":"absolute","value":1699082935},{"type":"absolute","value":1699084985},{"type":"absolute","value":1699080901},{"type":"absolute","value":1699085007},{"type":"absolute","value":1699082960},{"type":"absolute","value":1699087055},{"type":"absolute","value":1699089105},{"type":"absolute","value":1699087061},{"type":"absolute","value":1699080920},{"type":"absolute","value":1699082970},{"type":"absolute","value":1699089115},{"type":"absolute","value":1699082976},{"type":"absolute","value":1699080931},{"type":"absolute","value":1699085032},{"type":"absolute","value":1699080938},{"type":"absolute","value":1699085039},{"type":"absolute","value":1699087089},{"type":"absolute","value":1699087094},{"type":"absolute","value":1699089143},{"type":"absolute","value":1699087099},{"type":"absolute","value":1699089149},{"type":"absolute","value":1699083009},{"type":"absolute","value":1699085060},{"type":"absolute","value":1699080966},{"type":"absolute","value":1699085062},{"type":"absolute","value":1699089159},{"type":"absolute","value":1699083019},{"type":"absolute","value":1699085068},{"type":"absolute","value":1699080973},{"type":"absolute","value":1699080979},{"type":"absolute","value":1699089177},{"type":"absolute","value":1699087131},{"type":"absolute","value":1699087141},{"type":"absolute","value":1699083046},{"type":"absolute","value":1699089191},{"type":"absolute","value":1699089201},{"type":"absolute","value":1699083058},{"type":"absolute","value":1699085113},{"type":"absolute","value":1699085119},{"type":"absolute","value":1699087169},{"type":"absolute","value":1699083076},{"type":"absolute","value":1699089226},{"type":"absolute","value":1699081035},{"type":"absolute","value":1699087181},{"type":"absolute","value":1699089229},{"type":"absolute","value":1699087184},{"type":"absolute","value":1699089235},{"type":"absolute","value":1699085146},{"type":"absolute","value":1699081053},{"type":"absolute","value":1699083101},{"type":"absolute","value":1699085152},{"type":"absolute","value":1699083111},{"type":"absolute","value":1699081064},{"type":"absolute","value":1699081072},{"type":"absolute","value":1699083120},{"type":"absolute","value":1699087216},{"type":"absolute","value":1699085179},{"type":"absolute","value":1699089283},{"type":"absolute","value":1699083141},{"type":"absolute","value":1699087238},{"type":"absolute","value":1699089286},{"type":"absolute","value":1699081098},{"type":"absolute","value":1699087245},{"type":"absolute","value":1699083150},{"type":"absolute","value":1699085198},{"type":"absolute","value":1699083155},{"type":"absolute","value":1699081108},{"type":"absolute","value":1699081114},{"type":"absolute","value":1699085212},{"type":"absolute","value":1699085218},{"type":"absolute","value":1699089323},{"type":"absolute","value":1699087278},{"type":"absolute","value":1699089329},{"type":"absolute","value":1699083186},{"type":"absolute","value":1699087284},{"type":"absolute","value":1699089337},{"type":"absolute","value":1699083194},{"type":"absolute","value":1699087290},{"type":"absolute","value":1699081150},{"type":"absolute","value":1699085247},{"type":"absolute","value":1699085254},{"type":"absolute","value":1699085260},{"type":"absolute","value":1699089358},{"type":"absolute","value":1699083218},{"type":"absolute","value":1699081176},{"type":"absolute","value":1699089371},{"type":"absolute","value":1699083230},{"type":"absolute","value":1699089381},{"type":"absolute","value":1699081191},{"type":"absolute","value":1699087335},{"type":"absolute","value":1699083245},{"type":"absolute","value":1699081200},{"type":"absolute","value":1699085300},{"type":"absolute","value":1699087349},{"type":"absolute","value":1699089407},{"type":"absolute","value":1699085312},{"type":"absolute","value":1699083268},{"type":"absolute","value":1699089414},{"type":"absolute","value":1699087367},{"type":"absolute","value":1699081224},{"type":"absolute","value":1699083279},{"type":"absolute","value":1699089424},{"type":"absolute","value":1699081234},{"type":"absolute","value":1699081240},{"type":"absolute","value":1699083288},{"type":"absolute","value":1699085336},{"type":"absolute","value":1699087393},{"type":"absolute","value":1699085351},{"type":"absolute","value":1699083308},{"type":"absolute","value":1699087405},{"type":"absolute","value":1699085363},{"type":"absolute","value":1699083317},{"type":"absolute","value":1699081273},{"type":"absolute","value":1699087417},{"type":"absolute","value":1699083323},{"type":"absolute","value":1699089465},{"type":"absolute","value":1699089475},{"type":"absolute","value":1699085382},{"type":"absolute","value":1699085392},{"type":"absolute","value":1699081298},{"type":"absolute","value":1699083350},{"type":"absolute","value":1699087448},{"type":"absolute","value":1699085401},{"type":"absolute","value":1699089499},{"type":"absolute","value":1699083357},{"type":"absolute","value":1699087455},{"type":"absolute","value":1699081312},{"type":"absolute","value":1699089505},{"type":"absolute","value":1699089511},{"type":"absolute","value":1699081321},{"type":"absolute","value":1699085425},{"type":"absolute","value":1699083379},{"type":"absolute","value":1699087483},{"type":"absolute","value":1699083388},{"type":"absolute","value":1699085436},{"type":"absolute","value":1699089533},{"type":"absolute","value":1699085441},{"type":"absolute","value":1699087489},{"type":"absolute","value":1699083397},{"type":"absolute","value":1699081350},{"type":"absolute","value":1699087493},{"type":"absolute","value":1699089549},{"type":"absolute","value":1699081359},{"type":"absolute","value":1699081365},{"type":"absolute","value":1699089557},{"type":"absolute","value":1699083421},{"type":"absolute","value":1699085469},{"type":"absolute","value":1699085478},{"type":"absolute","value":1699087530},{"type":"absolute","value":1699083441},{"type":"absolute","value":1699087539},{"type":"absolute","value":1699089587},{"type":"absolute","value":1699081397},{"type":"absolute","value":1699089589},{"type":"absolute","value":1699083448},{"type":"absolute","value":1699089595},{"type":"absolute","value":1699081407},{"type":"absolute","value":1699085508},{"type":"absolute","value":1699085516},{"type":"absolute","value":1699087565},{"type":"absolute","value":1699083470},{"type":"absolute","value":1699083476},{"type":"absolute","value":1699085526},{"type":"absolute","value":1699081431},{"type":"absolute","value":1699087575},{"type":"absolute","value":1699083482},{"type":"absolute","value":1699079392},{"type":"absolute","value":1699081440},{"type":"absolute","value":1699087589},{"type":"absolute","value":1699085546},{"type":"absolute","value":1699089643},{"type":"absolute","value":1699089645},{"type":"absolute","value":1699081454},{"type":"absolute","value":1699087602},{"type":"absolute","value":1699079412},{"type":"absolute","value":1699085562},{"type":"absolute","value":1699081467},{"type":"absolute","value":1699087614},{"type":"absolute","value":1699085570},{"type":"absolute","value":1699079427},{"type":"absolute","value":1699081477},{"type":"absolute","value":1699083527},{"type":"absolute","value":1699087623},{"type":"absolute","value":1699079433},{"type":"absolute","value":1699081484},{"type":"absolute","value":1699083533},{"type":"absolute","value":1699089681},{"type":"absolute","value":1699089683},{"type":"absolute","value":1699089693},{"type":"absolute","value":1699085599},{"type":"absolute","value":1699087647},{"type":"absolute","value":1699085601},{"type":"absolute","value":1699083554},{"type":"absolute","value":1699081511},{"type":"absolute","value":1699085607},{"type":"absolute","value":1699089704},{"type":"absolute","value":1699087659},{"type":"absolute","value":1699083566},{"type":"absolute","value":1699081519},{"type":"absolute","value":1699079472},{"type":"absolute","value":1699087665},{"type":"absolute","value":1699081524},{"type":"absolute","value":1699089721},{"type":"absolute","value":1699079482},{"type":"absolute","value":1699083582},{"type":"absolute","value":1699079488},{"type":"absolute","value":1699089728},{"type":"absolute","value":1699081552},{"type":"absolute","value":1699085649},{"type":"absolute","value":1699083602},{"type":"absolute","value":1699087697},{"type":"absolute","value":1699081559},{"type":"absolute","value":1699085659},{"type":"absolute","value":1699083613},{"type":"absolute","value":1699079518},{"type":"absolute","value":1699087710},{"type":"absolute","value":1699089760},{"type":"absolute","value":1699083620},{"type":"absolute","value":1699089767},{"type":"absolute","value":1699081577},{"type":"absolute","value":1699089773},{"type":"absolute","value":1699079540},{"type":"absolute","value":1699081589},{"type":"absolute","value":1699085684},{"type":"absolute","value":1699083640},{"type":"absolute","value":1699087736},{"type":"absolute","value":1699085694},{"type":"absolute","value":1699087746},{"type":"absolute","value":1699081603},{"type":"absolute","value":1699083653},{"type":"absolute","value":1699085704},{"type":"absolute","value":1699079561},{"type":"absolute","value":1699087752},{"type":"absolute","value":1699083659},{"type":"absolute","value":1699079567},{"type":"absolute","value":1699081615},{"type":"absolute","value":1699089817},{"type":"absolute","value":1699081626},{"type":"absolute","value":1699087778},{"type":"absolute","value":1699081636},{"type":"absolute","value":1699083686},{"type":"absolute","value":1699079591},{"type":"absolute","value":1699089834},{"type":"absolute","value":1699085743},{"type":"absolute","value":1699083696},{"type":"absolute","value":1699087793},{"type":"absolute","value":1699079606},{"type":"absolute","value":1699079610},{"type":"absolute","value":1699081658},{"type":"absolute","value":1699087806},{"type":"absolute","value":1699089859},{"type":"absolute","value":1699081668},{"type":"absolute","value":1699089862},{"type":"absolute","value":1699085768},{"type":"absolute","value":1699081674},{"type":"absolute","value":1699083723},{"type":"absolute","value":1699085776},{"type":"absolute","value":1699079639},{"type":"absolute","value":1699083735},{"type":"absolute","value":1699087831},{"type":"absolute","value":1699089884},{"type":"absolute","value":1699079649},{"type":"absolute","value":1699087841},{"type":"absolute","value":1699083747},{"type":"absolute","value":1699085797},{"type":"absolute","value":1699087847},{"type":"absolute","value":1699081706},{"type":"absolute","value":1699085804},{"type":"absolute","value":1699089903},{"type":"absolute","value":1699085809},{"type":"absolute","value":1699089906},{"type":"absolute","value":1699081716},{"type":"absolute","value":1699083765},{"type":"absolute","value":1699089921},{"type":"absolute","value":1699079684},{"type":"absolute","value":1699085831},{"type":"absolute","value":1699079692},{"type":"absolute","value":1699083788},{"type":"absolute","value":1699081745},{"type":"absolute","value":1699085841},{"type":"absolute","value":1699087890},{"type":"absolute","value":1699083797},{"type":"absolute","value":1699081755},{"type":"absolute","value":1699087900},{"type":"absolute","value":1699079717},{"type":"absolute","value":1699081767},{"type":"absolute","value":1699079724},{"type":"absolute","value":1699083821},{"type":"absolute","value":1699089967},{"type":"absolute","value":1699079730},{"type":"absolute","value":1699087922},{"type":"absolute","value":1699085878},{"type":"absolute","value":1699083831},{"type":"absolute","value":1699089974},{"type":"absolute","value":1699081788},{"type":"absolute","value":1699083837},{"type":"absolute","value":1699087932},{"type":"absolute","value":1699089980},{"type":"absolute","value":1699085888},{"type":"absolute","value":1699087943},{"type":"absolute","value":1699081807},{"type":"absolute","value":1699085903},{"type":"absolute","value":1699087955},{"type":"absolute","value":1699081817},{"type":"absolute","value":1699079770},{"type":"absolute","value":1699083869},{"type":"absolute","value":1699079778},{"type":"absolute","value":1699087972},{"type":"absolute","value":1699085926},{"type":"absolute","value":1699083879},{"type":"absolute","value":1699087980},{"type":"absolute","value":1699081840},{"type":"absolute","value":1699081850},{"type":"absolute","value":1699085947},{"type":"absolute","value":1699083901},{"type":"absolute","value":1699081856},{"type":"absolute","value":1699088000},{"type":"absolute","value":1699085954},{"type":"absolute","value":1699079814},{"type":"absolute","value":1699083911},{"type":"absolute","value":1699088009},{"type":"absolute","value":1699088015},{"type":"absolute","value":1699083921},{"type":"absolute","value":1699079826},{"type":"absolute","value":1699085981},{"type":"absolute","value":1699081890},{"type":"absolute","value":1699085988},{"type":"absolute","value":1699085994},{"type":"absolute","value":1699083948},{"type":"absolute","value":1699079853},{"type":"absolute","value":1699088046},{"type":"absolute","value":1699079860},{"type":"absolute","value":1699081910},{"type":"absolute","value":1699083958},{"type":"absolute","value":1699088054},{"type":"absolute","value":1699079866},{"type":"absolute","value":1699083966},{"type":"absolute","value":1699081930},{"type":"absolute","value":1699088077},{"type":"absolute","value":1699081940},{"type":"absolute","value":1699083988},{"type":"absolute","value":1699086038},{"type":"absolute","value":1699088087},{"type":"absolute","value":1699083996},{"type":"absolute","value":1699086047},{"type":"absolute","value":1699081952},{"type":"absolute","value":1699084000},{"type":"absolute","value":1699088098},{"type":"absolute","value":1699079912},{"type":"absolute","value":1699079920},{"type":"absolute","value":1699086068},{"type":"absolute","value":1699081974},{"type":"absolute","value":1699086073},{"type":"absolute","value":1699088122},{"type":"absolute","value":1699084029},{"type":"absolute","value":1699084037},{"type":"absolute","value":1699088133},{"type":"absolute","value":1699088140},{"type":"absolute","value":1699081997},{"type":"absolute","value":1699086094},{"type":"absolute","value":1699079957},{"type":"absolute","value":1699082006},{"type":"absolute","value":1699084057},{"type":"absolute","value":1699079966},{"type":"absolute","value":1699088160},{"type":"absolute","value":1699084065},{"type":"absolute","value":1699086120},{"type":"absolute","value":1699088170},{"type":"absolute","value":1699084077},{"type":"absolute","value":1699082030},{"type":"absolute","value":1699088176},{"type":"absolute","value":1699086131},{"type":"absolute","value":1699079990},{"type":"absolute","value":1699082040},{"type":"absolute","value":1699084091},{"type":"absolute","value":1699086140},{"type":"absolute","value":1699082046},{"type":"absolute","value":1699080000},{"type":"absolute","value":1699080006},{"type":"absolute","value":1699086159},{"type":"absolute","value":1699088208},{"type":"absolute","value":1699084113},{"type":"absolute","value":1699084121},{"type":"absolute","value":1699086172},{"type":"absolute","value":1699082079},{"type":"absolute","value":1699088225},{"type":"absolute","value":1699084130},{"type":"absolute","value":1699086178},{"type":"absolute","value":1699084139},{"type":"absolute","value":1699080045},{"type":"absolute","value":1699084144},{"type":"absolute","value":1699082099},{"type":"absolute","value":1699088243},{"type":"absolute","value":1699080057},{"type":"absolute","value":1699088253},{"type":"absolute","value":1699088259},{"type":"absolute","value":1699086212},{"type":"absolute","value":1699082119},{"type":"absolute","value":1699086221},{"type":"absolute","value":1699084176},{"type":"absolute","value":1699082131},{"type":"absolute","value":1699080085},{"type":"absolute","value":1699084187},{"type":"absolute","value":1699080094},{"type":"absolute","value":1699082143},{"type":"absolute","value":1699088291},{"type":"absolute","value":1699086249},{"type":"absolute","value":1699084207},{"type":"absolute","value":1699086255},{"type":"absolute","value":1699080117},{"type":"absolute","value":1699088309},{"type":"absolute","value":1699086263},{"type":"absolute","value":1699082169},{"type":"absolute","value":1699084218},{"type":"absolute","value":1699084287},{"type":"absolute","value":1699088318},{"type":"absolute","value":1699080127},{"type":"absolute","value":1699080133},{"type":"absolute","value":1699084232},{"type":"absolute","value":1699082188},{"type":"absolute","value":1699082191},{"type":"absolute","value":1699086288},{"type":"absolute","value":1699088344},{"type":"absolute","value":1699084250},{"type":"absolute","value":1699088347},{"type":"absolute","value":1699086302},{"type":"absolute","value":1699088353},{"type":"absolute","value":1699080165},{"type":"absolute","value":1699086311},{"type":"absolute","value":1699082220},{"type":"absolute","value":1699080173},{"type":"absolute","value":1699082229},{"type":"absolute","value":1699084277},{"type":"absolute","value":1699082234},{"type":"absolute","value":1699086335}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699091184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699091184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699092226},{"type":"absolute","value":1699091716},{"type":"absolute","value":1699091972},{"type":"absolute","value":1699093001},{"type":"absolute","value":1699093259},{"type":"absolute","value":1699091982},{"type":"absolute","value":1699093008},{"type":"absolute","value":1699092241},{"type":"absolute","value":1699091986},{"type":"absolute","value":1699093267},{"type":"absolute","value":1699092244},{"type":"absolute","value":1699091989},{"type":"absolute","value":1699091226},{"type":"absolute","value":1699092252},{"type":"absolute","value":1699092515},{"type":"absolute","value":1699093283},{"type":"absolute","value":1699093286},{"type":"absolute","value":1699091240},{"type":"absolute","value":1699092010},{"type":"absolute","value":1699091243},{"type":"absolute","value":1699092267},{"type":"absolute","value":1699093293},{"type":"absolute","value":1699091502},{"type":"absolute","value":1699091250},{"type":"absolute","value":1699092274},{"type":"absolute","value":1699092530},{"type":"absolute","value":1699092277},{"type":"absolute","value":1699092023},{"type":"absolute","value":1699091512},{"type":"absolute","value":1699092537},{"type":"absolute","value":1699093309},{"type":"absolute","value":1699091266},{"type":"absolute","value":1699092803},{"type":"absolute","value":1699091524},{"type":"absolute","value":1699092293},{"type":"absolute","value":1699092549},{"type":"absolute","value":1699091273},{"type":"absolute","value":1699091532},{"type":"absolute","value":1699092559},{"type":"absolute","value":1699092818},{"type":"absolute","value":1699092563},{"type":"absolute","value":1699092821},{"type":"absolute","value":1699092566},{"type":"absolute","value":1699091803},{"type":"absolute","value":1699091548},{"type":"absolute","value":1699092829},{"type":"absolute","value":1699091551},{"type":"absolute","value":1699091558},{"type":"absolute","value":1699093096},{"type":"absolute","value":1699091817},{"type":"absolute","value":1699092587},{"type":"absolute","value":1699091820},{"type":"absolute","value":1699092844},{"type":"absolute","value":1699092079},{"type":"absolute","value":1699091827},{"type":"absolute","value":1699092851},{"type":"absolute","value":1699091574},{"type":"absolute","value":1699092854},{"type":"absolute","value":1699092600},{"type":"absolute","value":1699092089},{"type":"absolute","value":1699093111},{"type":"absolute","value":1699093118},{"type":"absolute","value":1699091843},{"type":"absolute","value":1699092101},{"type":"absolute","value":1699092870},{"type":"absolute","value":1699093384},{"type":"absolute","value":1699091850},{"type":"absolute","value":1699093130},{"type":"absolute","value":1699092109},{"type":"absolute","value":1699093140},{"type":"absolute","value":1699093399},{"type":"absolute","value":1699093144},{"type":"absolute","value":1699093402},{"type":"absolute","value":1699093147},{"type":"absolute","value":1699092380},{"type":"absolute","value":1699092125},{"type":"absolute","value":1699092128},{"type":"absolute","value":1699091361},{"type":"absolute","value":1699092728},{"type":"absolute","value":1699093410},{"type":"absolute","value":1699092135},{"type":"absolute","value":1699092394},{"type":"absolute","value":1699092397},{"type":"absolute","value":1699091376},{"type":"absolute","value":1699092656},{"type":"absolute","value":1699093168},{"type":"absolute","value":1699093425},{"type":"absolute","value":1699092404},{"type":"absolute","value":1699091383},{"type":"absolute","value":1699092151},{"type":"absolute","value":1699093432},{"type":"absolute","value":1699092666},{"type":"absolute","value":1699093435},{"type":"absolute","value":1699093181},{"type":"absolute","value":1699091649},{"type":"absolute","value":1699091395},{"type":"absolute","value":1699092420},{"type":"absolute","value":1699092678},{"type":"absolute","value":1699092427},{"type":"absolute","value":1699093451},{"type":"absolute","value":1699091405},{"type":"absolute","value":1699092686},{"type":"absolute","value":1699091664},{"type":"absolute","value":1699091409},{"type":"absolute","value":1699091667},{"type":"absolute","value":1699091412},{"type":"absolute","value":1699091675},{"type":"absolute","value":1699092702},{"type":"absolute","value":1699092705},{"type":"absolute","value":1699091938},{"type":"absolute","value":1699092961},{"type":"absolute","value":1699092712},{"type":"absolute","value":1699091433},{"type":"absolute","value":1699091690},{"type":"absolute","value":1699092975},{"type":"absolute","value":1699091697},{"type":"absolute","value":1699091953},{"type":"absolute","value":1699092978},{"type":"absolute","value":1699091700},{"type":"absolute","value":1699093237},{"type":"absolute","value":1699091446},{"type":"absolute","value":1699091960},{"type":"absolute","value":1699092985},{"type":"absolute","value":1699093247}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699093513},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699093513}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699094018},{"type":"absolute","value":1699094149},{"type":"absolute","value":1699093638},{"type":"absolute","value":1699094028},{"type":"absolute","value":1699093645},{"type":"absolute","value":1699093648},{"type":"absolute","value":1699094035},{"type":"absolute","value":1699094038},{"type":"absolute","value":1699093658},{"type":"absolute","value":1699093534},{"type":"absolute","value":1699094048},{"type":"absolute","value":1699093665},{"type":"absolute","value":1699093924},{"type":"absolute","value":1699094055},{"type":"absolute","value":1699093544},{"type":"absolute","value":1699093934},{"type":"absolute","value":1699093551},{"type":"absolute","value":1699093554},{"type":"absolute","value":1699093941},{"type":"absolute","value":1699093816},{"type":"absolute","value":1699093944},{"type":"absolute","value":1699093564},{"type":"absolute","value":1699094206},{"type":"absolute","value":1699093826},{"type":"absolute","value":1699093571},{"type":"absolute","value":1699093954},{"type":"absolute","value":1699094216},{"type":"absolute","value":1699093833},{"type":"absolute","value":1699093961},{"type":"absolute","value":1699093836},{"type":"absolute","value":1699094223},{"type":"absolute","value":1699094226},{"type":"absolute","value":1699093846},{"type":"absolute","value":1699093722},{"type":"absolute","value":1699094236},{"type":"absolute","value":1699093853},{"type":"absolute","value":1699094112},{"type":"absolute","value":1699094243},{"type":"absolute","value":1699093732},{"type":"absolute","value":1699094122},{"type":"absolute","value":1699093739},{"type":"absolute","value":1699093742},{"type":"absolute","value":1699094129},{"type":"absolute","value":1699094132},{"type":"absolute","value":1699093752},{"type":"absolute","value":1699093628},{"type":"absolute","value":1699094142},{"type":"absolute","value":1699093759}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699094912},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699094912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699096327},{"type":"absolute","value":1699096077},{"type":"absolute","value":1699096590},{"type":"absolute","value":1699096846},{"type":"absolute","value":1699096085},{"type":"absolute","value":1699096343},{"type":"absolute","value":1699095064},{"type":"absolute","value":1699096601},{"type":"absolute","value":1699096346},{"type":"absolute","value":1699096857},{"type":"absolute","value":1699096604},{"type":"absolute","value":1699096611},{"type":"absolute","value":1699096870},{"type":"absolute","value":1699095080},{"type":"absolute","value":1699096878},{"type":"absolute","value":1699095088},{"type":"absolute","value":1699095344},{"type":"absolute","value":1699096628},{"type":"absolute","value":1699095611},{"type":"absolute","value":1699096636},{"type":"absolute","value":1699095101},{"type":"absolute","value":1699096894},{"type":"absolute","value":1699095360},{"type":"absolute","value":1699096897},{"type":"absolute","value":1699095363},{"type":"absolute","value":1699095371},{"type":"absolute","value":1699095116},{"type":"absolute","value":1699095627},{"type":"absolute","value":1699095119},{"type":"absolute","value":1699095635},{"type":"absolute","value":1699095891},{"type":"absolute","value":1699095387},{"type":"absolute","value":1699096158},{"type":"absolute","value":1699095648},{"type":"absolute","value":1699095395},{"type":"absolute","value":1699095907},{"type":"absolute","value":1699095910},{"type":"absolute","value":1699095918},{"type":"absolute","value":1699095663},{"type":"absolute","value":1699096174},{"type":"absolute","value":1699095666},{"type":"absolute","value":1699096182},{"type":"absolute","value":1699096438},{"type":"absolute","value":1699095934},{"type":"absolute","value":1699096195},{"type":"absolute","value":1699096709},{"type":"absolute","value":1699095942},{"type":"absolute","value":1699096454},{"type":"absolute","value":1699096457},{"type":"absolute","value":1699096465},{"type":"absolute","value":1699096210},{"type":"absolute","value":1699096213},{"type":"absolute","value":1699096725},{"type":"absolute","value":1699096733},{"type":"absolute","value":1699096989},{"type":"absolute","value":1699094945},{"type":"absolute","value":1699095201},{"type":"absolute","value":1699096481},{"type":"absolute","value":1699096489},{"type":"absolute","value":1699096746},{"type":"absolute","value":1699094956},{"type":"absolute","value":1699095212},{"type":"absolute","value":1699097005},{"type":"absolute","value":1699094959},{"type":"absolute","value":1699097008},{"type":"absolute","value":1699094966},{"type":"absolute","value":1699097016},{"type":"absolute","value":1699095225},{"type":"absolute","value":1699096761},{"type":"absolute","value":1699096764},{"type":"absolute","value":1699095233},{"type":"absolute","value":1699095492},{"type":"absolute","value":1699095748},{"type":"absolute","value":1699094983},{"type":"absolute","value":1699097032},{"type":"absolute","value":1699094991},{"type":"absolute","value":1699095503},{"type":"absolute","value":1699095249},{"type":"absolute","value":1699095506},{"type":"absolute","value":1699095759},{"type":"absolute","value":1699095252},{"type":"absolute","value":1699097040},{"type":"absolute","value":1699095513},{"type":"absolute","value":1699095772},{"type":"absolute","value":1699095780},{"type":"absolute","value":1699096039},{"type":"absolute","value":1699096295},{"type":"absolute","value":1699095530},{"type":"absolute","value":1699095538},{"type":"absolute","value":1699096050},{"type":"absolute","value":1699095796},{"type":"absolute","value":1699096053},{"type":"absolute","value":1699096306},{"type":"absolute","value":1699095799},{"type":"absolute","value":1699096060},{"type":"absolute","value":1699096319}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699097121},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699097121}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699097857},{"type":"absolute","value":1699097476},{"type":"absolute","value":1699097354},{"type":"absolute","value":1699097484},{"type":"absolute","value":1699097868},{"type":"absolute","value":1699097362},{"type":"absolute","value":1699097876},{"type":"absolute","value":1699097365},{"type":"absolute","value":1699097879},{"type":"absolute","value":1699097243},{"type":"absolute","value":1699097757},{"type":"absolute","value":1699097376},{"type":"absolute","value":1699097890},{"type":"absolute","value":1699097254},{"type":"absolute","value":1699097384},{"type":"absolute","value":1699097768},{"type":"absolute","value":1699097898},{"type":"absolute","value":1699097262},{"type":"absolute","value":1699097776},{"type":"absolute","value":1699097265},{"type":"absolute","value":1699097779},{"type":"absolute","value":1699097143},{"type":"absolute","value":1699097657},{"type":"absolute","value":1699097276},{"type":"absolute","value":1699097790},{"type":"absolute","value":1699097154},{"type":"absolute","value":1699097284},{"type":"absolute","value":1699097668},{"type":"absolute","value":1699097798},{"type":"absolute","value":1699097162},{"type":"absolute","value":1699097676},{"type":"absolute","value":1699097165},{"type":"absolute","value":1699097679},{"type":"absolute","value":1699097557},{"type":"absolute","value":1699097176},{"type":"absolute","value":1699097690},{"type":"absolute","value":1699097184},{"type":"absolute","value":1699097568},{"type":"absolute","value":1699097698},{"type":"absolute","value":1699097443},{"type":"absolute","value":1699097576},{"type":"absolute","value":1699097579},{"type":"absolute","value":1699097454},{"type":"absolute","value":1699097462},{"type":"absolute","value":1699097590},{"type":"absolute","value":1699097465},{"type":"absolute","value":1699097598},{"type":"absolute","value":1699097343}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699098592},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699098592}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699099907},{"type":"absolute","value":1699100427},{"type":"absolute","value":1699098638},{"type":"absolute","value":1699100430},{"type":"absolute","value":1699099920},{"type":"absolute","value":1699098641},{"type":"absolute","value":1699100176},{"type":"absolute","value":1699100179},{"type":"absolute","value":1699099668},{"type":"absolute","value":1699099927},{"type":"absolute","value":1699100439},{"type":"absolute","value":1699098905},{"type":"absolute","value":1699100695},{"type":"absolute","value":1699100698},{"type":"absolute","value":1699098657},{"type":"absolute","value":1699098914},{"type":"absolute","value":1699100199},{"type":"absolute","value":1699100461},{"type":"absolute","value":1699100724},{"type":"absolute","value":1699098677},{"type":"absolute","value":1699099191},{"type":"absolute","value":1699100727},{"type":"absolute","value":1699099194},{"type":"absolute","value":1699100474},{"type":"absolute","value":1699100220},{"type":"absolute","value":1699098941},{"type":"absolute","value":1699098686},{"type":"absolute","value":1699099456},{"type":"absolute","value":1699100481},{"type":"absolute","value":1699098694},{"type":"absolute","value":1699099465},{"type":"absolute","value":1699098954},{"type":"absolute","value":1699099210},{"type":"absolute","value":1699100747},{"type":"absolute","value":1699098962},{"type":"absolute","value":1699099738},{"type":"absolute","value":1699099741},{"type":"absolute","value":1699099231},{"type":"absolute","value":1699098976},{"type":"absolute","value":1699100768},{"type":"absolute","value":1699099492},{"type":"absolute","value":1699100005},{"type":"absolute","value":1699099240},{"type":"absolute","value":1699099757},{"type":"absolute","value":1699100014},{"type":"absolute","value":1699099248},{"type":"absolute","value":1699099505},{"type":"absolute","value":1699099513},{"type":"absolute","value":1699099777},{"type":"absolute","value":1699100291},{"type":"absolute","value":1699100294},{"type":"absolute","value":1699099527},{"type":"absolute","value":1699100041},{"type":"absolute","value":1699099786},{"type":"absolute","value":1699100556},{"type":"absolute","value":1699099794},{"type":"absolute","value":1699098773},{"type":"absolute","value":1699100054},{"type":"absolute","value":1699100310},{"type":"absolute","value":1699098776},{"type":"absolute","value":1699100565},{"type":"absolute","value":1699100062},{"type":"absolute","value":1699098785},{"type":"absolute","value":1699099046},{"type":"absolute","value":1699099049},{"type":"absolute","value":1699100331},{"type":"absolute","value":1699100076},{"type":"absolute","value":1699100592},{"type":"absolute","value":1699100340},{"type":"absolute","value":1699098807},{"type":"absolute","value":1699100348},{"type":"absolute","value":1699100605},{"type":"absolute","value":1699099327},{"type":"absolute","value":1699099330},{"type":"absolute","value":1699098820},{"type":"absolute","value":1699099076},{"type":"absolute","value":1699100613},{"type":"absolute","value":1699099079},{"type":"absolute","value":1699098827},{"type":"absolute","value":1699099339},{"type":"absolute","value":1699099595},{"type":"absolute","value":1699099598},{"type":"absolute","value":1699100627},{"type":"absolute","value":1699099099},{"type":"absolute","value":1699099361},{"type":"absolute","value":1699099873},{"type":"absolute","value":1699099876},{"type":"absolute","value":1699099624},{"type":"absolute","value":1699099627},{"type":"absolute","value":1699099885},{"type":"absolute","value":1699099374},{"type":"absolute","value":1699099120},{"type":"absolute","value":1699100146},{"type":"absolute","value":1699099381},{"type":"absolute","value":1699100149},{"type":"absolute","value":1699099647}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699100810},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699100810}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699101056},{"type":"absolute","value":1699101184},{"type":"absolute","value":1699100930},{"type":"absolute","value":1699101440},{"type":"absolute","value":1699101443},{"type":"absolute","value":1699100933},{"type":"absolute","value":1699101574},{"type":"absolute","value":1699101068},{"type":"absolute","value":1699101457},{"type":"absolute","value":1699100948},{"type":"absolute","value":1699101590},{"type":"absolute","value":1699101466},{"type":"absolute","value":1699101084},{"type":"absolute","value":1699100957},{"type":"absolute","value":1699101341},{"type":"absolute","value":1699101344},{"type":"absolute","value":1699100836},{"type":"absolute","value":1699101477},{"type":"absolute","value":1699100839},{"type":"absolute","value":1699100969},{"type":"absolute","value":1699101359},{"type":"absolute","value":1699100851},{"type":"absolute","value":1699101492},{"type":"absolute","value":1699101368},{"type":"absolute","value":1699100985},{"type":"absolute","value":1699100860},{"type":"absolute","value":1699101244},{"type":"absolute","value":1699101247},{"type":"absolute","value":1699101380},{"type":"absolute","value":1699100871},{"type":"absolute","value":1699101129},{"type":"absolute","value":1699101259},{"type":"absolute","value":1699101132},{"type":"absolute","value":1699101268},{"type":"absolute","value":1699101396},{"type":"absolute","value":1699100886},{"type":"absolute","value":1699101147},{"type":"absolute","value":1699101279},{"type":"absolute","value":1699101537},{"type":"absolute","value":1699101156},{"type":"absolute","value":1699101029},{"type":"absolute","value":1699101540},{"type":"absolute","value":1699101032},{"type":"absolute","value":1699101168},{"type":"absolute","value":1699101296},{"type":"absolute","value":1699101554},{"type":"absolute","value":1699101047},{"type":"absolute","value":1699101563}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699101744},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699101744}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699102080},{"type":"absolute","value":1699101953},{"type":"absolute","value":1699102208},{"type":"absolute","value":1699102466},{"type":"absolute","value":1699101956},{"type":"absolute","value":1699102475},{"type":"absolute","value":1699102092},{"type":"absolute","value":1699102352},{"type":"absolute","value":1699101971},{"type":"absolute","value":1699102355},{"type":"absolute","value":1699102486},{"type":"absolute","value":1699101980},{"type":"absolute","value":1699102108},{"type":"absolute","value":1699101854},{"type":"absolute","value":1699101857},{"type":"absolute","value":1699102369},{"type":"absolute","value":1699102502},{"type":"absolute","value":1699101992},{"type":"absolute","value":1699102378},{"type":"absolute","value":1699102253},{"type":"absolute","value":1699101872},{"type":"absolute","value":1699102256},{"type":"absolute","value":1699102389},{"type":"absolute","value":1699102008},{"type":"absolute","value":1699101881},{"type":"absolute","value":1699102271},{"type":"absolute","value":1699101759},{"type":"absolute","value":1699101762},{"type":"absolute","value":1699102404},{"type":"absolute","value":1699101893},{"type":"absolute","value":1699102280},{"type":"absolute","value":1699102156},{"type":"absolute","value":1699101774},{"type":"absolute","value":1699102159},{"type":"absolute","value":1699102292},{"type":"absolute","value":1699101909},{"type":"absolute","value":1699101783},{"type":"absolute","value":1699102171},{"type":"absolute","value":1699101794},{"type":"absolute","value":1699102180},{"type":"absolute","value":1699102053},{"type":"absolute","value":1699102308},{"type":"absolute","value":1699102056},{"type":"absolute","value":1699102191},{"type":"absolute","value":1699102449},{"type":"absolute","value":1699101810},{"type":"absolute","value":1699102452},{"type":"absolute","value":1699102071}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699112075},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699112075}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699125248},{"type":"absolute","value":1699123201},{"type":"absolute","value":1699119109},{"type":"absolute","value":1699121162},{"type":"absolute","value":1699125258},{"type":"absolute","value":1699115020},{"type":"absolute","value":1699112974},{"type":"absolute","value":1699117071},{"type":"absolute","value":1699119121},{"type":"absolute","value":1699115026},{"type":"absolute","value":1699117081},{"type":"absolute","value":1699123229},{"type":"absolute","value":1699121182},{"type":"absolute","value":1699125278},{"type":"absolute","value":1699123232},{"type":"absolute","value":1699112993},{"type":"absolute","value":1699115042},{"type":"absolute","value":1699119139},{"type":"absolute","value":1699115045},{"type":"absolute","value":1699123240},{"type":"absolute","value":1699125288},{"type":"absolute","value":1699113002},{"type":"absolute","value":1699119146},{"type":"absolute","value":1699123243},{"type":"absolute","value":1699119149},{"type":"absolute","value":1699125291},{"type":"absolute","value":1699113012},{"type":"absolute","value":1699117109},{"type":"absolute","value":1699117112},{"type":"absolute","value":1699115066},{"type":"absolute","value":1699125306},{"type":"absolute","value":1699113022},{"type":"absolute","value":1699119167},{"type":"absolute","value":1699117120},{"type":"absolute","value":1699117123},{"type":"absolute","value":1699123270},{"type":"absolute","value":1699121228},{"type":"absolute","value":1699123276},{"type":"absolute","value":1699115086},{"type":"absolute","value":1699119182},{"type":"absolute","value":1699125325},{"type":"absolute","value":1699119186},{"type":"absolute","value":1699121238},{"type":"absolute","value":1699125334},{"type":"absolute","value":1699119193},{"type":"absolute","value":1699119197},{"type":"absolute","value":1699117150},{"type":"absolute","value":1699123295},{"type":"absolute","value":1699125344},{"type":"absolute","value":1699123298},{"type":"absolute","value":1699117156},{"type":"absolute","value":1699113061},{"type":"absolute","value":1699125354},{"type":"absolute","value":1699113071},{"type":"absolute","value":1699113074},{"type":"absolute","value":1699121269},{"type":"absolute","value":1699117175},{"type":"absolute","value":1699117178},{"type":"absolute","value":1699123322},{"type":"absolute","value":1699115132},{"type":"absolute","value":1699119231},{"type":"absolute","value":1699113089},{"type":"absolute","value":1699121281},{"type":"absolute","value":1699115142},{"type":"absolute","value":1699119241},{"type":"absolute","value":1699123342},{"type":"absolute","value":1699117202},{"type":"absolute","value":1699121299},{"type":"absolute","value":1699113108},{"type":"absolute","value":1699121306},{"type":"absolute","value":1699113117},{"type":"absolute","value":1699121309},{"type":"absolute","value":1699115170},{"type":"absolute","value":1699119269},{"type":"absolute","value":1699117222},{"type":"absolute","value":1699113127},{"type":"absolute","value":1699119272},{"type":"absolute","value":1699115182},{"type":"absolute","value":1699121327},{"type":"absolute","value":1699119280},{"type":"absolute","value":1699113137},{"type":"absolute","value":1699119283},{"type":"absolute","value":1699123388},{"type":"absolute","value":1699121342},{"type":"absolute","value":1699115200},{"type":"absolute","value":1699121346},{"type":"absolute","value":1699123398},{"type":"absolute","value":1699115207},{"type":"absolute","value":1699121353},{"type":"absolute","value":1699115210},{"type":"absolute","value":1699121357},{"type":"absolute","value":1699119310},{"type":"absolute","value":1699113171},{"type":"absolute","value":1699117268},{"type":"absolute","value":1699119316},{"type":"absolute","value":1699115228},{"type":"absolute","value":1699113181},{"type":"absolute","value":1699117278},{"type":"absolute","value":1699113184},{"type":"absolute","value":1699123429},{"type":"absolute","value":1699119335},{"type":"absolute","value":1699119338},{"type":"absolute","value":1699115243},{"type":"absolute","value":1699113199},{"type":"absolute","value":1699115247},{"type":"absolute","value":1699121391},{"type":"absolute","value":1699123441},{"type":"absolute","value":1699115254},{"type":"absolute","value":1699121401},{"type":"absolute","value":1699115258},{"type":"absolute","value":1699117309},{"type":"absolute","value":1699113218},{"type":"absolute","value":1699119362},{"type":"absolute","value":1699123459},{"type":"absolute","value":1699117321},{"type":"absolute","value":1699123466},{"type":"absolute","value":1699113227},{"type":"absolute","value":1699123469},{"type":"absolute","value":1699113237},{"type":"absolute","value":1699119382},{"type":"absolute","value":1699121429},{"type":"absolute","value":1699121432},{"type":"absolute","value":1699117339},{"type":"absolute","value":1699115292},{"type":"absolute","value":1699113247},{"type":"absolute","value":1699121440},{"type":"absolute","value":1699123487},{"type":"absolute","value":1699117346},{"type":"absolute","value":1699121443},{"type":"absolute","value":1699117349},{"type":"absolute","value":1699115302},{"type":"absolute","value":1699123502},{"type":"absolute","value":1699123506},{"type":"absolute","value":1699117367},{"type":"absolute","value":1699123513},{"type":"absolute","value":1699123517},{"type":"absolute","value":1699121470},{"type":"absolute","value":1699115330},{"type":"absolute","value":1699119428},{"type":"absolute","value":1699115333},{"type":"absolute","value":1699113286},{"type":"absolute","value":1699117382},{"type":"absolute","value":1699121476},{"type":"absolute","value":1699117386},{"type":"absolute","value":1699115341},{"type":"absolute","value":1699119438},{"type":"absolute","value":1699113296},{"type":"absolute","value":1699115344},{"type":"absolute","value":1699117393},{"type":"absolute","value":1699113299},{"type":"absolute","value":1699117397},{"type":"absolute","value":1699121495},{"type":"absolute","value":1699121498},{"type":"absolute","value":1699123551},{"type":"absolute","value":1699113314},{"type":"absolute","value":1699123561},{"type":"absolute","value":1699115371},{"type":"absolute","value":1699119469},{"type":"absolute","value":1699115377},{"type":"absolute","value":1699121522},{"type":"absolute","value":1699113333},{"type":"absolute","value":1699117431},{"type":"absolute","value":1699119481},{"type":"absolute","value":1699113342},{"type":"absolute","value":1699117441},{"type":"absolute","value":1699115396},{"type":"absolute","value":1699123589},{"type":"absolute","value":1699121542},{"type":"absolute","value":1699115399},{"type":"absolute","value":1699113352},{"type":"absolute","value":1699123592},{"type":"absolute","value":1699119499},{"type":"absolute","value":1699123600},{"type":"absolute","value":1699113362},{"type":"absolute","value":1699119506},{"type":"absolute","value":1699123603},{"type":"absolute","value":1699119509},{"type":"absolute","value":1699115420},{"type":"absolute","value":1699117469},{"type":"absolute","value":1699117472},{"type":"absolute","value":1699119527},{"type":"absolute","value":1699117480},{"type":"absolute","value":1699117483},{"type":"absolute","value":1699123630},{"type":"absolute","value":1699115440},{"type":"absolute","value":1699113396},{"type":"absolute","value":1699121588},{"type":"absolute","value":1699119542},{"type":"absolute","value":1699123636},{"type":"absolute","value":1699119546},{"type":"absolute","value":1699113406},{"type":"absolute","value":1699121598},{"type":"absolute","value":1699113409},{"type":"absolute","value":1699119553},{"type":"absolute","value":1699119557},{"type":"absolute","value":1699117510},{"type":"absolute","value":1699123655},{"type":"absolute","value":1699123658},{"type":"absolute","value":1699117516},{"type":"absolute","value":1699113424},{"type":"absolute","value":1699121629},{"type":"absolute","value":1699115486},{"type":"absolute","value":1699117535},{"type":"absolute","value":1699117538},{"type":"absolute","value":1699113443},{"type":"absolute","value":1699123682},{"type":"absolute","value":1699119591},{"type":"absolute","value":1699115496},{"type":"absolute","value":1699121641},{"type":"absolute","value":1699113452},{"type":"absolute","value":1699119601},{"type":"absolute","value":1699113462},{"type":"absolute","value":1699123702},{"type":"absolute","value":1699117562},{"type":"absolute","value":1699121659},{"type":"absolute","value":1699113472},{"type":"absolute","value":1699121666},{"type":"absolute","value":1699115524},{"type":"absolute","value":1699121669},{"type":"absolute","value":1699119629},{"type":"absolute","value":1699117582},{"type":"absolute","value":1699115536},{"type":"absolute","value":1699119632},{"type":"absolute","value":1699121687},{"type":"absolute","value":1699119640},{"type":"absolute","value":1699119643},{"type":"absolute","value":1699115554},{"type":"absolute","value":1699123748},{"type":"absolute","value":1699121702},{"type":"absolute","value":1699113511},{"type":"absolute","value":1699115561},{"type":"absolute","value":1699121706},{"type":"absolute","value":1699115564},{"type":"absolute","value":1699123758},{"type":"absolute","value":1699113521},{"type":"absolute","value":1699121713},{"type":"absolute","value":1699113524},{"type":"absolute","value":1699121717},{"type":"absolute","value":1699119670},{"type":"absolute","value":1699117628},{"type":"absolute","value":1699119676},{"type":"absolute","value":1699115582},{"type":"absolute","value":1699113539},{"type":"absolute","value":1699117638},{"type":"absolute","value":1699115597},{"type":"absolute","value":1699123789},{"type":"absolute","value":1699119695},{"type":"absolute","value":1699115601},{"type":"absolute","value":1699119698},{"type":"absolute","value":1699113558},{"type":"absolute","value":1699121751},{"type":"absolute","value":1699115608},{"type":"absolute","value":1699123801},{"type":"absolute","value":1699115612},{"type":"absolute","value":1699113567},{"type":"absolute","value":1699121761},{"type":"absolute","value":1699117669},{"type":"absolute","value":1699113577},{"type":"absolute","value":1699119722},{"type":"absolute","value":1699123819},{"type":"absolute","value":1699117681},{"type":"absolute","value":1699123826},{"type":"absolute","value":1699113587},{"type":"absolute","value":1699123829},{"type":"absolute","value":1699121789},{"type":"absolute","value":1699115646},{"type":"absolute","value":1699119742},{"type":"absolute","value":1699121792},{"type":"absolute","value":1699117699},{"type":"absolute","value":1699123847},{"type":"absolute","value":1699115656},{"type":"absolute","value":1699121800},{"type":"absolute","value":1699117706},{"type":"absolute","value":1699121803},{"type":"absolute","value":1699117709},{"type":"absolute","value":1699113621},{"type":"absolute","value":1699123862},{"type":"absolute","value":1699123866},{"type":"absolute","value":1699113631},{"type":"absolute","value":1699117727},{"type":"absolute","value":1699123873},{"type":"absolute","value":1699113634},{"type":"absolute","value":1699115684},{"type":"absolute","value":1699123877},{"type":"absolute","value":1699121830},{"type":"absolute","value":1699115687},{"type":"absolute","value":1699119788},{"type":"absolute","value":1699121836},{"type":"absolute","value":1699117742},{"type":"absolute","value":1699115695},{"type":"absolute","value":1699113649},{"type":"absolute","value":1699115698},{"type":"absolute","value":1699117746},{"type":"absolute","value":1699119798},{"type":"absolute","value":1699117753},{"type":"absolute","value":1699117757},{"type":"absolute","value":1699121855},{"type":"absolute","value":1699121858},{"type":"absolute","value":1699113668},{"type":"absolute","value":1699123911},{"type":"absolute","value":1699113677},{"type":"absolute","value":1699115725},{"type":"absolute","value":1699123921},{"type":"absolute","value":1699115731},{"type":"absolute","value":1699119829},{"type":"absolute","value":1699113687},{"type":"absolute","value":1699121882},{"type":"absolute","value":1699117791},{"type":"absolute","value":1699113697},{"type":"absolute","value":1699119841},{"type":"absolute","value":1699115750},{"type":"absolute","value":1699115753},{"type":"absolute","value":1699117801},{"type":"absolute","value":1699123949},{"type":"absolute","value":1699121902},{"type":"absolute","value":1699123952},{"type":"absolute","value":1699119859},{"type":"absolute","value":1699123960},{"type":"absolute","value":1699119866},{"type":"absolute","value":1699123963},{"type":"absolute","value":1699119869},{"type":"absolute","value":1699115774},{"type":"absolute","value":1699113729},{"type":"absolute","value":1699117829},{"type":"absolute","value":1699117832},{"type":"absolute","value":1699113739},{"type":"absolute","value":1699119887},{"type":"absolute","value":1699117840},{"type":"absolute","value":1699115794},{"type":"absolute","value":1699117843},{"type":"absolute","value":1699123990},{"type":"absolute","value":1699121948},{"type":"absolute","value":1699123996},{"type":"absolute","value":1699119902},{"type":"absolute","value":1699119906},{"type":"absolute","value":1699121958},{"type":"absolute","value":1699113767},{"type":"absolute","value":1699119913},{"type":"absolute","value":1699119917},{"type":"absolute","value":1699117870},{"type":"absolute","value":1699124015},{"type":"absolute","value":1699124018},{"type":"absolute","value":1699113779},{"type":"absolute","value":1699117876},{"type":"absolute","value":1699115840},{"type":"absolute","value":1699113797},{"type":"absolute","value":1699121989},{"type":"absolute","value":1699117895},{"type":"absolute","value":1699115850},{"type":"absolute","value":1699117898},{"type":"absolute","value":1699113804},{"type":"absolute","value":1699124042},{"type":"absolute","value":1699113807},{"type":"absolute","value":1699119951},{"type":"absolute","value":1699122001},{"type":"absolute","value":1699119961},{"type":"absolute","value":1699124062},{"type":"absolute","value":1699113825},{"type":"absolute","value":1699117922},{"type":"absolute","value":1699122019},{"type":"absolute","value":1699115878},{"type":"absolute","value":1699122026},{"type":"absolute","value":1699122029},{"type":"absolute","value":1699113840},{"type":"absolute","value":1699115890},{"type":"absolute","value":1699113844},{"type":"absolute","value":1699119989},{"type":"absolute","value":1699117942},{"type":"absolute","value":1699119992},{"type":"absolute","value":1699113851},{"type":"absolute","value":1699113855},{"type":"absolute","value":1699120000},{"type":"absolute","value":1699122047},{"type":"absolute","value":1699120003},{"type":"absolute","value":1699115908},{"type":"absolute","value":1699115915},{"type":"absolute","value":1699124108},{"type":"absolute","value":1699115918},{"type":"absolute","value":1699122062},{"type":"absolute","value":1699122066},{"type":"absolute","value":1699124118},{"type":"absolute","value":1699122073},{"type":"absolute","value":1699122077},{"type":"absolute","value":1699120030},{"type":"absolute","value":1699115936},{"type":"absolute","value":1699113889},{"type":"absolute","value":1699117988},{"type":"absolute","value":1699120036},{"type":"absolute","value":1699113899},{"type":"absolute","value":1699117998},{"type":"absolute","value":1699115951},{"type":"absolute","value":1699115955},{"type":"absolute","value":1699124149},{"type":"absolute","value":1699120055},{"type":"absolute","value":1699115962},{"type":"absolute","value":1699120058},{"type":"absolute","value":1699115966},{"type":"absolute","value":1699122111},{"type":"absolute","value":1699124161},{"type":"absolute","value":1699113927},{"type":"absolute","value":1699122121},{"type":"absolute","value":1699113930},{"type":"absolute","value":1699118029},{"type":"absolute","value":1699113938},{"type":"absolute","value":1699120082},{"type":"absolute","value":1699124179},{"type":"absolute","value":1699113941},{"type":"absolute","value":1699118041},{"type":"absolute","value":1699124186},{"type":"absolute","value":1699124189},{"type":"absolute","value":1699116000},{"type":"absolute","value":1699122149},{"type":"absolute","value":1699120102},{"type":"absolute","value":1699122152},{"type":"absolute","value":1699116010},{"type":"absolute","value":1699118059},{"type":"absolute","value":1699124207},{"type":"absolute","value":1699113968},{"type":"absolute","value":1699122160},{"type":"absolute","value":1699118066},{"type":"absolute","value":1699122163},{"type":"absolute","value":1699118069},{"type":"absolute","value":1699113974},{"type":"absolute","value":1699124222},{"type":"absolute","value":1699124226},{"type":"absolute","value":1699113990},{"type":"absolute","value":1699116038},{"type":"absolute","value":1699118087},{"type":"absolute","value":1699113993},{"type":"absolute","value":1699116041},{"type":"absolute","value":1699124233},{"type":"absolute","value":1699124237},{"type":"absolute","value":1699122190},{"type":"absolute","value":1699116049},{"type":"absolute","value":1699116052},{"type":"absolute","value":1699120148},{"type":"absolute","value":1699118102},{"type":"absolute","value":1699122196},{"type":"absolute","value":1699118106},{"type":"absolute","value":1699114013},{"type":"absolute","value":1699120158},{"type":"absolute","value":1699118113},{"type":"absolute","value":1699118117},{"type":"absolute","value":1699122215},{"type":"absolute","value":1699122218},{"type":"absolute","value":1699116079},{"type":"absolute","value":1699124271},{"type":"absolute","value":1699114033},{"type":"absolute","value":1699116085},{"type":"absolute","value":1699124281},{"type":"absolute","value":1699120189},{"type":"absolute","value":1699122242},{"type":"absolute","value":1699118151},{"type":"absolute","value":1699116104},{"type":"absolute","value":1699120201},{"type":"absolute","value":1699116107},{"type":"absolute","value":1699118161},{"type":"absolute","value":1699124309},{"type":"absolute","value":1699122262},{"type":"absolute","value":1699124312},{"type":"absolute","value":1699120219},{"type":"absolute","value":1699114079},{"type":"absolute","value":1699116128},{"type":"absolute","value":1699124320},{"type":"absolute","value":1699120226},{"type":"absolute","value":1699124323},{"type":"absolute","value":1699120229},{"type":"absolute","value":1699114089},{"type":"absolute","value":1699118189},{"type":"absolute","value":1699118192},{"type":"absolute","value":1699116148},{"type":"absolute","value":1699120247},{"type":"absolute","value":1699118200},{"type":"absolute","value":1699118203},{"type":"absolute","value":1699124350},{"type":"absolute","value":1699122308},{"type":"absolute","value":1699114117},{"type":"absolute","value":1699120262},{"type":"absolute","value":1699124356},{"type":"absolute","value":1699120266},{"type":"absolute","value":1699122318},{"type":"absolute","value":1699114129},{"type":"absolute","value":1699120273},{"type":"absolute","value":1699120277},{"type":"absolute","value":1699118230},{"type":"absolute","value":1699124375},{"type":"absolute","value":1699124378},{"type":"absolute","value":1699118236},{"type":"absolute","value":1699116194},{"type":"absolute","value":1699114147},{"type":"absolute","value":1699114154},{"type":"absolute","value":1699116204},{"type":"absolute","value":1699114157},{"type":"absolute","value":1699122349},{"type":"absolute","value":1699118255},{"type":"absolute","value":1699118258},{"type":"absolute","value":1699124402},{"type":"absolute","value":1699120311},{"type":"absolute","value":1699122361},{"type":"absolute","value":1699114175},{"type":"absolute","value":1699120321},{"type":"absolute","value":1699124422},{"type":"absolute","value":1699116232},{"type":"absolute","value":1699118282},{"type":"absolute","value":1699122379},{"type":"absolute","value":1699114190},{"type":"absolute","value":1699114194},{"type":"absolute","value":1699122386},{"type":"absolute","value":1699116244},{"type":"absolute","value":1699122389},{"type":"absolute","value":1699114201},{"type":"absolute","value":1699114205},{"type":"absolute","value":1699118302},{"type":"absolute","value":1699120349},{"type":"absolute","value":1699120352},{"type":"absolute","value":1699112161},{"type":"absolute","value":1699116262},{"type":"absolute","value":1699122407},{"type":"absolute","value":1699120360},{"type":"absolute","value":1699112171},{"type":"absolute","value":1699120363},{"type":"absolute","value":1699116269},{"type":"absolute","value":1699112174},{"type":"absolute","value":1699116272},{"type":"absolute","value":1699124468},{"type":"absolute","value":1699122422},{"type":"absolute","value":1699122426},{"type":"absolute","value":1699112189},{"type":"absolute","value":1699124478},{"type":"absolute","value":1699114239},{"type":"absolute","value":1699122433},{"type":"absolute","value":1699116290},{"type":"absolute","value":1699122437},{"type":"absolute","value":1699120390},{"type":"absolute","value":1699114249},{"type":"absolute","value":1699118348},{"type":"absolute","value":1699120396},{"type":"absolute","value":1699112208},{"type":"absolute","value":1699116305},{"type":"absolute","value":1699116309},{"type":"absolute","value":1699118358},{"type":"absolute","value":1699112217},{"type":"absolute","value":1699116316},{"type":"absolute","value":1699124509},{"type":"absolute","value":1699120415},{"type":"absolute","value":1699116320},{"type":"absolute","value":1699120418},{"type":"absolute","value":1699112227},{"type":"absolute","value":1699114277},{"type":"absolute","value":1699122471},{"type":"absolute","value":1699114280},{"type":"absolute","value":1699124521},{"type":"absolute","value":1699112237},{"type":"absolute","value":1699114288},{"type":"absolute","value":1699122481},{"type":"absolute","value":1699114291},{"type":"absolute","value":1699118389},{"type":"absolute","value":1699120442},{"type":"absolute","value":1699124539},{"type":"absolute","value":1699118401},{"type":"absolute","value":1699116354},{"type":"absolute","value":1699124546},{"type":"absolute","value":1699124549},{"type":"absolute","value":1699116364},{"type":"absolute","value":1699122509},{"type":"absolute","value":1699114318},{"type":"absolute","value":1699112271},{"type":"absolute","value":1699120462},{"type":"absolute","value":1699122512},{"type":"absolute","value":1699118419},{"type":"absolute","value":1699114324},{"type":"absolute","value":1699124567},{"type":"absolute","value":1699122520},{"type":"absolute","value":1699112281},{"type":"absolute","value":1699118426},{"type":"absolute","value":1699122523},{"type":"absolute","value":1699112284},{"type":"absolute","value":1699118429},{"type":"absolute","value":1699114340},{"type":"absolute","value":1699124582},{"type":"absolute","value":1699114343},{"type":"absolute","value":1699116392},{"type":"absolute","value":1699124586},{"type":"absolute","value":1699112299},{"type":"absolute","value":1699116395},{"type":"absolute","value":1699118447},{"type":"absolute","value":1699124593},{"type":"absolute","value":1699116403},{"type":"absolute","value":1699124597},{"type":"absolute","value":1699116406},{"type":"absolute","value":1699122550},{"type":"absolute","value":1699114364},{"type":"absolute","value":1699120508},{"type":"absolute","value":1699112318},{"type":"absolute","value":1699118462},{"type":"absolute","value":1699122556},{"type":"absolute","value":1699118466},{"type":"absolute","value":1699120518},{"type":"absolute","value":1699112327},{"type":"absolute","value":1699118473},{"type":"absolute","value":1699118477},{"type":"absolute","value":1699122575},{"type":"absolute","value":1699114384},{"type":"absolute","value":1699112337},{"type":"absolute","value":1699116433},{"type":"absolute","value":1699122578},{"type":"absolute","value":1699116439},{"type":"absolute","value":1699124631},{"type":"absolute","value":1699112347},{"type":"absolute","value":1699124641},{"type":"absolute","value":1699120549},{"type":"absolute","value":1699116458},{"type":"absolute","value":1699122602},{"type":"absolute","value":1699116461},{"type":"absolute","value":1699118511},{"type":"absolute","value":1699120561},{"type":"absolute","value":1699118521},{"type":"absolute","value":1699124669},{"type":"absolute","value":1699114430},{"type":"absolute","value":1699122622},{"type":"absolute","value":1699124672},{"type":"absolute","value":1699112386},{"type":"absolute","value":1699116482},{"type":"absolute","value":1699120579},{"type":"absolute","value":1699114440},{"type":"absolute","value":1699124680},{"type":"absolute","value":1699120586},{"type":"absolute","value":1699124683},{"type":"absolute","value":1699112396},{"type":"absolute","value":1699120589},{"type":"absolute","value":1699112399},{"type":"absolute","value":1699118549},{"type":"absolute","value":1699116502},{"type":"absolute","value":1699118552},{"type":"absolute","value":1699112414},{"type":"absolute","value":1699120607},{"type":"absolute","value":1699118560},{"type":"absolute","value":1699118563},{"type":"absolute","value":1699114468},{"type":"absolute","value":1699124710},{"type":"absolute","value":1699122668},{"type":"absolute","value":1699124716},{"type":"absolute","value":1699120622},{"type":"absolute","value":1699114480},{"type":"absolute","value":1699112433},{"type":"absolute","value":1699120626},{"type":"absolute","value":1699122678},{"type":"absolute","value":1699120633},{"type":"absolute","value":1699112442},{"type":"absolute","value":1699120637},{"type":"absolute","value":1699118590},{"type":"absolute","value":1699124735},{"type":"absolute","value":1699114498},{"type":"absolute","value":1699124738},{"type":"absolute","value":1699112452},{"type":"absolute","value":1699116548},{"type":"absolute","value":1699118596},{"type":"absolute","value":1699114505},{"type":"absolute","value":1699114508},{"type":"absolute","value":1699112462},{"type":"absolute","value":1699116558},{"type":"absolute","value":1699122709},{"type":"absolute","value":1699118615},{"type":"absolute","value":1699118618},{"type":"absolute","value":1699124762},{"type":"absolute","value":1699114526},{"type":"absolute","value":1699120671},{"type":"absolute","value":1699122721},{"type":"absolute","value":1699120681},{"type":"absolute","value":1699114541},{"type":"absolute","value":1699116589},{"type":"absolute","value":1699124782},{"type":"absolute","value":1699112496},{"type":"absolute","value":1699114545},{"type":"absolute","value":1699118642},{"type":"absolute","value":1699122739},{"type":"absolute","value":1699114552},{"type":"absolute","value":1699116601},{"type":"absolute","value":1699112506},{"type":"absolute","value":1699122746},{"type":"absolute","value":1699114556},{"type":"absolute","value":1699112509},{"type":"absolute","value":1699122749},{"type":"absolute","value":1699120709},{"type":"absolute","value":1699118662},{"type":"absolute","value":1699120712},{"type":"absolute","value":1699116619},{"type":"absolute","value":1699112524},{"type":"absolute","value":1699122767},{"type":"absolute","value":1699120720},{"type":"absolute","value":1699116626},{"type":"absolute","value":1699120723},{"type":"absolute","value":1699116629},{"type":"absolute","value":1699124828},{"type":"absolute","value":1699114590},{"type":"absolute","value":1699112543},{"type":"absolute","value":1699122782},{"type":"absolute","value":1699122786},{"type":"absolute","value":1699124838},{"type":"absolute","value":1699116647},{"type":"absolute","value":1699112552},{"type":"absolute","value":1699114600},{"type":"absolute","value":1699122793},{"type":"absolute","value":1699122797},{"type":"absolute","value":1699120750},{"type":"absolute","value":1699112562},{"type":"absolute","value":1699118708},{"type":"absolute","value":1699120756},{"type":"absolute","value":1699116662},{"type":"absolute","value":1699116666},{"type":"absolute","value":1699112572},{"type":"absolute","value":1699118718},{"type":"absolute","value":1699116673},{"type":"absolute","value":1699114628},{"type":"absolute","value":1699116677},{"type":"absolute","value":1699124869},{"type":"absolute","value":1699114631},{"type":"absolute","value":1699120775},{"type":"absolute","value":1699120778},{"type":"absolute","value":1699114639},{"type":"absolute","value":1699122831},{"type":"absolute","value":1699124881},{"type":"absolute","value":1699114642},{"type":"absolute","value":1699122841},{"type":"absolute","value":1699118749},{"type":"absolute","value":1699120802},{"type":"absolute","value":1699112611},{"type":"absolute","value":1699124899},{"type":"absolute","value":1699116711},{"type":"absolute","value":1699118761},{"type":"absolute","value":1699124906},{"type":"absolute","value":1699112621},{"type":"absolute","value":1699114669},{"type":"absolute","value":1699124909},{"type":"absolute","value":1699112624},{"type":"absolute","value":1699116721},{"type":"absolute","value":1699114675},{"type":"absolute","value":1699122869},{"type":"absolute","value":1699120822},{"type":"absolute","value":1699122872},{"type":"absolute","value":1699118779},{"type":"absolute","value":1699112639},{"type":"absolute","value":1699122880},{"type":"absolute","value":1699124927},{"type":"absolute","value":1699118786},{"type":"absolute","value":1699114691},{"type":"absolute","value":1699122883},{"type":"absolute","value":1699118789},{"type":"absolute","value":1699114694},{"type":"absolute","value":1699116749},{"type":"absolute","value":1699124942},{"type":"absolute","value":1699116752},{"type":"absolute","value":1699112658},{"type":"absolute","value":1699124946},{"type":"absolute","value":1699118807},{"type":"absolute","value":1699116760},{"type":"absolute","value":1699124953},{"type":"absolute","value":1699112667},{"type":"absolute","value":1699114715},{"type":"absolute","value":1699116763},{"type":"absolute","value":1699122910},{"type":"absolute","value":1699124957},{"type":"absolute","value":1699120868},{"type":"absolute","value":1699112677},{"type":"absolute","value":1699118822},{"type":"absolute","value":1699122916},{"type":"absolute","value":1699118826},{"type":"absolute","value":1699120878},{"type":"absolute","value":1699112687},{"type":"absolute","value":1699114735},{"type":"absolute","value":1699118833},{"type":"absolute","value":1699118837},{"type":"absolute","value":1699116790},{"type":"absolute","value":1699122935},{"type":"absolute","value":1699122938},{"type":"absolute","value":1699116796},{"type":"absolute","value":1699124991},{"type":"absolute","value":1699125001},{"type":"absolute","value":1699120909},{"type":"absolute","value":1699116815},{"type":"absolute","value":1699112721},{"type":"absolute","value":1699116818},{"type":"absolute","value":1699122962},{"type":"absolute","value":1699118871},{"type":"absolute","value":1699120921},{"type":"absolute","value":1699112731},{"type":"absolute","value":1699114781},{"type":"absolute","value":1699112734},{"type":"absolute","value":1699118881},{"type":"absolute","value":1699125029},{"type":"absolute","value":1699122982},{"type":"absolute","value":1699114791},{"type":"absolute","value":1699125032},{"type":"absolute","value":1699116842},{"type":"absolute","value":1699120939},{"type":"absolute","value":1699112749},{"type":"absolute","value":1699125040},{"type":"absolute","value":1699120946},{"type":"absolute","value":1699125043},{"type":"absolute","value":1699120949},{"type":"absolute","value":1699118909},{"type":"absolute","value":1699116862},{"type":"absolute","value":1699112768},{"type":"absolute","value":1699118912},{"type":"absolute","value":1699114819},{"type":"absolute","value":1699120967},{"type":"absolute","value":1699118920},{"type":"absolute","value":1699112777},{"type":"absolute","value":1699118923},{"type":"absolute","value":1699125070},{"type":"absolute","value":1699114831},{"type":"absolute","value":1699112787},{"type":"absolute","value":1699123028},{"type":"absolute","value":1699125076},{"type":"absolute","value":1699120982},{"type":"absolute","value":1699120986},{"type":"absolute","value":1699112797},{"type":"absolute","value":1699123038},{"type":"absolute","value":1699114849},{"type":"absolute","value":1699120993},{"type":"absolute","value":1699120997},{"type":"absolute","value":1699118950},{"type":"absolute","value":1699125095},{"type":"absolute","value":1699114856},{"type":"absolute","value":1699125098},{"type":"absolute","value":1699114859},{"type":"absolute","value":1699116908},{"type":"absolute","value":1699118956},{"type":"absolute","value":1699116918},{"type":"absolute","value":1699114877},{"type":"absolute","value":1699123069},{"type":"absolute","value":1699118975},{"type":"absolute","value":1699118978},{"type":"absolute","value":1699125122},{"type":"absolute","value":1699112836},{"type":"absolute","value":1699121031},{"type":"absolute","value":1699123081},{"type":"absolute","value":1699114892},{"type":"absolute","value":1699112846},{"type":"absolute","value":1699114896},{"type":"absolute","value":1699112849},{"type":"absolute","value":1699121041},{"type":"absolute","value":1699116949},{"type":"absolute","value":1699125142},{"type":"absolute","value":1699114903},{"type":"absolute","value":1699119002},{"type":"absolute","value":1699114907},{"type":"absolute","value":1699123099},{"type":"absolute","value":1699112864},{"type":"absolute","value":1699116961},{"type":"absolute","value":1699123106},{"type":"absolute","value":1699123109},{"type":"absolute","value":1699121069},{"type":"absolute","value":1699119022},{"type":"absolute","value":1699121072},{"type":"absolute","value":1699112883},{"type":"absolute","value":1699116979},{"type":"absolute","value":1699123127},{"type":"absolute","value":1699121080},{"type":"absolute","value":1699116986},{"type":"absolute","value":1699121083},{"type":"absolute","value":1699112892},{"type":"absolute","value":1699114941},{"type":"absolute","value":1699116989},{"type":"absolute","value":1699125182},{"type":"absolute","value":1699112902},{"type":"absolute","value":1699114951},{"type":"absolute","value":1699123142},{"type":"absolute","value":1699125192},{"type":"absolute","value":1699123146},{"type":"absolute","value":1699125195},{"type":"absolute","value":1699117007},{"type":"absolute","value":1699112912},{"type":"absolute","value":1699123153},{"type":"absolute","value":1699123157},{"type":"absolute","value":1699121110},{"type":"absolute","value":1699125210},{"type":"absolute","value":1699119068},{"type":"absolute","value":1699121116},{"type":"absolute","value":1699117022},{"type":"absolute","value":1699117026},{"type":"absolute","value":1699114979},{"type":"absolute","value":1699114982},{"type":"absolute","value":1699119078},{"type":"absolute","value":1699117033},{"type":"absolute","value":1699117037},{"type":"absolute","value":1699114990},{"type":"absolute","value":1699121135},{"type":"absolute","value":1699125229},{"type":"absolute","value":1699114993},{"type":"absolute","value":1699112946},{"type":"absolute","value":1699121138},{"type":"absolute","value":1699125238},{"type":"absolute","value":1699123191},{"type":"absolute","value":1699112956},{"type":"absolute","value":1699112959}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699126222},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699126222}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699135488},{"type":"absolute","value":1699137538},{"type":"absolute","value":1699127306},{"type":"absolute","value":1699133458},{"type":"absolute","value":1699127315},{"type":"absolute","value":1699131421},{"type":"absolute","value":1699127326},{"type":"absolute","value":1699129374},{"type":"absolute","value":1699135517},{"type":"absolute","value":1699131430},{"type":"absolute","value":1699127337},{"type":"absolute","value":1699129390},{"type":"absolute","value":1699133487},{"type":"absolute","value":1699135535},{"type":"absolute","value":1699131441},{"type":"absolute","value":1699133490},{"type":"absolute","value":1699137587},{"type":"absolute","value":1699129397},{"type":"absolute","value":1699131452},{"type":"absolute","value":1699137603},{"type":"absolute","value":1699135556},{"type":"absolute","value":1699137610},{"type":"absolute","value":1699127372},{"type":"absolute","value":1699129423},{"type":"absolute","value":1699133519},{"type":"absolute","value":1699135567},{"type":"absolute","value":1699127383},{"type":"absolute","value":1699127386},{"type":"absolute","value":1699137636},{"type":"absolute","value":1699127402},{"type":"absolute","value":1699129452},{"type":"absolute","value":1699131501},{"type":"absolute","value":1699135606},{"type":"absolute","value":1699131517},{"type":"absolute","value":1699127422},{"type":"absolute","value":1699129470},{"type":"absolute","value":1699133569},{"type":"absolute","value":1699137665},{"type":"absolute","value":1699131524},{"type":"absolute","value":1699127431},{"type":"absolute","value":1699133578},{"type":"absolute","value":1699127442},{"type":"absolute","value":1699129491},{"type":"absolute","value":1699135635},{"type":"absolute","value":1699133589},{"type":"absolute","value":1699135638},{"type":"absolute","value":1699137683},{"type":"absolute","value":1699127453},{"type":"absolute","value":1699129502},{"type":"absolute","value":1699131550},{"type":"absolute","value":1699133600},{"type":"absolute","value":1699137704},{"type":"absolute","value":1699135667},{"type":"absolute","value":1699137715},{"type":"absolute","value":1699131579},{"type":"absolute","value":1699127493},{"type":"absolute","value":1699129541},{"type":"absolute","value":1699131597},{"type":"absolute","value":1699127504},{"type":"absolute","value":1699133649},{"type":"absolute","value":1699127507},{"type":"absolute","value":1699137754},{"type":"absolute","value":1699129567},{"type":"absolute","value":1699133665},{"type":"absolute","value":1699129570},{"type":"absolute","value":1699127523},{"type":"absolute","value":1699131618},{"type":"absolute","value":1699135717},{"type":"absolute","value":1699133672},{"type":"absolute","value":1699131629},{"type":"absolute","value":1699135726},{"type":"absolute","value":1699127543},{"type":"absolute","value":1699137783},{"type":"absolute","value":1699135737},{"type":"absolute","value":1699137786},{"type":"absolute","value":1699129599},{"type":"absolute","value":1699127552},{"type":"absolute","value":1699133698},{"type":"absolute","value":1699135748},{"type":"absolute","value":1699127563},{"type":"absolute","value":1699131668},{"type":"absolute","value":1699127574},{"type":"absolute","value":1699137815},{"type":"absolute","value":1699133727},{"type":"absolute","value":1699129649},{"type":"absolute","value":1699131697},{"type":"absolute","value":1699133745},{"type":"absolute","value":1699131700},{"type":"absolute","value":1699135797},{"type":"absolute","value":1699127609},{"type":"absolute","value":1699129658},{"type":"absolute","value":1699127620},{"type":"absolute","value":1699129669},{"type":"absolute","value":1699133766},{"type":"absolute","value":1699127623},{"type":"absolute","value":1699135813},{"type":"absolute","value":1699137865},{"type":"absolute","value":1699135820},{"type":"absolute","value":1699129680},{"type":"absolute","value":1699131729},{"type":"absolute","value":1699133777},{"type":"absolute","value":1699137874},{"type":"absolute","value":1699127639},{"type":"absolute","value":1699137885},{"type":"absolute","value":1699135846},{"type":"absolute","value":1699137896},{"type":"absolute","value":1699127659},{"type":"absolute","value":1699127668},{"type":"absolute","value":1699133816},{"type":"absolute","value":1699129726},{"type":"absolute","value":1699127679},{"type":"absolute","value":1699131779},{"type":"absolute","value":1699135875},{"type":"absolute","value":1699127690},{"type":"absolute","value":1699131788},{"type":"absolute","value":1699129742},{"type":"absolute","value":1699129749},{"type":"absolute","value":1699133845},{"type":"absolute","value":1699131799},{"type":"absolute","value":1699133848},{"type":"absolute","value":1699135893},{"type":"absolute","value":1699137945},{"type":"absolute","value":1699131810},{"type":"absolute","value":1699137961},{"type":"absolute","value":1699135914},{"type":"absolute","value":1699129775},{"type":"absolute","value":1699137968},{"type":"absolute","value":1699127730},{"type":"absolute","value":1699133877},{"type":"absolute","value":1699135925},{"type":"absolute","value":1699127741},{"type":"absolute","value":1699127744},{"type":"absolute","value":1699137994},{"type":"absolute","value":1699129804},{"type":"absolute","value":1699127760},{"type":"absolute","value":1699131859},{"type":"absolute","value":1699135964},{"type":"absolute","value":1699129822},{"type":"absolute","value":1699131875},{"type":"absolute","value":1699127780},{"type":"absolute","value":1699133927},{"type":"absolute","value":1699138023},{"type":"absolute","value":1699131882},{"type":"absolute","value":1699127789},{"type":"absolute","value":1699133936},{"type":"absolute","value":1699129843},{"type":"absolute","value":1699127800},{"type":"absolute","value":1699135993},{"type":"absolute","value":1699138041},{"type":"absolute","value":1699133947},{"type":"absolute","value":1699135996},{"type":"absolute","value":1699129854},{"type":"absolute","value":1699127811},{"type":"absolute","value":1699131908},{"type":"absolute","value":1699133958},{"type":"absolute","value":1699138062},{"type":"absolute","value":1699136025},{"type":"absolute","value":1699138073},{"type":"absolute","value":1699131937},{"type":"absolute","value":1699129893},{"type":"absolute","value":1699127846},{"type":"absolute","value":1699127857},{"type":"absolute","value":1699131955},{"type":"absolute","value":1699127860},{"type":"absolute","value":1699134007},{"type":"absolute","value":1699129919},{"type":"absolute","value":1699138112},{"type":"absolute","value":1699129922},{"type":"absolute","value":1699127876},{"type":"absolute","value":1699134023},{"type":"absolute","value":1699131976},{"type":"absolute","value":1699136075},{"type":"absolute","value":1699134030},{"type":"absolute","value":1699131987},{"type":"absolute","value":1699136084},{"type":"absolute","value":1699127896},{"type":"absolute","value":1699138141},{"type":"absolute","value":1699129951},{"type":"absolute","value":1699136095},{"type":"absolute","value":1699127905},{"type":"absolute","value":1699138144},{"type":"absolute","value":1699134056},{"type":"absolute","value":1699136106},{"type":"absolute","value":1699127916},{"type":"absolute","value":1699127927},{"type":"absolute","value":1699132026},{"type":"absolute","value":1699138173},{"type":"absolute","value":1699134085},{"type":"absolute","value":1699130001},{"type":"absolute","value":1699132055},{"type":"absolute","value":1699134103},{"type":"absolute","value":1699130010},{"type":"absolute","value":1699132058},{"type":"absolute","value":1699136155},{"type":"absolute","value":1699130021},{"type":"absolute","value":1699127979},{"type":"absolute","value":1699134124},{"type":"absolute","value":1699136171},{"type":"absolute","value":1699138223},{"type":"absolute","value":1699130032},{"type":"absolute","value":1699136178},{"type":"absolute","value":1699132087},{"type":"absolute","value":1699134135},{"type":"absolute","value":1699138232},{"type":"absolute","value":1699127995},{"type":"absolute","value":1699128002},{"type":"absolute","value":1699138243},{"type":"absolute","value":1699136204},{"type":"absolute","value":1699138254},{"type":"absolute","value":1699128028},{"type":"absolute","value":1699130078},{"type":"absolute","value":1699134174},{"type":"absolute","value":1699132137},{"type":"absolute","value":1699136233},{"type":"absolute","value":1699130094},{"type":"absolute","value":1699132146},{"type":"absolute","value":1699130101},{"type":"absolute","value":1699128057},{"type":"absolute","value":1699134203},{"type":"absolute","value":1699136251},{"type":"absolute","value":1699132157},{"type":"absolute","value":1699134206},{"type":"absolute","value":1699138303},{"type":"absolute","value":1699132168},{"type":"absolute","value":1699128075},{"type":"absolute","value":1699130127},{"type":"absolute","value":1699136272},{"type":"absolute","value":1699138319},{"type":"absolute","value":1699138326},{"type":"absolute","value":1699134235},{"type":"absolute","value":1699136283},{"type":"absolute","value":1699128096},{"type":"absolute","value":1699128107},{"type":"absolute","value":1699130156},{"type":"absolute","value":1699138352},{"type":"absolute","value":1699132217},{"type":"absolute","value":1699130174},{"type":"absolute","value":1699136322},{"type":"absolute","value":1699132233},{"type":"absolute","value":1699134285},{"type":"absolute","value":1699138381},{"type":"absolute","value":1699132240},{"type":"absolute","value":1699128146},{"type":"absolute","value":1699130195},{"type":"absolute","value":1699134294},{"type":"absolute","value":1699130206},{"type":"absolute","value":1699136351},{"type":"absolute","value":1699138399},{"type":"absolute","value":1699134305},{"type":"absolute","value":1699136354},{"type":"absolute","value":1699128168},{"type":"absolute","value":1699132266},{"type":"absolute","value":1699128171},{"type":"absolute","value":1699134316},{"type":"absolute","value":1699138420},{"type":"absolute","value":1699136383},{"type":"absolute","value":1699138431},{"type":"absolute","value":1699130245},{"type":"absolute","value":1699132295},{"type":"absolute","value":1699128200},{"type":"absolute","value":1699132313},{"type":"absolute","value":1699134365},{"type":"absolute","value":1699130271},{"type":"absolute","value":1699130274},{"type":"absolute","value":1699138470},{"type":"absolute","value":1699134381},{"type":"absolute","value":1699132334},{"type":"absolute","value":1699136433},{"type":"absolute","value":1699134388},{"type":"absolute","value":1699132345},{"type":"absolute","value":1699128250},{"type":"absolute","value":1699136442},{"type":"absolute","value":1699130303},{"type":"absolute","value":1699128259},{"type":"absolute","value":1699138499},{"type":"absolute","value":1699136453},{"type":"absolute","value":1699138502},{"type":"absolute","value":1699128270},{"type":"absolute","value":1699134414},{"type":"absolute","value":1699136464},{"type":"absolute","value":1699128281},{"type":"absolute","value":1699132384},{"type":"absolute","value":1699138531},{"type":"absolute","value":1699134443},{"type":"absolute","value":1699130353},{"type":"absolute","value":1699130362},{"type":"absolute","value":1699134461},{"type":"absolute","value":1699132413},{"type":"absolute","value":1699132416},{"type":"absolute","value":1699136513},{"type":"absolute","value":1699130373},{"type":"absolute","value":1699128327},{"type":"absolute","value":1699130384},{"type":"absolute","value":1699136529},{"type":"absolute","value":1699134482},{"type":"absolute","value":1699138581},{"type":"absolute","value":1699128343},{"type":"absolute","value":1699136536},{"type":"absolute","value":1699132445},{"type":"absolute","value":1699128350},{"type":"absolute","value":1699134493},{"type":"absolute","value":1699138590},{"type":"absolute","value":1699126308},{"type":"absolute","value":1699138601},{"type":"absolute","value":1699126319},{"type":"absolute","value":1699126322},{"type":"absolute","value":1699136562},{"type":"absolute","value":1699138612},{"type":"absolute","value":1699128376},{"type":"absolute","value":1699130430},{"type":"absolute","value":1699126338},{"type":"absolute","value":1699134532},{"type":"absolute","value":1699130446},{"type":"absolute","value":1699132495},{"type":"absolute","value":1699136591},{"type":"absolute","value":1699128405},{"type":"absolute","value":1699126358},{"type":"absolute","value":1699130453},{"type":"absolute","value":1699132504},{"type":"absolute","value":1699126367},{"type":"absolute","value":1699134561},{"type":"absolute","value":1699136609},{"type":"absolute","value":1699132515},{"type":"absolute","value":1699134564},{"type":"absolute","value":1699138661},{"type":"absolute","value":1699128423},{"type":"absolute","value":1699126378},{"type":"absolute","value":1699132526},{"type":"absolute","value":1699130479},{"type":"absolute","value":1699126389},{"type":"absolute","value":1699136630},{"type":"absolute","value":1699138677},{"type":"absolute","value":1699128444},{"type":"absolute","value":1699138684},{"type":"absolute","value":1699134593},{"type":"absolute","value":1699136641},{"type":"absolute","value":1699128455},{"type":"absolute","value":1699130508},{"type":"absolute","value":1699138710},{"type":"absolute","value":1699126424},{"type":"absolute","value":1699130526},{"type":"absolute","value":1699132575},{"type":"absolute","value":1699126435},{"type":"absolute","value":1699126438},{"type":"absolute","value":1699136680},{"type":"absolute","value":1699128494},{"type":"absolute","value":1699132591},{"type":"absolute","value":1699130547},{"type":"absolute","value":1699134643},{"type":"absolute","value":1699138739},{"type":"absolute","value":1699126454},{"type":"absolute","value":1699132598},{"type":"absolute","value":1699134652},{"type":"absolute","value":1699130558},{"type":"absolute","value":1699128517},{"type":"absolute","value":1699136709},{"type":"absolute","value":1699134663},{"type":"absolute","value":1699128520},{"type":"absolute","value":1699136712},{"type":"absolute","value":1699126474},{"type":"absolute","value":1699138757},{"type":"absolute","value":1699132624},{"type":"absolute","value":1699134674},{"type":"absolute","value":1699126483},{"type":"absolute","value":1699138778},{"type":"absolute","value":1699126494},{"type":"absolute","value":1699128549},{"type":"absolute","value":1699130597},{"type":"absolute","value":1699136741},{"type":"absolute","value":1699138789},{"type":"absolute","value":1699126505},{"type":"absolute","value":1699132653},{"type":"absolute","value":1699130623},{"type":"absolute","value":1699132671},{"type":"absolute","value":1699130626},{"type":"absolute","value":1699134723},{"type":"absolute","value":1699138828},{"type":"absolute","value":1699126545},{"type":"absolute","value":1699134739},{"type":"absolute","value":1699132692},{"type":"absolute","value":1699128599},{"type":"absolute","value":1699136791},{"type":"absolute","value":1699134746},{"type":"absolute","value":1699126556},{"type":"absolute","value":1699126559},{"type":"absolute","value":1699128608},{"type":"absolute","value":1699130655},{"type":"absolute","value":1699132703},{"type":"absolute","value":1699136800},{"type":"absolute","value":1699138857},{"type":"absolute","value":1699128619},{"type":"absolute","value":1699136811},{"type":"absolute","value":1699138860},{"type":"absolute","value":1699126575},{"type":"absolute","value":1699134772},{"type":"absolute","value":1699128630},{"type":"absolute","value":1699136822},{"type":"absolute","value":1699126595},{"type":"absolute","value":1699132742},{"type":"absolute","value":1699138889},{"type":"absolute","value":1699126604},{"type":"absolute","value":1699130705},{"type":"absolute","value":1699134801},{"type":"absolute","value":1699126615},{"type":"absolute","value":1699130714},{"type":"absolute","value":1699126626},{"type":"absolute","value":1699132771},{"type":"absolute","value":1699128676},{"type":"absolute","value":1699130725},{"type":"absolute","value":1699132774},{"type":"absolute","value":1699134819},{"type":"absolute","value":1699136871},{"type":"absolute","value":1699130736},{"type":"absolute","value":1699128692},{"type":"absolute","value":1699136887},{"type":"absolute","value":1699134840},{"type":"absolute","value":1699128699},{"type":"absolute","value":1699138939},{"type":"absolute","value":1699136894},{"type":"absolute","value":1699132803},{"type":"absolute","value":1699134851},{"type":"absolute","value":1699126661},{"type":"absolute","value":1699138948},{"type":"absolute","value":1699138959},{"type":"absolute","value":1699126672},{"type":"absolute","value":1699126675},{"type":"absolute","value":1699128725},{"type":"absolute","value":1699136920},{"type":"absolute","value":1699138970},{"type":"absolute","value":1699130785},{"type":"absolute","value":1699126691},{"type":"absolute","value":1699134890},{"type":"absolute","value":1699130801},{"type":"absolute","value":1699128754},{"type":"absolute","value":1699132853},{"type":"absolute","value":1699136949},{"type":"absolute","value":1699126711},{"type":"absolute","value":1699130808},{"type":"absolute","value":1699132862},{"type":"absolute","value":1699126720},{"type":"absolute","value":1699128772},{"type":"absolute","value":1699134919},{"type":"absolute","value":1699136967},{"type":"absolute","value":1699132873},{"type":"absolute","value":1699134922},{"type":"absolute","value":1699126731},{"type":"absolute","value":1699139019},{"type":"absolute","value":1699130834},{"type":"absolute","value":1699132884},{"type":"absolute","value":1699126742},{"type":"absolute","value":1699128793},{"type":"absolute","value":1699139035},{"type":"absolute","value":1699136988},{"type":"absolute","value":1699139042},{"type":"absolute","value":1699128804},{"type":"absolute","value":1699134951},{"type":"absolute","value":1699136999},{"type":"absolute","value":1699130863},{"type":"absolute","value":1699139068},{"type":"absolute","value":1699126782},{"type":"absolute","value":1699130881},{"type":"absolute","value":1699132933},{"type":"absolute","value":1699126793},{"type":"absolute","value":1699128843},{"type":"absolute","value":1699126796},{"type":"absolute","value":1699137038},{"type":"absolute","value":1699132949},{"type":"absolute","value":1699130902},{"type":"absolute","value":1699135001},{"type":"absolute","value":1699139097},{"type":"absolute","value":1699126812},{"type":"absolute","value":1699132956},{"type":"absolute","value":1699130913},{"type":"absolute","value":1699128866},{"type":"absolute","value":1699135010},{"type":"absolute","value":1699128869},{"type":"absolute","value":1699137067},{"type":"absolute","value":1699139115},{"type":"absolute","value":1699135021},{"type":"absolute","value":1699137070},{"type":"absolute","value":1699126832},{"type":"absolute","value":1699132982},{"type":"absolute","value":1699135032},{"type":"absolute","value":1699126841},{"type":"absolute","value":1699139136},{"type":"absolute","value":1699128898},{"type":"absolute","value":1699126852},{"type":"absolute","value":1699130952},{"type":"absolute","value":1699137099},{"type":"absolute","value":1699139147},{"type":"absolute","value":1699126863},{"type":"absolute","value":1699133011},{"type":"absolute","value":1699130981},{"type":"absolute","value":1699133029},{"type":"absolute","value":1699130984},{"type":"absolute","value":1699135081},{"type":"absolute","value":1699126898},{"type":"absolute","value":1699139186},{"type":"absolute","value":1699128948},{"type":"absolute","value":1699135097},{"type":"absolute","value":1699133050},{"type":"absolute","value":1699126909},{"type":"absolute","value":1699128957},{"type":"absolute","value":1699137149},{"type":"absolute","value":1699126912},{"type":"absolute","value":1699135104},{"type":"absolute","value":1699131013},{"type":"absolute","value":1699133061},{"type":"absolute","value":1699137158},{"type":"absolute","value":1699128968},{"type":"absolute","value":1699139215},{"type":"absolute","value":1699126928},{"type":"absolute","value":1699137169},{"type":"absolute","value":1699139218},{"type":"absolute","value":1699128979},{"type":"absolute","value":1699135130},{"type":"absolute","value":1699137180},{"type":"absolute","value":1699126948},{"type":"absolute","value":1699133100},{"type":"absolute","value":1699126957},{"type":"absolute","value":1699139247},{"type":"absolute","value":1699131063},{"type":"absolute","value":1699126968},{"type":"absolute","value":1699135159},{"type":"absolute","value":1699131072},{"type":"absolute","value":1699129025},{"type":"absolute","value":1699126979},{"type":"absolute","value":1699133129},{"type":"absolute","value":1699135177},{"type":"absolute","value":1699131083},{"type":"absolute","value":1699133132},{"type":"absolute","value":1699137229},{"type":"absolute","value":1699129041},{"type":"absolute","value":1699131094},{"type":"absolute","value":1699129048},{"type":"absolute","value":1699137245},{"type":"absolute","value":1699135198},{"type":"absolute","value":1699139297},{"type":"absolute","value":1699137252},{"type":"absolute","value":1699133161},{"type":"absolute","value":1699135209},{"type":"absolute","value":1699127019},{"type":"absolute","value":1699139306},{"type":"absolute","value":1699129074},{"type":"absolute","value":1699139317},{"type":"absolute","value":1699127030},{"type":"absolute","value":1699127033},{"type":"absolute","value":1699137278},{"type":"absolute","value":1699139328},{"type":"absolute","value":1699131143},{"type":"absolute","value":1699127049},{"type":"absolute","value":1699129103},{"type":"absolute","value":1699135248},{"type":"absolute","value":1699139349},{"type":"absolute","value":1699131159},{"type":"absolute","value":1699133211},{"type":"absolute","value":1699137307},{"type":"absolute","value":1699127069},{"type":"absolute","value":1699131166},{"type":"absolute","value":1699139360},{"type":"absolute","value":1699129121},{"type":"absolute","value":1699139363},{"type":"absolute","value":1699133220},{"type":"absolute","value":1699127078},{"type":"absolute","value":1699135277},{"type":"absolute","value":1699137325},{"type":"absolute","value":1699133231},{"type":"absolute","value":1699135280},{"type":"absolute","value":1699127089},{"type":"absolute","value":1699139379},{"type":"absolute","value":1699129142},{"type":"absolute","value":1699131192},{"type":"absolute","value":1699133242},{"type":"absolute","value":1699127100},{"type":"absolute","value":1699129153},{"type":"absolute","value":1699137346},{"type":"absolute","value":1699139399},{"type":"absolute","value":1699135309},{"type":"absolute","value":1699137357},{"type":"absolute","value":1699139408},{"type":"absolute","value":1699131221},{"type":"absolute","value":1699139419},{"type":"absolute","value":1699127135},{"type":"absolute","value":1699139430},{"type":"absolute","value":1699131239},{"type":"absolute","value":1699129192},{"type":"absolute","value":1699127146},{"type":"absolute","value":1699133291},{"type":"absolute","value":1699127149},{"type":"absolute","value":1699137396},{"type":"absolute","value":1699133307},{"type":"absolute","value":1699131260},{"type":"absolute","value":1699127165},{"type":"absolute","value":1699139451},{"type":"absolute","value":1699129215},{"type":"absolute","value":1699135359},{"type":"absolute","value":1699129218},{"type":"absolute","value":1699133314},{"type":"absolute","value":1699139462},{"type":"absolute","value":1699131271},{"type":"absolute","value":1699135368},{"type":"absolute","value":1699139465},{"type":"absolute","value":1699127185},{"type":"absolute","value":1699137425},{"type":"absolute","value":1699135379},{"type":"absolute","value":1699137428},{"type":"absolute","value":1699139481},{"type":"absolute","value":1699127194},{"type":"absolute","value":1699133340},{"type":"absolute","value":1699135390},{"type":"absolute","value":1699129247},{"type":"absolute","value":1699127205},{"type":"absolute","value":1699139501},{"type":"absolute","value":1699131310},{"type":"absolute","value":1699127216},{"type":"absolute","value":1699137457},{"type":"absolute","value":1699139510},{"type":"absolute","value":1699133369},{"type":"absolute","value":1699139521},{"type":"absolute","value":1699131339},{"type":"absolute","value":1699133387},{"type":"absolute","value":1699139532},{"type":"absolute","value":1699131342},{"type":"absolute","value":1699135439},{"type":"absolute","value":1699129297},{"type":"absolute","value":1699127256},{"type":"absolute","value":1699129306},{"type":"absolute","value":1699135455},{"type":"absolute","value":1699133408},{"type":"absolute","value":1699127267},{"type":"absolute","value":1699137507},{"type":"absolute","value":1699129317},{"type":"absolute","value":1699127270},{"type":"absolute","value":1699135462},{"type":"absolute","value":1699131371},{"type":"absolute","value":1699133419},{"type":"absolute","value":1699137516},{"type":"absolute","value":1699129328},{"type":"absolute","value":1699127286},{"type":"absolute","value":1699137527}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699140544},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699140544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699142145},{"type":"absolute","value":1699141128},{"type":"absolute","value":1699142923},{"type":"absolute","value":1699141390},{"type":"absolute","value":1699142926},{"type":"absolute","value":1699141393},{"type":"absolute","value":1699142163},{"type":"absolute","value":1699140632},{"type":"absolute","value":1699141402},{"type":"absolute","value":1699140635},{"type":"absolute","value":1699142172},{"type":"absolute","value":1699142938},{"type":"absolute","value":1699142175},{"type":"absolute","value":1699142950},{"type":"absolute","value":1699140647},{"type":"absolute","value":1699142184},{"type":"absolute","value":1699141420},{"type":"absolute","value":1699141429},{"type":"absolute","value":1699140662},{"type":"absolute","value":1699141685},{"type":"absolute","value":1699141432},{"type":"absolute","value":1699141688},{"type":"absolute","value":1699142457},{"type":"absolute","value":1699142454},{"type":"absolute","value":1699140926},{"type":"absolute","value":1699140671},{"type":"absolute","value":1699140674},{"type":"absolute","value":1699142469},{"type":"absolute","value":1699140935},{"type":"absolute","value":1699141706},{"type":"absolute","value":1699141709},{"type":"absolute","value":1699142484},{"type":"absolute","value":1699140953},{"type":"absolute","value":1699141721},{"type":"absolute","value":1699142748},{"type":"absolute","value":1699142493},{"type":"absolute","value":1699142496},{"type":"absolute","value":1699140962},{"type":"absolute","value":1699140965},{"type":"absolute","value":1699141733},{"type":"absolute","value":1699142757},{"type":"absolute","value":1699141995},{"type":"absolute","value":1699140974},{"type":"absolute","value":1699141998},{"type":"absolute","value":1699141237},{"type":"absolute","value":1699142007},{"type":"absolute","value":1699141240},{"type":"absolute","value":1699142775},{"type":"absolute","value":1699142784},{"type":"absolute","value":1699142787},{"type":"absolute","value":1699141252},{"type":"absolute","value":1699142025},{"type":"absolute","value":1699142796},{"type":"absolute","value":1699142034},{"type":"absolute","value":1699141267},{"type":"absolute","value":1699142290},{"type":"absolute","value":1699142037},{"type":"absolute","value":1699142293},{"type":"absolute","value":1699141531},{"type":"absolute","value":1699141276},{"type":"absolute","value":1699141116},{"type":"absolute","value":1699141279},{"type":"absolute","value":1699141540},{"type":"absolute","value":1699142311},{"type":"absolute","value":1699142314},{"type":"absolute","value":1699140785},{"type":"absolute","value":1699140788},{"type":"absolute","value":1699141558},{"type":"absolute","value":1699142326},{"type":"absolute","value":1699140797},{"type":"absolute","value":1699142649},{"type":"absolute","value":1699141567},{"type":"absolute","value":1699141570},{"type":"absolute","value":1699142338},{"type":"absolute","value":1699142905},{"type":"absolute","value":1699141579},{"type":"absolute","value":1699140815},{"type":"absolute","value":1699142607},{"type":"absolute","value":1699141842},{"type":"absolute","value":1699142610},{"type":"absolute","value":1699141845},{"type":"absolute","value":1699140824},{"type":"absolute","value":1699141080},{"type":"absolute","value":1699140827},{"type":"absolute","value":1699141083},{"type":"absolute","value":1699142619},{"type":"absolute","value":1699141857},{"type":"absolute","value":1699141101},{"type":"absolute","value":1699142637},{"type":"absolute","value":1699141104},{"type":"absolute","value":1699141872},{"type":"absolute","value":1699142646},{"type":"absolute","value":1699142902},{"type":"absolute","value":1699142136},{"type":"absolute","value":1699141881},{"type":"absolute","value":1699141884}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699142992},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699142992}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699143041},{"type":"absolute","value":1699143170},{"type":"absolute","value":1699143558},{"type":"absolute","value":1699143688},{"type":"absolute","value":1699143434},{"type":"absolute","value":1699143053},{"type":"absolute","value":1699143437},{"type":"absolute","value":1699143570},{"type":"absolute","value":1699143316},{"type":"absolute","value":1699143319},{"type":"absolute","value":1699143449},{"type":"absolute","value":1699143069},{"type":"absolute","value":1699143458},{"type":"absolute","value":1699143587},{"type":"absolute","value":1699143334},{"type":"absolute","value":1699143470},{"type":"absolute","value":1699143215},{"type":"absolute","value":1699143343},{"type":"absolute","value":1699143218},{"type":"absolute","value":1699143733},{"type":"absolute","value":1699143736},{"type":"absolute","value":1699143355},{"type":"absolute","value":1699143486},{"type":"absolute","value":1699143233},{"type":"absolute","value":1699143751},{"type":"absolute","value":1699143114},{"type":"absolute","value":1699143242},{"type":"absolute","value":1699143372},{"type":"absolute","value":1699143117},{"type":"absolute","value":1699143632},{"type":"absolute","value":1699143760},{"type":"absolute","value":1699143635},{"type":"absolute","value":1699143254},{"type":"absolute","value":1699143132},{"type":"absolute","value":1699143772},{"type":"absolute","value":1699143650},{"type":"absolute","value":1699143141},{"type":"absolute","value":1699143271},{"type":"absolute","value":1699143017},{"type":"absolute","value":1699143531},{"type":"absolute","value":1699143020},{"type":"absolute","value":1699143659},{"type":"absolute","value":1699143534},{"type":"absolute","value":1699143789},{"type":"absolute","value":1699143153},{"type":"absolute","value":1699143671},{"type":"absolute","value":1699143032},{"type":"absolute","value":1699143549}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699188240},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699188240}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699188745},{"type":"absolute","value":1699191819},{"type":"absolute","value":1699189772},{"type":"absolute","value":1699189778},{"type":"absolute","value":1699188755},{"type":"absolute","value":1699190820},{"type":"absolute","value":1699189797},{"type":"absolute","value":1699191845},{"type":"absolute","value":1699190823},{"type":"absolute","value":1699191848},{"type":"absolute","value":1699189801},{"type":"absolute","value":1699190826},{"type":"absolute","value":1699188780},{"type":"absolute","value":1699189804},{"type":"absolute","value":1699191855},{"type":"absolute","value":1699191858},{"type":"absolute","value":1699191862},{"type":"absolute","value":1699189815},{"type":"absolute","value":1699189825},{"type":"absolute","value":1699188804},{"type":"absolute","value":1699191891},{"type":"absolute","value":1699191893},{"type":"absolute","value":1699189848},{"type":"absolute","value":1699189851},{"type":"absolute","value":1699191900},{"type":"absolute","value":1699188829},{"type":"absolute","value":1699189854},{"type":"absolute","value":1699190877},{"type":"absolute","value":1699190886},{"type":"absolute","value":1699190888},{"type":"absolute","value":1699191912},{"type":"absolute","value":1699189866},{"type":"absolute","value":1699191914},{"type":"absolute","value":1699191918},{"type":"absolute","value":1699191922},{"type":"absolute","value":1699188851},{"type":"absolute","value":1699189877},{"type":"absolute","value":1699191927},{"type":"absolute","value":1699189900},{"type":"absolute","value":1699191948},{"type":"absolute","value":1699188878},{"type":"absolute","value":1699189904},{"type":"absolute","value":1699189906},{"type":"absolute","value":1699188893},{"type":"absolute","value":1699189918},{"type":"absolute","value":1699191974},{"type":"absolute","value":1699190953},{"type":"absolute","value":1699190956},{"type":"absolute","value":1699189933},{"type":"absolute","value":1699190959},{"type":"absolute","value":1699188916},{"type":"absolute","value":1699188919},{"type":"absolute","value":1699189952},{"type":"absolute","value":1699189955},{"type":"absolute","value":1699188935},{"type":"absolute","value":1699192007},{"type":"absolute","value":1699190985},{"type":"absolute","value":1699189962},{"type":"absolute","value":1699192010},{"type":"absolute","value":1699189965},{"type":"absolute","value":1699190990},{"type":"absolute","value":1699189970},{"type":"absolute","value":1699190995},{"type":"absolute","value":1699192021},{"type":"absolute","value":1699192024},{"type":"absolute","value":1699192034},{"type":"absolute","value":1699188965},{"type":"absolute","value":1699192037},{"type":"absolute","value":1699188974},{"type":"absolute","value":1699189999},{"type":"absolute","value":1699190007},{"type":"absolute","value":1699190014},{"type":"absolute","value":1699188995},{"type":"absolute","value":1699188998},{"type":"absolute","value":1699190025},{"type":"absolute","value":1699191051},{"type":"absolute","value":1699190028},{"type":"absolute","value":1699192076},{"type":"absolute","value":1699189007},{"type":"absolute","value":1699192082},{"type":"absolute","value":1699192093},{"type":"absolute","value":1699189028},{"type":"absolute","value":1699190055},{"type":"absolute","value":1699190058},{"type":"absolute","value":1699192109},{"type":"absolute","value":1699190062},{"type":"absolute","value":1699191086},{"type":"absolute","value":1699191089},{"type":"absolute","value":1699189047},{"type":"absolute","value":1699190073},{"type":"absolute","value":1699189050},{"type":"absolute","value":1699192123},{"type":"absolute","value":1699189052},{"type":"absolute","value":1699192126},{"type":"absolute","value":1699189060},{"type":"absolute","value":1699192132},{"type":"absolute","value":1699192137},{"type":"absolute","value":1699190093},{"type":"absolute","value":1699192150},{"type":"absolute","value":1699190104},{"type":"absolute","value":1699190107},{"type":"absolute","value":1699189086},{"type":"absolute","value":1699190115},{"type":"absolute","value":1699189101},{"type":"absolute","value":1699192174},{"type":"absolute","value":1699189104},{"type":"absolute","value":1699192177},{"type":"absolute","value":1699190130},{"type":"absolute","value":1699190133},{"type":"absolute","value":1699189110},{"type":"absolute","value":1699190136},{"type":"absolute","value":1699190141},{"type":"absolute","value":1699192191},{"type":"absolute","value":1699190144},{"type":"absolute","value":1699191169},{"type":"absolute","value":1699189122},{"type":"absolute","value":1699191172},{"type":"absolute","value":1699190150},{"type":"absolute","value":1699192203},{"type":"absolute","value":1699191183},{"type":"absolute","value":1699190164},{"type":"absolute","value":1699189143},{"type":"absolute","value":1699190167},{"type":"absolute","value":1699192218},{"type":"absolute","value":1699189158},{"type":"absolute","value":1699192230},{"type":"absolute","value":1699189161},{"type":"absolute","value":1699189163},{"type":"absolute","value":1699192236},{"type":"absolute","value":1699189169},{"type":"absolute","value":1699192243},{"type":"absolute","value":1699192246},{"type":"absolute","value":1699191225},{"type":"absolute","value":1699189184},{"type":"absolute","value":1699191234},{"type":"absolute","value":1699191242},{"type":"absolute","value":1699192267},{"type":"absolute","value":1699190225},{"type":"absolute","value":1699190228},{"type":"absolute","value":1699190230},{"type":"absolute","value":1699192278},{"type":"absolute","value":1699190233},{"type":"absolute","value":1699192281},{"type":"absolute","value":1699192284},{"type":"absolute","value":1699189216},{"type":"absolute","value":1699189219},{"type":"absolute","value":1699192291},{"type":"absolute","value":1699190245},{"type":"absolute","value":1699192294},{"type":"absolute","value":1699189224},{"type":"absolute","value":1699190263},{"type":"absolute","value":1699189241},{"type":"absolute","value":1699190269},{"type":"absolute","value":1699191304},{"type":"absolute","value":1699192328},{"type":"absolute","value":1699191307},{"type":"absolute","value":1699192331},{"type":"absolute","value":1699191311},{"type":"absolute","value":1699189265},{"type":"absolute","value":1699192342},{"type":"absolute","value":1699192345},{"type":"absolute","value":1699189276},{"type":"absolute","value":1699192350},{"type":"absolute","value":1699192353},{"type":"absolute","value":1699190307},{"type":"absolute","value":1699192356},{"type":"absolute","value":1699190310},{"type":"absolute","value":1699190316},{"type":"absolute","value":1699190318},{"type":"absolute","value":1699189297},{"type":"absolute","value":1699190322},{"type":"absolute","value":1699192371},{"type":"absolute","value":1699189304},{"type":"absolute","value":1699189312},{"type":"absolute","value":1699189315},{"type":"absolute","value":1699189318},{"type":"absolute","value":1699189321},{"type":"absolute","value":1699190349},{"type":"absolute","value":1699191373},{"type":"absolute","value":1699192397},{"type":"absolute","value":1699191376},{"type":"absolute","value":1699188306},{"type":"absolute","value":1699192403},{"type":"absolute","value":1699188308},{"type":"absolute","value":1699191380},{"type":"absolute","value":1699190359},{"type":"absolute","value":1699190362},{"type":"absolute","value":1699189351},{"type":"absolute","value":1699192428},{"type":"absolute","value":1699188333},{"type":"absolute","value":1699188335},{"type":"absolute","value":1699192433},{"type":"absolute","value":1699189362},{"type":"absolute","value":1699192439},{"type":"absolute","value":1699192441},{"type":"absolute","value":1699189371},{"type":"absolute","value":1699189374},{"type":"absolute","value":1699192446},{"type":"absolute","value":1699189377},{"type":"absolute","value":1699191434},{"type":"absolute","value":1699191436},{"type":"absolute","value":1699191440},{"type":"absolute","value":1699190420},{"type":"absolute","value":1699188377},{"type":"absolute","value":1699192475},{"type":"absolute","value":1699190429},{"type":"absolute","value":1699192479},{"type":"absolute","value":1699190432},{"type":"absolute","value":1699192485},{"type":"absolute","value":1699189415},{"type":"absolute","value":1699192488},{"type":"absolute","value":1699188394},{"type":"absolute","value":1699189418},{"type":"absolute","value":1699189421},{"type":"absolute","value":1699192494},{"type":"absolute","value":1699189440},{"type":"absolute","value":1699188421},{"type":"absolute","value":1699189451},{"type":"absolute","value":1699192527},{"type":"absolute","value":1699191505},{"type":"absolute","value":1699188434},{"type":"absolute","value":1699192531},{"type":"absolute","value":1699191508},{"type":"absolute","value":1699191510},{"type":"absolute","value":1699189463},{"type":"absolute","value":1699192534},{"type":"absolute","value":1699189467},{"type":"absolute","value":1699189470},{"type":"absolute","value":1699192542},{"type":"absolute","value":1699192545},{"type":"absolute","value":1699189475},{"type":"absolute","value":1699188453},{"type":"absolute","value":1699188469},{"type":"absolute","value":1699192578},{"type":"absolute","value":1699189508},{"type":"absolute","value":1699190533},{"type":"absolute","value":1699190535},{"type":"absolute","value":1699192583},{"type":"absolute","value":1699189514},{"type":"absolute","value":1699190539},{"type":"absolute","value":1699189517},{"type":"absolute","value":1699192589},{"type":"absolute","value":1699188496},{"type":"absolute","value":1699190552},{"type":"absolute","value":1699192601},{"type":"absolute","value":1699191578},{"type":"absolute","value":1699191581},{"type":"absolute","value":1699191583},{"type":"absolute","value":1699189536},{"type":"absolute","value":1699192612},{"type":"absolute","value":1699188523},{"type":"absolute","value":1699192637},{"type":"absolute","value":1699189566},{"type":"absolute","value":1699192640},{"type":"absolute","value":1699188546},{"type":"absolute","value":1699189570},{"type":"absolute","value":1699189574},{"type":"absolute","value":1699192646},{"type":"absolute","value":1699191624},{"type":"absolute","value":1699189584},{"type":"absolute","value":1699191635},{"type":"absolute","value":1699192660},{"type":"absolute","value":1699190613},{"type":"absolute","value":1699188568},{"type":"absolute","value":1699190616},{"type":"absolute","value":1699190621},{"type":"absolute","value":1699192671},{"type":"absolute","value":1699189605},{"type":"absolute","value":1699191657},{"type":"absolute","value":1699191660},{"type":"absolute","value":1699192689},{"type":"absolute","value":1699188597},{"type":"absolute","value":1699192698},{"type":"absolute","value":1699189627},{"type":"absolute","value":1699189634},{"type":"absolute","value":1699189637},{"type":"absolute","value":1699192709},{"type":"absolute","value":1699189640},{"type":"absolute","value":1699189643},{"type":"absolute","value":1699192715},{"type":"absolute","value":1699188621},{"type":"absolute","value":1699192720},{"type":"absolute","value":1699189653},{"type":"absolute","value":1699192733},{"type":"absolute","value":1699192735},{"type":"absolute","value":1699191714},{"type":"absolute","value":1699192740},{"type":"absolute","value":1699189669},{"type":"absolute","value":1699190693},{"type":"absolute","value":1699190696},{"type":"absolute","value":1699191720},{"type":"absolute","value":1699191725},{"type":"absolute","value":1699188659},{"type":"absolute","value":1699188668},{"type":"absolute","value":1699189694},{"type":"absolute","value":1699189697},{"type":"absolute","value":1699189702},{"type":"absolute","value":1699191750},{"type":"absolute","value":1699192775},{"type":"absolute","value":1699189710},{"type":"absolute","value":1699192787},{"type":"absolute","value":1699188697},{"type":"absolute","value":1699189722},{"type":"absolute","value":1699191777},{"type":"absolute","value":1699190754},{"type":"absolute","value":1699191780},{"type":"absolute","value":1699190759},{"type":"absolute","value":1699191783},{"type":"absolute","value":1699190761},{"type":"absolute","value":1699188719},{"type":"absolute","value":1699189745},{"type":"absolute","value":1699191797}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699206320},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699206320}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699206324}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699206496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699206496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699206784},{"type":"absolute","value":1699206657},{"type":"absolute","value":1699206852},{"type":"absolute","value":1699206599},{"type":"absolute","value":1699206536},{"type":"absolute","value":1699206795},{"type":"absolute","value":1699206668},{"type":"absolute","value":1699206733},{"type":"absolute","value":1699206864},{"type":"absolute","value":1699206609},{"type":"absolute","value":1699206548},{"type":"absolute","value":1699206678},{"type":"absolute","value":1699206806},{"type":"absolute","value":1699206744},{"type":"absolute","value":1699206874},{"type":"absolute","value":1699206621},{"type":"absolute","value":1699206716},{"type":"absolute","value":1699206559},{"type":"absolute","value":1699206689},{"type":"absolute","value":1699206817},{"type":"absolute","value":1699206755},{"type":"absolute","value":1699206503},{"type":"absolute","value":1699206633},{"type":"absolute","value":1699206700},{"type":"absolute","value":1699206828},{"type":"absolute","value":1699206511},{"type":"absolute","value":1699206577},{"type":"absolute","value":1699206644},{"type":"absolute","value":1699206773},{"type":"absolute","value":1699206839},{"type":"absolute","value":1699206521},{"type":"absolute","value":1699206588}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699207939},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699207939}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699207951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699207971},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699207971}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699207983}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211223},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699211223}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699211227}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using blowfish":{"meta":{"name":"encrypt data using blowfish","namespace":"data-manipulation/encryption/blowfish","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","Blowfish"],"objective":"Cryptography","behavior":"Encrypt Data","method":"Blowfish","id":"C0027.002"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x653E19E5"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using blowfish\r\n    namespace: data-manipulation/encryption/blowfish\r\n    authors:\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires bytes features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\r\n      - Cryptography::Encrypt Data::Blowfish [C0027.002]\r\n    examples:\r\n      - 0761142efbda6c4b1e801223de723578:0x653E19E5\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 0x3a39ce37 = u32 ks3 sbox4\r\n        - number: 0xe93d5a68 = u32 ks2 sbox3\r\n        - number: 0x4b7a70e9 = u32 ks1 sbox2\r\n        - number: 0xd1310ba6 = u32 ks0 sbox1\r\n      - or:\r\n        - bytes: 88 6a 3f 24 d3 08 a3 85 2e 8a 19 13 44 73 70 03 22 38 09 a4 d0 31 9f 29 98 fa 2e 08 89 6c 4e ec e6 21 28 45 77 13 d0 38 cf 66 54 be 6c 0c e9 34 b7 29 ac c0 dd 50 7c c9 b5 d5 84 3f 17 09 47 b5 d9 d5 16 92 1b fb 79 89 = ps\r\n        - bytes: a6 0b 31 d1 ac b5 df 98 db 72 fd 2f b7 df 1a d0 ed af e1 b8 96 7e 26 6a 45 90 7c ba 99 7f 2c f1 47 99 a1 24 f7 6c 91 b3 e2 f2 01 08 16 fc 8e 85 d8 20 69 63 69 4e 57 71 a3 fe 58 a4 7e 3d 93 f4 8f 74 95 0d 58 b6 8e 72 58 cd 8b 71 ee 4a 15 82 1d a4 54 7b b5 59 5a c2 39 d5 30 9c 13 60 f2 2a 23 b0 d1 c5 f0 85 60 28 18 79 41 ca ef 38 db b8 b0 dc 79 8e 0e 18 3a 60 8b 0e 9e 6c 3e 8a 1e b0 c1 77 15 d7 27 4b 31 bd da 2f af 78 60 5c 60 55 f3 25 55 e6 94 ab 55 aa 62 98 48 57 40 14 e8 63 6a 39 ca 55 b6 10 ab 2a 34 5c cc = ks0 sbox1\r\n        - bytes: e9 70 7a 4b 44 29 b3 b5 2e 09 75 db 23 26 19 c4 b0 a6 6e ad 7d df a7 49 b8 60 ee 9c 66 b2 ed 8f 71 8c aa ec ff 17 9a 69 6c 52 64 56 e1 9e b1 c2 a5 02 36 19 29 4c 09 75 40 13 59 a0 3e 3a 18 e4 9a 98 54 3f 65 9d 42 5b d6 e4 8f 6b d6 3f f7 99 07 9c d2 a1 f5 30 e8 ef e6 38 2d 4d c1 5d 25 f0 86 20 dd 4c 26 eb 70 84 c6 e9 82 63 5e cc 1e 02 3f 6b 68 09 c9 ef ba 3e 14 18 97 3c a1 70 6a 6b 84 35 7f 68 86 e2 a0 52 05 53 9c b7 37 07 50 aa 1c 84 07 3e 5c ae de 7f ec 44 7d 8e b8 f2 16 57 37 da 3a b0 0d 0c 50 f0 04 1f 1c  = ks1 sbox2\r\n        - bytes: 68 5a 3d e9 f7 40 81 94 1c 26 4c f6 34 29 69 94 f7 20 15 41 f7 d4 02 76 2e 6b f4 bc 68 00 a2 d4 71 24 08 d4 6a f4 20 33 b7 d4 b7 43 af 61 00 50 2e f6 39 1e 46 45 24 97 74 4f 21 14 40 88 8b bf 1d fc 95 4d af 91 b5 96 d3 dd f4 70 45 2f a0 66 ec 09 bc bf 85 97 bd 03 d0 6d ac 7f 04 85 cb 31 b3 27 eb 96 41 39 fd 55 e6 47 25 da 9a 0a ca ab 25 78 50 28 f4 29 04 53 da 86 2c 0a fb 6d b6 e9 62 14 dc 68 00 69 48 d7 a4 c0 0e 68 ee 8d a1 27 a2 fe 3f 4f 8c ad 87 e8 06 e0 8c b5 b6 d6 f4 7a 7c 1e ce aa ec 5f 37 d3 99 a3 78 = ks2 sbox3\r\n        - bytes: 37 ce 39 3a cf f5 fa d3 37 77 c2 ab 1b 2d c5 5a 9e 67 b0 5c 42 37 a3 4f 40 27 82 d3 be 9b bc 99 9d 8e 11 d5 15 73 0f bf 7e 1c 2d d6 7b c4 00 c7 6b 1b 8c b7 45 90 a1 21 be b1 6e b2 b4 6e 36 6a 2f ab 48 57 79 6e 94 bc d2 76 a3 c6 c8 c2 49 65 ee f8 0f 53 7d de 8d 46 1d 0a 73 d5 c6 4d d0 4c db bb 39 29 50 46 ba a9 e8 26 95 ac 04 e3 5e be f0 d5 fa a1 9a 51 2d 6a e2 8c ef 63 22 ee 86 9a b8 c2 89 c0 f6 2e 24 43 aa 03 1e a5 a4 d0 f2 9c ba 61 c0 83 4d 6a e9 9b 50 15 e5 8f d6 5b 64 ba f9 a2 26 28 e1 3a 3a a7 86 95 a9 = ks3 sbox4\r\n","matches":[[{"type":"absolute","value":1698568626},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[{"type":"absolute","value":1698568646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568677},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568679}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568691}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568696}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568701}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568708}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568715}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568722}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568595},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[{"type":"absolute","value":1698568646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568677},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568679}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568691}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568696}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568701}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568708}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568715}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568722}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using DES":{"meta":{"name":"encrypt data using DES","namespace":"data-manipulation/encryption/des","authors":["@_re_fox","william.ballenthin@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","3DES"],"objective":"Cryptography","behavior":"Encrypt Data","method":"3DES","id":"C0027.004"}],"references":[],"examples":["91a12a4cf437589ba70b1687f5acad19:0x47F5E8"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using DES\r\n    namespace: data-manipulation/encryption/des\r\n    authors:\r\n      - \"@_re_fox\"\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires characteristic, bytes, mnemonic features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\r\n      - Cryptography::Encrypt Data::3DES [C0027.004]\r\n    examples:\r\n      - 91a12a4cf437589ba70b1687f5acad19:0x47F5E8\r\n  features:\r\n    - or:\r\n      - bytes: 0e 04 0d 01 02 0f 0b 08 03 0a 06 0c 05 09 00 07 00 0f 07 04 0e 02 0d 01 0a 06 0c 0b 09 05 03 08 04 01 0e 08 0d 06 02 0b 0f 0c 09 07 03 0a 05 00 0f 0c 08 02 04 09 01 07 05 0b 03 0e 0a 00 06 0d = SBOX S1\r\n      - bytes: 0f 01 08 0e 06 0b 03 04 09 07 02 0d 0c 00 05 0a 03 0d 04 07 0f 02 08 0e 0c 00 01 0a 06 09 0b 05 00 0e 07 0b 0a 04 0d 01 05 08 0c 06 09 03 02 0f 0d 08 0a 01 03 0f 04 02 0b 06 07 0c 00 05 0e 09 = SBOX S2\r\n      - bytes: 0a 00 09 0e 06 03 0f 05 01 0d 0c 07 0b 04 02 08 0d 07 00 09 03 04 06 0a 02 08 05 0e 0c 0b 0f 01 0d 06 04 09 08 0f 03 00 0b 01 02 0c 05 0a 0e 07 01 0a 0d 00 06 09 08 07 04 0f 0e 03 0b 05 02 0c = SBOX S3\r\n      - bytes: 07 0d 0e 03 00 06 09 0a 01 02 08 05 0b 0c 04 0f 0d 08 0b 05 06 0f 00 03 04 07 02 0c 01 0a 0e 09 0a 06 09 00 0c 0b 07 0d 0f 01 03 0e 05 02 08 04 03 0f 00 06 0a 01 0d 08 09 04 05 0b 0c 07 02 0e = SBOX S4\r\n      - bytes: 02 0c 04 01 07 0a 0b 06 08 05 03 0f 0d 00 0e 09 0e 0b 02 0c 04 07 0d 01 05 00 0f 0a 03 09 08 06 04 02 01 0b 0a 0d 07 08 0f 09 0c 05 06 03 00 0e 0b 08 0c 07 01 0e 02 0d 06 0f 00 09 0a 04 05 03 = SBOX S5\r\n      - bytes: 0c 01 0a 0f 09 02 06 08 00 0d 03 04 0e 07 05 0b 0a 0f 04 02 07 0c 09 05 06 01 0d 0e 00 0b 03 08 09 0e 0f 05 02 08 0c 03 07 00 04 0a 01 0d 0b 06 04 03 02 0c 09 05 0f 0a 0b 0e 01 07 06 00 08 0d = SBOX S6\r\n      - bytes: 04 0b 02 0e 0f 00 08 0d 03 0c 09 07 05 0a 06 01 0d 00 0b 07 04 09 01 0a 0e 03 05 0c 02 0f 08 06 01 04 0b 0d 0c 03 07 0e 0a 0f 06 08 00 05 09 02 06 0b 0d 08 01 04 0a 07 09 05 00 0f 0e 02 03 0c = SBOX S7\r\n      - bytes: 0d 02 08 04 06 0f 0b 01 0a 09 03 0e 05 00 0c 07 01 0f 0d 08 0a 03 07 04 0c 05 06 0b 00 0e 09 02 07 0b 04 01 09 0c 0e 02 00 06 0a 0d 0f 03 05 08 02 01 0e 07 04 0a 08 0d 0f 0c 09 00 03 05 06 0b = SBOX S8\r\n      - bytes: 39 31 29 21 19 11 09 01 3a 32 2a 22 1a 12 0a 02 3b 33 2b 23 1b 13 0b 03 3c 34 2c 24 3f 37 2f 27 1f 17 0f 07 3e 36 2e 26 1e 16 0e 06 3d 35 2d 25 1d 15 0d 05 1c 14 0c 04  = PC1\r\n      - bytes: 0e 11 0b 18 01 05 03 1c 0f 06 15 0a 17 13 0c 04 1a 08 10 07 1b 14 0d 02 29 34 1f 25 2f 37 1e 28 33 2d 21 30 2c 31 27 38 22 35 2e 2a 32 24 1d 20  = PC2\r\n      - bytes: 3a 32 2a 22 1a 12 0a 02 3c 34 2c 24 1c 14 0c 04 3e 36 2e 26 1e 16 0e 06 40 38 30 28 20 18 10 08 39 31 29 21 19 11 09 01 3b 33 2b 23 1b 13 0b 03 3d 35 2d 25 1d 15 0d 05 3f 37 2f 27 1f 17 0f 07 = Initial Permutation\r\n      - bytes: 28 08 30 10 38 18 40 20 27 07 2f 0f 37 17 3f 1f 26 06 2e 0e 36 16 3e 1e 25 05 2d 0d 35 15 3d 1d 24 04 2c 0c 34 14 3c 1c 23 03 2b 0b 33 13 3b 1b 22 02 2a 0a 32 12 3a 1a 21 01 29 09 31 11 39 19 = Final Permutation\r\n      - bytes: 20 01 02 03 04 05 04 05 06 07 08 09 08 09 0a 0b 0c 0d 0c 0d 0e 0f 10 11 10 11 12 13 14 15 14 15 16 17 18 19 18 19 1a 1b 1c 1d 1c 1d 1e 1f 20 01 = DES Expansion\r\n      - bytes: 10 07 14 15 1d 0c 1c 11 01 0f 17 1a 05 12 1f 0a 02 08 18 0e 20 1b 03 09 13 0d 1e 06 16 0b 04 19 = PBOX\r\n      - and:\r\n        - description: DES RawProcessBlock\r\n        - number: 0x18\r\n        - number: 0x10\r\n        - number: 0x8\r\n        - number: 0x3f\r\n        - characteristic: nzxor\r\n        - count(mnemonic(shr)): 8 or more\r\n        - mnemonic: ror\r\n      - or:\r\n        - description: libtomcrypt implementation\r\n        - bytes: 38 30 28 20 18 10 08 00 39 31 29 21 19 11 09 01 3A 32 2A 22 1A 12 0A 02 3B 33 2B 23 3E 36 2E 26 1E 16 0E 06 3D 35 2D 25 1D 15 0D 05 3C 34 2C 24 1C 14 0C 04 1B 13 0B 03 = pc1\r\n        - bytes: 0D 10 0A 17 00 04 02 1B 0E 05 14 09 16 12 0B 03 19 07 0F 06 1A 13 0C 01 28 33 1E 24 2E 36 1D 27 32 2C 20 2F 2B 30 26 37 21 34 2D 29 31 23 1C 1F 00 00 00 00 00 00 00 00 = pc2\r\n        - bytes: 00 04 01 01 00 00 00 00 00 00 01 00 04 04 01 01 04 00 01 01 04 04 01 00 04 00 00 00 00 00 01 00 00 04 00 00 00 04 01 01 04 04 01 01 00 04 00 00 04 04 00 01 04 00 01 01 00 00 00 01 04 00 00 00 04 04 00 00 00 04 00 01 00 04 00 01 00 04 01 00 00 04 01 00 00 00 01 01 00 00 01 01 04 04 00 01 04 00 01 00 04 00 00 01 04 00 00 01 04 00 01 00 00 00 00 00 04 04 00 00 04 04 01 00 00 00 00 01 00 00 01 00 04 04 01 01 04 00 00 00 00 00 01 01 00 04 01 01 00 00 00 01 00 00 00 01 00 04 00 00 04 00 01 01 00 00 01 00 00 04 01 00 04 00 00 01 00 04 00 00 04 00 00 00 04 04 00 01 04 04 01 00 04 04 01 01 04 00 01 00 00 00 01 01 04 04 00 01 04 00 00 01 04 04 00 00 04 04 01 00 00 04 01 01 04 04 00 00 00 04 00 01 00 04 00 01 00 00 00 00 04 00 01 00 00 04 01 00 00 00 00 00 04 00 01 01 = SP1\r\n        - bytes: 20 80 10 80 00 80 00 80 00 80 00 00 20 80 10 00 00 00 10 00 20 00 00 00 20 00 10 80 20 80 00 80 20 00 00 80 20 80 10 80 00 80 10 80 00 00 00 80 00 80 00 80 00 00 10 00 20 00 00 00 20 00 10 80 00 80 10 00 20 00 10 00 20 80 00 80 00 00 00 00 00 00 00 80 00 80 00 00 20 80 10 00 00 00 10 80 20 00 10 00 20 00 00 80 00 00 00 00 00 80 10 00 20 80 00 00 00 80 10 80 00 00 10 80 20 80 00 00 00 00 00 00 20 80 10 00 20 00 10 80 00 00 10 00 20 80 00 80 00 00 10 80 00 80 10 80 00 80 00 00 00 00 10 80 00 80 00 80 20 00 00 00 20 80 10 80 20 80 10 00 20 00 00 00 00 80 00 00 00 00 00 80 20 80 00 00 00 80 10 80 00 00 10 00 20 00 00 80 20 00 10 00 20 80 00 80 20 00 00 80 20 00 10 00 00 80 10 00 00 00 00 00 00 80 00 80 20 80 00 00 00 00 00 80 20 00 10 80 20 80 10 80 00 80 10 00 = SP2\r\n        - bytes: 08 02 00 00 00 02 02 08 00 00 00 00 08 00 02 08 00 02 00 08 00 00 00 00 08 02 02 00 00 02 00 08 08 00 02 00 08 00 00 08 08 00 00 08 00 00 02 00 08 02 02 08 08 00 02 00 00 00 02 08 08 02 00 00 00 00 00 08 08 00 00 00 00 02 02 08 00 02 00 00 00 02 02 00 00 00 02 08 08 00 02 08 08 02 02 00 08 02 00 08 00 02 02 00 00 00 02 00 08 02 00 08 08 00 00 00 08 02 02 08 00 02 00 00 00 00 00 08 00 02 02 08 00 00 00 08 08 00 02 00 08 02 00 00 00 00 02 00 00 02 02 08 00 02 00 08 00 00 00 00 00 02 00 00 08 00 02 00 08 02 02 08 00 02 00 08 08 00 00 08 00 02 00 00 00 00 00 00 08 00 02 08 08 02 00 08 00 00 02 00 00 00 00 08 08 02 02 08 08 00 00 00 08 02 02 00 00 02 02 00 08 00 00 08 00 00 02 08 08 02 00 08 08 02 00 00 00 00 02 08 08 02 02 00 08 00 00 00 08 00 02 08 00 02 02 00 = SP3\r\n        - bytes: 01 20 80 00 81 20 00 00 81 20 00 00 80 00 00 00 80 20 80 00 81 00 80 00 01 00 80 00 01 20 00 00 00 00 00 00 00 20 80 00 00 20 80 00 81 20 80 00 81 00 00 00 00 00 00 00 80 00 80 00 01 00 80 00 01 00 00 00 00 20 00 00 00 00 80 00 01 20 80 00 80 00 00 00 00 00 80 00 01 20 00 00 80 20 00 00 81 00 80 00 01 00 00 00 80 20 00 00 80 00 80 00 00 20 00 00 80 20 80 00 81 20 80 00 81 00 00 00 80 00 80 00 01 00 80 00 00 20 80 00 81 20 80 00 81 00 00 00 00 00 00 00 00 00 00 00 00 20 80 00 80 20 00 00 80 00 80 00 81 00 80 00 01 00 00 00 01 20 80 00 81 20 00 00 81 20 00 00 80 00 00 00 81 20 80 00 81 00 00 00 01 00 00 00 00 20 00 00 01 00 80 00 01 20 00 00 80 20 80 00 81 00 80 00 01 20 00 00 80 20 00 00 00 00 80 00 01 20 80 00 80 00 00 00 00 00 80 00 00 20 00 00 80 20 80 00 = SP4\r\n        - bytes: 00 01 00 00 00 01 08 02 00 00 08 02 00 01 00 42 00 00 08 00 00 01 00 00 00 00 00 40 00 00 08 02 00 01 08 40 00 00 08 00 00 01 00 02 00 01 08 40 00 01 00 42 00 00 08 42 00 01 08 00 00 00 00 40 00 00 00 02 00 00 08 40 00 00 08 40 00 00 00 00 00 01 00 40 00 01 08 42 00 01 08 42 00 01 00 02 00 00 08 42 00 01 00 40 00 00 00 00 00 00 00 42 00 01 08 02 00 00 00 02 00 00 00 42 00 01 08 00 00 00 08 00 00 01 00 42 00 01 00 00 00 00 00 02 00 00 00 40 00 00 08 02 00 01 00 42 00 01 08 40 00 01 00 02 00 00 00 40 00 00 08 42 00 01 08 02 00 01 08 40 00 01 00 00 00 00 00 02 00 00 08 42 00 01 08 42 00 01 08 00 00 00 00 42 00 01 08 42 00 00 08 02 00 00 00 00 00 00 08 40 00 00 00 42 00 01 08 00 00 01 00 02 00 01 00 40 00 00 08 00 00 00 00 00 00 00 08 40 00 01 08 02 00 01 00 40 = SP5\r\n        - bytes: 10 00 00 20 00 00 40 20 00 40 00 00 10 40 40 20 00 00 40 20 10 00 00 00 10 40 40 20 00 00 40 00 00 40 00 20 10 40 40 00 00 00 40 00 10 00 00 20 10 00 40 00 00 40 00 20 00 00 00 20 10 40 00 00 00 00 00 00 10 00 40 00 10 40 00 20 00 40 00 00 00 40 40 00 10 40 00 20 10 00 00 00 10 00 40 20 10 00 40 20 00 00 00 00 10 40 40 00 00 40 40 20 10 40 00 00 00 40 40 00 00 40 40 20 00 00 00 20 00 40 00 20 10 00 00 00 10 00 40 20 00 40 40 00 10 40 40 20 00 00 40 00 10 40 00 00 10 00 00 20 00 00 40 00 00 40 00 20 00 00 00 20 10 40 00 00 10 00 00 20 10 40 40 20 00 40 40 00 00 00 40 20 10 40 40 00 00 40 40 20 00 00 00 00 10 00 40 20 10 00 00 00 00 40 00 00 00 00 40 20 10 40 40 00 00 40 00 00 10 00 40 00 10 40 00 20 00 00 00 00 00 40 40 20 00 00 00 20 10 00 40 00 10 40 00 20 = SP6\r\n        - bytes: 00 00 20 00 02 00 20 04 02 08 00 04 00 00 00 00 00 08 00 00 02 08 00 04 02 08 20 00 00 08 20 04 02 08 20 04 00 00 20 00 00 00 00 00 02 00 00 04 02 00 00 00 00 00 00 04 02 00 20 04 02 08 00 00 00 08 00 04 02 08 20 00 02 00 20 00 00 08 00 04 02 00 00 04 00 00 20 04 00 08 20 04 02 00 20 00 00 00 20 04 00 08 00 00 02 08 00 00 02 08 20 04 00 08 20 00 02 00 00 00 00 00 00 04 00 08 20 00 00 00 00 04 00 08 20 00 00 00 20 00 02 08 00 04 02 08 00 04 02 00 20 04 02 00 20 04 02 00 00 00 02 00 20 00 00 00 00 04 00 08 00 04 00 00 20 00 00 08 20 04 02 08 00 00 02 08 20 00 00 08 20 04 02 08 00 00 02 00 00 04 02 08 20 04 00 00 20 04 00 08 20 00 00 00 00 00 02 00 00 00 02 08 20 04 00 00 00 00 02 08 20 00 00 00 20 04 00 08 00 00 02 00 00 04 00 08 00 04 00 08 00 00 02 00 20 00 = SP7\r\n        - bytes: 40 10 00 10 00 10 00 00 00 00 04 00 40 10 04 10 00 00 00 10 40 10 00 10 40 00 00 00 00 00 00 10 40 00 04 00 00 00 04 10 40 10 04 10 00 10 04 00 00 10 04 10 40 10 04 00 00 10 00 00 40 00 00 00 00 00 04 10 40 00 00 10 00 10 00 10 40 10 00 00 00 10 04 00 40 00 04 00 40 00 04 10 00 10 04 10 40 10 00 00 00 00 00 00 00 00 00 00 40 00 04 10 40 00 00 10 00 10 00 10 40 10 04 00 00 00 04 00 40 10 04 00 00 00 04 00 00 10 04 10 00 10 00 00 40 00 00 00 40 00 04 10 00 10 00 00 40 10 04 00 00 10 00 10 40 00 00 00 40 00 00 10 00 00 04 10 40 00 04 10 00 00 00 10 00 00 04 00 40 10 00 10 00 00 00 00 40 10 04 10 40 00 04 00 40 00 00 10 00 00 04 10 00 10 00 10 40 10 00 10 00 00 00 00 40 10 04 10 00 10 04 00 00 10 04 00 40 10 00 00 40 10 00 00 40 00 04 00 00 00 00 10 00 10 04 10 = SP8\r\n","matches":[[{"type":"absolute","value":1698595729},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0e040d01020f0b08030a060c05090007000f07040e020d010a060c0b0905030804010e080d06020b0f0c0907030a05000f0c080204090107050b030e0a00060d","description":"SBOX S1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0f01080e060b03040907020d0c00050a030d04070f02080e0c00010a06090b05000e070b0a040d0105080c060903020f0d080a01030f04020b06070c00050e09","description":"SBOX S2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0a00090e06030f05010d0c070b0402080d0700090304060a0208050e0c0b0f010d060409080f03000b01020c050a0e07010a0d0006090807040f0e030b05020c","description":"SBOX S3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"070d0e030006090a010208050b0c040f0d080b05060f00030407020c010a0e090a0609000c0b070d0f01030e05020804030f00060a010d080904050b0c07020e","description":"SBOX S4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"020c0401070a0b060805030f0d000e090e0b020c04070d0105000f0a030908060402010b0a0d07080f090c050603000e0b080c07010e020d060f00090a040503","description":"SBOX S5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0c010a0f09020608000d03040e07050b0a0f0402070c090506010d0e000b0308090e0f0502080c030700040a010d0b060403020c09050f0a0b0e01070600080d","description":"SBOX S6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"040b020e0f00080d030c0907050a06010d000b070409010a0e03050c020f080601040b0d0c03070e0a0f060800050902060b0d0801040a070905000f0e02030c","description":"SBOX S7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0d020804060f0b010a09030e05000c07010f0d080a0307040c05060b000e0902070b0401090c0e0200060a0d0f03050802010e07040a080d0f0c09000305060b","description":"SBOX S8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"39312921191109013a322a221a120a023b332b231b130b033c342c243f372f271f170f073e362e261e160e063d352d251d150d051c140c04","description":"PC1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0e110b180105031c0f06150a17130c041a0810071b140d0229341f252f371e28332d21302c31273822352e2a32241d20","description":"PC2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3a322a221a120a023c342c241c140c043e362e261e160e06403830282018100839312921191109013b332b231b130b033d352d251d150d053f372f271f170f07","description":"Initial Permutation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"280830103818402027072f0f37173f1f26062e0e36163e1e25052d0d35153d1d24042c0c34143c1c23032b0b33133b1b22022a0a32123a1a2101290931113919","description":"Final Permutation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"20010203040504050607080908090a0b0c0d0c0d0e0f101110111213141514151617181918191a1b1c1d1c1d1e1f2001","description":"DES Expansion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"100714151d0c1c11010f171a05121f0a0208180e201b0309130d1e06160b0419","description":"PBOX"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"DES RawProcessBlock"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24}},"children":[],"locations":[{"type":"absolute","value":1698596930},{"type":"absolute","value":1698596994},{"type":"absolute","value":1698597119},{"type":"absolute","value":1698596805},{"type":"absolute","value":1698596680},{"type":"absolute","value":1698596744},{"type":"absolute","value":1698596619},{"type":"absolute","value":1698596430},{"type":"absolute","value":1698596494},{"type":"absolute","value":1698596305},{"type":"absolute","value":1698596369},{"type":"absolute","value":1698596563},{"type":"absolute","value":1698596180},{"type":"absolute","value":1698596244},{"type":"absolute","value":1698596881},{"type":"absolute","value":1698596119},{"type":"absolute","value":1698596060},{"type":"absolute","value":1698595997},{"type":"absolute","value":1698595942},{"type":"absolute","value":1698597369},{"type":"absolute","value":1698597744},{"type":"absolute","value":1698597810},{"type":"absolute","value":1698597555},{"type":"absolute","value":1698597619},{"type":"absolute","value":1698597684},{"type":"absolute","value":1698597430},{"type":"absolute","value":1698597494},{"type":"absolute","value":1698597244},{"type":"absolute","value":1698597305},{"type":"absolute","value":1698597876},{"type":"absolute","value":1698597180},{"type":"absolute","value":1698597055}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":16}},"children":[],"locations":[{"type":"absolute","value":1698597184},{"type":"absolute","value":1698597248},{"type":"absolute","value":1698597373},{"type":"absolute","value":1698597059},{"type":"absolute","value":1698597123},{"type":"absolute","value":1698596869},{"type":"absolute","value":1698596934},{"type":"absolute","value":1698596998},{"type":"absolute","value":1698596809},{"type":"absolute","value":1698596555},{"type":"absolute","value":1698596684},{"type":"absolute","value":1698595789},{"type":"absolute","value":1698596748},{"type":"absolute","value":1698596623},{"type":"absolute","value":1698596434},{"type":"absolute","value":1698596498},{"type":"absolute","value":1698596309},{"type":"absolute","value":1698596373},{"type":"absolute","value":1698596184},{"type":"absolute","value":1698596248},{"type":"absolute","value":1698595801},{"type":"absolute","value":1698596123},{"type":"absolute","value":1698597980},{"type":"absolute","value":1698596064},{"type":"absolute","value":1698596001},{"type":"absolute","value":1698597990},{"type":"absolute","value":1698595946},{"type":"absolute","value":1698597623},{"type":"absolute","value":1698597680},{"type":"absolute","value":1698597879},{"type":"absolute","value":1698597748},{"type":"absolute","value":1698597498},{"type":"absolute","value":1698597559},{"type":"absolute","value":1698597814},{"type":"absolute","value":1698597434},{"type":"absolute","value":1698597309}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8}},"children":[],"locations":[{"type":"absolute","value":1698595842},{"type":"absolute","value":1698596290},{"type":"absolute","value":1698596354},{"type":"absolute","value":1698596165},{"type":"absolute","value":1698596229},{"type":"absolute","value":1698596106},{"type":"absolute","value":1698596047},{"type":"absolute","value":1698595984},{"type":"absolute","value":1698595921},{"type":"absolute","value":1698596665},{"type":"absolute","value":1698595864},{"type":"absolute","value":1698597945},{"type":"absolute","value":1698597665},{"type":"absolute","value":1698596540},{"type":"absolute","value":1698597729},{"type":"absolute","value":1698597540},{"type":"absolute","value":1698597604},{"type":"absolute","value":1698597793},{"type":"absolute","value":1698597415},{"type":"absolute","value":1698597479},{"type":"absolute","value":1698597858},{"type":"absolute","value":1698597290},{"type":"absolute","value":1698597354},{"type":"absolute","value":1698597928},{"type":"absolute","value":1698596415},{"type":"absolute","value":1698597165},{"type":"absolute","value":1698597229},{"type":"absolute","value":1698597040},{"type":"absolute","value":1698597104},{"type":"absolute","value":1698596915},{"type":"absolute","value":1698596979},{"type":"absolute","value":1698596790},{"type":"absolute","value":1698596854},{"type":"absolute","value":1698596729},{"type":"absolute","value":1698596604},{"type":"absolute","value":1698596479}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63}},"children":[],"locations":[{"type":"absolute","value":1698596096},{"type":"absolute","value":1698596608},{"type":"absolute","value":1698597377},{"type":"absolute","value":1698597381},{"type":"absolute","value":1698596358},{"type":"absolute","value":1698597127},{"type":"absolute","value":1698596873},{"type":"absolute","value":1698597131},{"type":"absolute","value":1698596109},{"type":"absolute","value":1698596627},{"type":"absolute","value":1698596885},{"type":"absolute","value":1698597653},{"type":"absolute","value":1698596631},{"type":"absolute","value":1698596377},{"type":"absolute","value":1698597403},{"type":"absolute","value":1698596381},{"type":"absolute","value":1698596126},{"type":"absolute","value":1698597153},{"type":"absolute","value":1698596130},{"type":"absolute","value":1698597669},{"type":"absolute","value":1698596903},{"type":"absolute","value":1698597419},{"type":"absolute","value":1698596653},{"type":"absolute","value":1698597169},{"type":"absolute","value":1698596403},{"type":"absolute","value":1698596151},{"type":"absolute","value":1698596919},{"type":"absolute","value":1698597688},{"type":"absolute","value":1698597692},{"type":"absolute","value":1698596669},{"type":"absolute","value":1698597438},{"type":"absolute","value":1698597442},{"type":"absolute","value":1698596419},{"type":"absolute","value":1698597188},{"type":"absolute","value":1698595910},{"type":"absolute","value":1698597883},{"type":"absolute","value":1698596169},{"type":"absolute","value":1698596938},{"type":"absolute","value":1698597196},{"type":"absolute","value":1698596942},{"type":"absolute","value":1698596688},{"type":"absolute","value":1698595924},{"type":"absolute","value":1698596692},{"type":"absolute","value":1698596438},{"type":"absolute","value":1698597718},{"type":"absolute","value":1698596442},{"type":"absolute","value":1698596188},{"type":"absolute","value":1698597468},{"type":"absolute","value":1698596192},{"type":"absolute","value":1698597218},{"type":"absolute","value":1698597733},{"type":"absolute","value":1698596968},{"type":"absolute","value":1698597483},{"type":"absolute","value":1698595949},{"type":"absolute","value":1698596718},{"type":"absolute","value":1698595953},{"type":"absolute","value":1698597233},{"type":"absolute","value":1698596468},{"type":"absolute","value":1698596983},{"type":"absolute","value":1698597752},{"type":"absolute","value":1698596218},{"type":"absolute","value":1698597756},{"type":"absolute","value":1698596733},{"type":"absolute","value":1698597502},{"type":"absolute","value":1698595967},{"type":"absolute","value":1698597506},{"type":"absolute","value":1698596483},{"type":"absolute","value":1698597252},{"type":"absolute","value":1698597256},{"type":"absolute","value":1698596233},{"type":"absolute","value":1698597002},{"type":"absolute","value":1698597006},{"type":"absolute","value":1698596752},{"type":"absolute","value":1698597778},{"type":"absolute","value":1698595987},{"type":"absolute","value":1698596756},{"type":"absolute","value":1698596502},{"type":"absolute","value":1698597528},{"type":"absolute","value":1698596506},{"type":"absolute","value":1698596252},{"type":"absolute","value":1698597278},{"type":"absolute","value":1698596256},{"type":"absolute","value":1698596004},{"type":"absolute","value":1698597028},{"type":"absolute","value":1698597797},{"type":"absolute","value":1698596008},{"type":"absolute","value":1698597544},{"type":"absolute","value":1698596778},{"type":"absolute","value":1698597294},{"type":"absolute","value":1698596528},{"type":"absolute","value":1698597044},{"type":"absolute","value":1698596278},{"type":"absolute","value":1698597817},{"type":"absolute","value":1698596794},{"type":"absolute","value":1698597563},{"type":"absolute","value":1698597821},{"type":"absolute","value":1698597567},{"type":"absolute","value":1698596032},{"type":"absolute","value":1698596544},{"type":"absolute","value":1698597313},{"type":"absolute","value":1698597317},{"type":"absolute","value":1698596294},{"type":"absolute","value":1698597063},{"type":"absolute","value":1698597067},{"type":"absolute","value":1698596813},{"type":"absolute","value":1698596559},{"type":"absolute","value":1698596817},{"type":"absolute","value":1698596050},{"type":"absolute","value":1698596567},{"type":"absolute","value":1698597847},{"type":"absolute","value":1698596313},{"type":"absolute","value":1698597593},{"type":"absolute","value":1698596317},{"type":"absolute","value":1698597343},{"type":"absolute","value":1698596067},{"type":"absolute","value":1698597093},{"type":"absolute","value":1698596071},{"type":"absolute","value":1698597608},{"type":"absolute","value":1698597865},{"type":"absolute","value":1698596843},{"type":"absolute","value":1698597358},{"type":"absolute","value":1698596593},{"type":"absolute","value":1698597108},{"type":"absolute","value":1698596343},{"type":"absolute","value":1698596858},{"type":"absolute","value":1698597627},{"type":"absolute","value":1698597886},{"type":"absolute","value":1698597631}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698597890},{"type":"absolute","value":1698595845},{"type":"absolute","value":1698597385},{"type":"absolute","value":1698596362},{"type":"absolute","value":1698597897},{"type":"absolute","value":1698596877},{"type":"absolute","value":1698597389},{"type":"absolute","value":1698595855},{"type":"absolute","value":1698597907},{"type":"absolute","value":1698597397},{"type":"absolute","value":1698596889},{"type":"absolute","value":1698597917},{"type":"absolute","value":1698595870},{"type":"absolute","value":1698597407},{"type":"absolute","value":1698597920},{"type":"absolute","value":1698596385},{"type":"absolute","value":1698596897},{"type":"absolute","value":1698596389},{"type":"absolute","value":1698595882},{"type":"absolute","value":1698596907},{"type":"absolute","value":1698597932},{"type":"absolute","value":1698596397},{"type":"absolute","value":1698597423},{"type":"absolute","value":1698595892},{"type":"absolute","value":1698597942},{"type":"absolute","value":1698595895},{"type":"absolute","value":1698596407},{"type":"absolute","value":1698595898},{"type":"absolute","value":1698596923},{"type":"absolute","value":1698597949},{"type":"absolute","value":1698597446},{"type":"absolute","value":1698596423},{"type":"absolute","value":1698597958},{"type":"absolute","value":1698595913},{"type":"absolute","value":1698597450},{"type":"absolute","value":1698597966},{"type":"absolute","value":1698596946},{"type":"absolute","value":1698597461},{"type":"absolute","value":1698596950},{"type":"absolute","value":1698597977},{"type":"absolute","value":1698595931},{"type":"absolute","value":1698596446},{"type":"absolute","value":1698595935},{"type":"absolute","value":1698597472},{"type":"absolute","value":1698596961},{"type":"absolute","value":1698596450},{"type":"absolute","value":1698597983},{"type":"absolute","value":1698597988},{"type":"absolute","value":1698597993},{"type":"absolute","value":1698596972},{"type":"absolute","value":1698596461},{"type":"absolute","value":1698597487},{"type":"absolute","value":1698598000},{"type":"absolute","value":1698595956},{"type":"absolute","value":1698596472},{"type":"absolute","value":1698595963},{"type":"absolute","value":1698596987},{"type":"absolute","value":1698598011},{"type":"absolute","value":1698597510},{"type":"absolute","value":1698596487},{"type":"absolute","value":1698595977},{"type":"absolute","value":1698597514},{"type":"absolute","value":1698598025},{"type":"absolute","value":1698597010},{"type":"absolute","value":1698597522},{"type":"absolute","value":1698595990},{"type":"absolute","value":1698597014},{"type":"absolute","value":1698597532},{"type":"absolute","value":1698596510},{"type":"absolute","value":1698597022},{"type":"absolute","value":1698596514},{"type":"absolute","value":1698597032},{"type":"absolute","value":1698596522},{"type":"absolute","value":1698596011},{"type":"absolute","value":1698597548},{"type":"absolute","value":1698596532},{"type":"absolute","value":1698596022},{"type":"absolute","value":1698597048},{"type":"absolute","value":1698596026},{"type":"absolute","value":1698597571},{"type":"absolute","value":1698596036},{"type":"absolute","value":1698596548},{"type":"absolute","value":1698597575},{"type":"absolute","value":1698597071},{"type":"absolute","value":1698597586},{"type":"absolute","value":1698597075},{"type":"absolute","value":1698596053},{"type":"absolute","value":1698596571},{"type":"absolute","value":1698597597},{"type":"absolute","value":1698597086},{"type":"absolute","value":1698596575},{"type":"absolute","value":1698597097},{"type":"absolute","value":1698596074},{"type":"absolute","value":1698596586},{"type":"absolute","value":1698597612},{"type":"absolute","value":1698596078},{"type":"absolute","value":1698596597},{"type":"absolute","value":1698597112},{"type":"absolute","value":1698596089},{"type":"absolute","value":1698596099},{"type":"absolute","value":1698596612},{"type":"absolute","value":1698597635},{"type":"absolute","value":1698597639},{"type":"absolute","value":1698597135},{"type":"absolute","value":1698596112},{"type":"absolute","value":1698597647},{"type":"absolute","value":1698597139},{"type":"absolute","value":1698597657},{"type":"absolute","value":1698596635},{"type":"absolute","value":1698597147},{"type":"absolute","value":1698596639},{"type":"absolute","value":1698596133},{"type":"absolute","value":1698597157},{"type":"absolute","value":1698596647},{"type":"absolute","value":1698596137},{"type":"absolute","value":1698597673},{"type":"absolute","value":1698596145},{"type":"absolute","value":1698596657},{"type":"absolute","value":1698597173},{"type":"absolute","value":1698596154},{"type":"absolute","value":1698597696},{"type":"absolute","value":1698596673},{"type":"absolute","value":1698597700},{"type":"absolute","value":1698597192},{"type":"absolute","value":1698596173},{"type":"absolute","value":1698597711},{"type":"absolute","value":1698597200},{"type":"absolute","value":1698596696},{"type":"absolute","value":1698597722},{"type":"absolute","value":1698597211},{"type":"absolute","value":1698596700},{"type":"absolute","value":1698596196},{"type":"absolute","value":1698597222},{"type":"absolute","value":1698596711},{"type":"absolute","value":1698596200},{"type":"absolute","value":1698597737},{"type":"absolute","value":1698596722},{"type":"absolute","value":1698596211},{"type":"absolute","value":1698597237},{"type":"absolute","value":1698596222},{"type":"absolute","value":1698597760},{"type":"absolute","value":1698596737},{"type":"absolute","value":1698597764},{"type":"absolute","value":1698597260},{"type":"absolute","value":1698596237},{"type":"absolute","value":1698597772},{"type":"absolute","value":1698597264},{"type":"absolute","value":1698597782},{"type":"absolute","value":1698596760},{"type":"absolute","value":1698597272},{"type":"absolute","value":1698596764},{"type":"absolute","value":1698597282},{"type":"absolute","value":1698596260},{"type":"absolute","value":1698596772},{"type":"absolute","value":1698597801},{"type":"absolute","value":1698596268},{"type":"absolute","value":1698596782},{"type":"absolute","value":1698596272},{"type":"absolute","value":1698597298},{"type":"absolute","value":1698595770},{"type":"absolute","value":1698596282},{"type":"absolute","value":1698596798},{"type":"absolute","value":1698597824},{"type":"absolute","value":1698595779},{"type":"absolute","value":1698597829},{"type":"absolute","value":1698595785},{"type":"absolute","value":1698596298},{"type":"absolute","value":1698597321},{"type":"absolute","value":1698597325},{"type":"absolute","value":1698595792},{"type":"absolute","value":1698597840},{"type":"absolute","value":1698596821},{"type":"absolute","value":1698595798},{"type":"absolute","value":1698597336},{"type":"absolute","value":1698596825},{"type":"absolute","value":1698597851},{"type":"absolute","value":1698595804},{"type":"absolute","value":1698596321},{"type":"absolute","value":1698597347},{"type":"absolute","value":1698595812},{"type":"absolute","value":1698596325},{"type":"absolute","value":1698596836},{"type":"absolute","value":1698597869},{"type":"absolute","value":1698596847},{"type":"absolute","value":1698596336},{"type":"absolute","value":1698597362},{"type":"absolute","value":1698595827},{"type":"absolute","value":1698596347},{"type":"absolute","value":1698595836},{"type":"absolute","value":1698596862}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":8,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shr"}}},"children":[],"locations":[{"type":"absolute","value":1698595842},{"type":"absolute","value":1698596354},{"type":"absolute","value":1698597123},{"type":"absolute","value":1698596869},{"type":"absolute","value":1698596106},{"type":"absolute","value":1698596619},{"type":"absolute","value":1698596623},{"type":"absolute","value":1698596369},{"type":"absolute","value":1698596881},{"type":"absolute","value":1698596373},{"type":"absolute","value":1698596119},{"type":"absolute","value":1698596123},{"type":"absolute","value":1698597665},{"type":"absolute","value":1698597415},{"type":"absolute","value":1698597928},{"type":"absolute","value":1698597165},{"type":"absolute","value":1698597680},{"type":"absolute","value":1698596915},{"type":"absolute","value":1698597684},{"type":"absolute","value":1698597879},{"type":"absolute","value":1698597430},{"type":"absolute","value":1698596665},{"type":"absolute","value":1698597434},{"type":"absolute","value":1698597180},{"type":"absolute","value":1698596415},{"type":"absolute","value":1698597184},{"type":"absolute","value":1698596930},{"type":"absolute","value":1698597955},{"type":"absolute","value":1698596165},{"type":"absolute","value":1698596934},{"type":"absolute","value":1698596680},{"type":"absolute","value":1698596684},{"type":"absolute","value":1698596430},{"type":"absolute","value":1698595921},{"type":"absolute","value":1698596434},{"type":"absolute","value":1698596180},{"type":"absolute","value":1698596184},{"type":"absolute","value":1698597980},{"type":"absolute","value":1698597729},{"type":"absolute","value":1698595942},{"type":"absolute","value":1698597479},{"type":"absolute","value":1698595946},{"type":"absolute","value":1698597229},{"type":"absolute","value":1698597997},{"type":"absolute","value":1698597744},{"type":"absolute","value":1698596979},{"type":"absolute","value":1698597748},{"type":"absolute","value":1698597494},{"type":"absolute","value":1698596729},{"type":"absolute","value":1698597498},{"type":"absolute","value":1698597244},{"type":"absolute","value":1698596479},{"type":"absolute","value":1698597248},{"type":"absolute","value":1698596994},{"type":"absolute","value":1698596229},{"type":"absolute","value":1698596998},{"type":"absolute","value":1698596744},{"type":"absolute","value":1698596748},{"type":"absolute","value":1698596494},{"type":"absolute","value":1698595984},{"type":"absolute","value":1698596498},{"type":"absolute","value":1698596244},{"type":"absolute","value":1698596248},{"type":"absolute","value":1698595997},{"type":"absolute","value":1698596001},{"type":"absolute","value":1698597793},{"type":"absolute","value":1698597540},{"type":"absolute","value":1698597290},{"type":"absolute","value":1698597040},{"type":"absolute","value":1698597810},{"type":"absolute","value":1698597555},{"type":"absolute","value":1698596790},{"type":"absolute","value":1698595767},{"type":"absolute","value":1698597559},{"type":"absolute","value":1698597305},{"type":"absolute","value":1698597814},{"type":"absolute","value":1698596540},{"type":"absolute","value":1698597309},{"type":"absolute","value":1698597055},{"type":"absolute","value":1698596290},{"type":"absolute","value":1698597059},{"type":"absolute","value":1698596805},{"type":"absolute","value":1698596809},{"type":"absolute","value":1698596555},{"type":"absolute","value":1698595789},{"type":"absolute","value":1698596047},{"type":"absolute","value":1698596305},{"type":"absolute","value":1698596563},{"type":"absolute","value":1698596309},{"type":"absolute","value":1698596060},{"type":"absolute","value":1698596064},{"type":"absolute","value":1698595809},{"type":"absolute","value":1698597858},{"type":"absolute","value":1698597604},{"type":"absolute","value":1698597354},{"type":"absolute","value":1698597104},{"type":"absolute","value":1698597619},{"type":"absolute","value":1698597876},{"type":"absolute","value":1698596854},{"type":"absolute","value":1698597623},{"type":"absolute","value":1698597369},{"type":"absolute","value":1698596604},{"type":"absolute","value":1698597373},{"type":"absolute","value":1698597119}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"ror"}},"children":[],"locations":[{"type":"absolute","value":1698596832},{"type":"absolute","value":1698596707},{"type":"absolute","value":1698597923},{"type":"absolute","value":1698596582},{"type":"absolute","value":1698596457},{"type":"absolute","value":1698597707},{"type":"absolute","value":1698596332},{"type":"absolute","value":1698597837},{"type":"absolute","value":1698597582},{"type":"absolute","value":1698596207},{"type":"absolute","value":1698597457},{"type":"absolute","value":1698597905},{"type":"absolute","value":1698597332},{"type":"absolute","value":1698596085},{"type":"absolute","value":1698595927},{"type":"absolute","value":1698597082},{"type":"absolute","value":1698596957},{"type":"absolute","value":1698597207}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"libtomcrypt implementation"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"383028201810080039312921191109013a322a221a120a023b332b233e362e261e160e063d352d251d150d053c342c241c140c041b130b03","description":"pc1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0d100a170004021b0e05140916120b0319070f061a130c0128331e242e361d27322c202f2b30263721342d2931231c1f0000000000000000","description":"pc2"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00040101000000000000010004040101040001010404010004000000000001000004000000040101040401010004000004040001040001010000000104000000040400000004000100040001000401000004010000000101000001010404000104000100040000010400000104000100000000000404000004040100000000010000010004040101040000000000010100040101000000010000000100040000040001010000010000040100040000010004000004000000040400010404010004040101040001000000010104040001040000010404000004040100000401010404000000040001000400010000000004000100000401000000000004000101","description":"SP1"}},"children":[],"locations":[{"type":"absolute","value":1698596015}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"20801080008000800080000020801000000010002000000020001080208000802000008020801080008010800000008000800080000010002000000020001080008010002000100020800080000000000000008000800000208010000000108020001000200000800000000000801000208000000080108000001080208000000000000020801000200010800000100020800080000010800080108000800000000010800080008020000000208010802080100020000000008000000000008020800000008010800000100020000080200010002080008020000080200010000080100000000000008000802080000000000080200010802080108000801000","description":"SP2"}},"children":[],"locations":[{"type":"absolute","value":1698595829}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08020000000202080000000008000208000200080000000008020200000200080800020008000008080000080000020008020208080002000000020808020000000000080800000000020208000200000002020000000208080002080802020008020008000202000000020008020008080000000802020800020000000000080002020800000008080002000802000000000200000202080002000800000000000200000800020008020208000200080800000800020000000000000800020808020008000002000000000808020208080000000802020000020200080000080000020808020008080200000000020808020200080000000800020800020200","description":"SP3"}},"children":[],"locations":[{"type":"absolute","value":1698595857}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01208000812000008120000080000000802080008100800001008000012000000000000000208000002080008120800081000000000000008000800001008000010000000020000000008000012080008000000000008000012000008020000081008000010000008020000080008000002000008020800081208000810000008000800001008000002080008120800081000000000000000000000000208000802000008000800081008000010000000120800081200000812000008000000081208000810000000100000000200000010080000120000080208000810080000120000080200000000080000120800080000000000080000020000080208000","description":"SP4"}},"children":[],"locations":[{"type":"absolute","value":1698595749}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00010000000108020000080200010042000008000001000000000040000008020001084000000800000100020001084000010042000008420001080000000040000000020000084000000840000000000001004000010842000108420001000200000842000100400000000000000042000108020000000200000042000108000000080000010042000100000000000200000040000008020001004200010840000100020000004000000842000108020001084000010000000000020000084200010842000108000000004200010842000008020000000000000840000000420001080000010002000100400000080000000000000008400001080200010040","description":"SP5"}},"children":[],"locations":[{"type":"absolute","value":1698595970}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"10000020000040200040000010404020000040201000000010404020000040000040002010404000000040001000002010004000004000200000002010400000000000001000400010400020004000000040400010400020100000001000402010004020000000001040400000404020104000000040400000404020000000200040002010000000100040200040400010404020000040001040000010000020000040000040002000000020104000001000002010404020004040000000402010404000004040200000000010004020100000000040000000004020104040000040000010004000104000200000000000404020000000201000400010400020","description":"SP6"}},"children":[],"locations":[{"type":"absolute","value":1698595742}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00002000020020040208000400000000000800000208000402082000000820040208200400002000000000000200000402000000000000040200200402080000000800040208200002002000000800040200000400002004000820040200200000002004000800000208000002082004000820000200000000000004000820000000000400082000000020000208000402080004020020040200200402000000020020000000000400080004000020000008200402080000020820000008200402080000020000040208200400002004000820000000000002000000020820040000000002082000000020040008000002000004000800040008000002002000","description":"SP7"}},"children":[],"locations":[{"type":"absolute","value":1698595873}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"40100010001000000000040040100410000000104010001040000000000000104000040000000410401004100010040000100410401004000010000040000000000004104000001000100010401000000010040040000400400004100010041040100000000000000000000040000410400000100010001040100400000004004010040000000400001004100010000040000000400004100010000040100400001000104000000040000010000004104000041000000010000004004010001000000000401004104000040040000010000004100010001040100010000000004010041000100400001004004010000040100000400004000000001000100410","description":"SP8"}},"children":[],"locations":[{"type":"absolute","value":1698595735}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using twofish":{"meta":{"name":"encrypt data using twofish","namespace":"data-manipulation/encryption/twofish","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","Twofish"],"objective":"Cryptography","behavior":"Encrypt Data","method":"Twofish","id":"C0027.005"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x653F801C"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using twofish\r\n    namespace: data-manipulation/encryption/twofish\r\n    authors:\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires bytes features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\r\n      - Cryptography::Encrypt Data::Twofish [C0027.005]\r\n    examples:\r\n      - 0761142efbda6c4b1e801223de723578:0x653F801C\r\n  features:\r\n    - or:\r\n      - bytes: A9 67 B3 E8 04 FD A3 76 9A 92 80 78 E4 DD D1 38 0D C6 35 98 18 F7 EC 6C 43 75 37 26 FA 13 94 48 F2 D0 8B 30 84 54 DF 23 19 5B 3D 59 F3 AE A2 82 63 01 83 2E D9 51 9B 7C A6 EB A5 BE 16 0C E3 61 C0 8C 3A F5 73 2C 25 0B BB 4E 89 6B 53 6A B4 F1 E1 E6 BD 45 E2 F4 B6 66 CC 95 03 56 D4 1C 1E D7 FB C3 8E B5 E9 CF BF BA EA 77 39 AF 33 C9 62 71 81 79 09 AD 24 CD F9 D8 E5 C5 B9 4D 44 08 86 E7 A1 1D AA ED 06 70 B2 D2 41 7B A0 11 31 C2 27 90 20 F6 60 FF 96 5C B1 AB 9E 9C 52 1B 5F 93 0A EF 91 85 49 EE 2D 4F 8F 3B 47 87 6D = Q0\r\n      - bytes: 75 F3 C6 F4 DB 7B FB C8 4A D3 E6 6B 45 7D E8 4B D6 32 D8 FD 37 71 F1 E1 30 0F F8 1B 87 FA 06 3F 5E BA AE 5B 8A 00 BC 9D 6D C1 B1 0E 80 5D D2 D5 A0 84 07 14 B5 90 2C A3 B2 73 4C 54 92 74 36 51 38 B0 BD 5A FC 60 62 96 6C 42 F7 10 7C 28 27 8C 13 95 9C C7 24 46 3B 70 CA E3 85 CB 11 D0 93 B8 A6 83 20 FF 9F 77 C3 CC 03 6F 08 BF 40 E7 2B E2 79 0C AA 82 41 3A EA B9 E4 9A A4 97 7E DA 7A 17 66 94 A1 1D 3D F0 DE B3 0B 72 A7 1C EF D1 53 3E 8F 33 26 5F EC 76 2A 49 81 88 EE 21 C4 1A EB D9 C5 39 99 CD AD 31 8B 01 18 23 DD = Q1\r\n      - bytes: 75 32 BC BC F3 21 EC EC C6 43 20 20 F4 C9 B3 B3 DB 03 DA DA 7B 8B 02 02 FB 2B E2 E2 C8 FA 9E 9E 4A EC C9 C9 D3 09 D4 D4 E6 6B 18 18 6B 9F 1E 1E 45 0E 98 98 7D 38 B2 B2 E8 D2 A6 A6 4B B7 26 26 D6 57 3C 3C 32 8A 93 93 D8 EE 82 82 FD 98 52 52 37 D4 7B 7B 71 37 BB BB F1 97 5B 5B E1 83 47 47 30 3C 24 24 0F E2 51 51 F8 C6 BA BA 1B F3 4A 4A 87 48 BF BF FA 70 0D 0D 06 B3 B0 B0 3F DE 75 75 5E FD D2 D2 BA 20 7D 7D AE 31 66 66 5B A3 3A 3A 8A 1C 59 59 00 00 00 00 BC 93 CD CD 9D E0 1A 1A 6D 2C AE AE C1 AB 7F 7F B1 C7 2B = MDS1\r\n      - bytes: 39 39 D9 A9 17 17 90 67 9C 9C 71 B3 A6 A6 D2 E8 07 07 05 04 52 52 98 FD 80 80 65 A3 E4 E4 DF 76 45 45 08 9A 4B 4B 02 92 E0 E0 A0 80 5A 5A 66 78 AF AF DD E4 6A 6A B0 DD 63 63 BF D1 2A 2A 36 38 E6 E6 54 0D 20 20 43 C6 CC CC 62 35 F2 F2 BE 98 12 12 1E 18 EB EB 24 F7 A1 A1 D7 EC 41 41 77 6C 28 28 BD 43 BC BC 32 75 7B 7B D4 37 88 88 9B 26 0D 0D 70 FA 44 44 F9 13 FB FB B1 94 7E 7E 5A 48 03 03 7A F2 8C 8C E4 D0 B6 B6 47 8B 24 24 3C 30 E7 E7 A5 84 6B 6B 41 54 DD DD 06 DF 60 60 C5 23 FD FD 45 19 3A 3A A3 5B C2 C2 68 = MDS2\r\n      - bytes: 32 BC 75 BC 21 EC F3 EC 43 20 C6 20 C9 B3 F4 B3 03 DA DB DA 8B 02 7B 02 2B E2 FB E2 FA 9E C8 9E EC C9 4A C9 09 D4 D3 D4 6B 18 E6 18 9F 1E 6B 1E 0E 98 45 98 38 B2 7D B2 D2 A6 E8 A6 B7 26 4B 26 57 3C D6 3C 8A 93 32 93 EE 82 D8 82 98 52 FD 52 D4 7B 37 7B 37 BB 71 BB 97 5B F1 5B 83 47 E1 47 3C 24 30 24 E2 51 0F 51 C6 BA F8 BA F3 4A 1B 4A 48 BF 87 BF 70 0D FA 0D B3 B0 06 B0 DE 75 3F 75 FD D2 5E D2 20 7D BA 7D 31 66 AE 66 A3 3A 5B 3A 1C 59 8A 59 00 00 00 00 93 CD BC CD E0 1A 9D 1A 2C AE 6D AE AB 7F C1 7F C7 2B B1 = MDS3\r\n      - bytes: D9 A9 39 D9 90 67 17 90 71 B3 9C 71 D2 E8 A6 D2 05 04 07 05 98 FD 52 98 65 A3 80 65 DF 76 E4 DF 08 9A 45 08 02 92 4B 02 A0 80 E0 A0 66 78 5A 66 DD E4 AF DD B0 DD 6A B0 BF D1 63 BF 36 38 2A 36 54 0D E6 54 43 C6 20 43 62 35 CC 62 BE 98 F2 BE 1E 18 12 1E 24 F7 EB 24 D7 EC A1 D7 77 6C 41 77 BD 43 28 BD 32 75 BC 32 D4 37 7B D4 9B 26 88 9B 70 FA 0D 70 F9 13 44 F9 B1 94 FB B1 5A 48 7E 5A 7A F2 03 7A E4 D0 8C E4 47 8B B6 47 3C 30 24 3C A5 84 E7 A5 41 54 6B 41 06 DF DD 06 C5 23 60 C5 45 19 FD 45 A3 5B 3A A3 68 3D C2 = MDS4\r\n      - bytes: 01 02 04 08 10 20 40 80 4D 9A 79 F2 A9 1F 3E 7C F8 BD 37 6E DC F5 A7 03 06 0C 18 30 60 C0 CD D7 E3 8B 5B B6 21 42 84 45 8A 59 B2 29 52 A4 05 0A 14 28 50 A0 0D 1A 34 68 D0 ED 97 63 C6 C1 CF D3 EB 9B 7B F6 A1 0F 1E 3C 78 F0 AD 17 2E 5C B8 3D 7A F4 A5 07 0E 1C 38 70 E0 8D 57 AE 11 22 44 88 5D BA 39 72 E4 85 47 8E 51 A2 09 12 24 48 90 6D DA F9 BF 33 66 CC D5 E7 83 4B 96 61 C2 C9 DF F3 AB 1B 36 6C D8 FD B7 23 46 8C 55 AA 19 32 64 C8 DD F7 A3 0B 16 2C 58 B0 2D 5A B4 25 4A 94 65 CA D9 FF B3 2B 56 AC 15 2A 54 A8 1D = EXP_TO_POLY\r\n      - bytes: A9 75 67 F3 B3 C6 E8 F4 04 DB FD 7B A3 FB 76 C8 9A 4A 92 D3 80 E6 78 6B E4 45 DD 7D D1 E8 38 4B 0D D6 C6 32 35 D8 98 FD 18 37 F7 71 EC F1 6C E1 43 30 75 0F 37 F8 26 1B FA 87 13 FA 94 06 48 3F F2 5E D0 BA 8B AE 30 5B 84 8A 54 00 DF BC 23 9D 19 6D 5B C1 3D B1 59 0E F3 80 AE 5D A2 D2 82 D5 63 A0 01 84 83 07 2E 14 D9 B5 51 90 9B 2C 7C A3 A6 B2 EB 73 A5 4C BE 54 16 92 0C 74 E3 36 61 51 C0 38 8C B0 3A BD F5 5A 73 FC 2C 60 25 62 0B 96 BB 6C 4E 42 89 F7 6B 10 53 7C 6A 28 B4 27 F1 8C E1 13 E6 95 BD 9C 45 C7 E2 24 F4 = CALC_SB_TBL\r\n","matches":[[{"type":"absolute","value":1698659556},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[{"type":"absolute","value":1698659580}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698660380},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[{"type":"absolute","value":1698660424}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[{"type":"absolute","value":1698660431}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[{"type":"absolute","value":1698660409}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698661440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[{"type":"absolute","value":1698662231}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[{"type":"absolute","value":1698662238}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[{"type":"absolute","value":1698662216}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698662270},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[{"type":"absolute","value":1698662495}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using Camellia":{"meta":{"name":"encrypt data using Camellia","namespace":"data-manipulation/encryption/camellia","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","Camellia"],"objective":"Cryptography","behavior":"Encrypt Data","method":"Camellia","id":"C0027.003"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x6541CD50","112f9f0e8d349858a80dd8c14190e620:0x4CE3B2"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using Camellia\r\n    namespace: data-manipulation/encryption/camellia\r\n    authors:\r\n      - '@_re_fox'\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires bytes features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\r\n      - Cryptography::Encrypt Data::Camellia [C0027.003]\r\n    examples:\r\n      - 0761142efbda6c4b1e801223de723578:0x6541CD50\r\n      - 112f9f0e8d349858a80dd8c14190e620:0x4CE3B2\r\n  features:\r\n    - or:\r\n      - bytes: 00 70 70 70 00 82 82 82 00 2c 2c 2c 00 ec ec ec 00 b3 b3 b3 00 27 27 27 00 c0 c0 c0 00 e5 e5 e5 00 e4 e4 e4 00 85 85 85 00 57 57 57 00 35 35 35 00 ea ea ea 00 0c 0c 0c 00 ae ae ae 00 41 41 41 00 23 23 23 00 ef ef ef 00 6b 6b 6b 00 93 93 93 00 45 45 45 00 19 19 19 00 a5 a5 a5 00 21 21 21 00 ed ed ed 00 0e 0e 0e 00 4f 4f 4f 00 4e 4e 4e 00 1d 1d 1d 00 65 65 65 00 92 92 92 00 bd bd bd 00 86 86 86 00 b8 b8 b8 00 af af af 00 8f 8f 8f 00 7c 7c 7c 00 eb eb eb 00 1f 1f 1f 00 ce ce ce 00 3e 3e 3e 00 30 30 30 00 dc dc = libgcrypt_sp1110\r\n      - bytes: e0 e0 e0 00 05 05 05 00 58 58 58 00 d9 d9 d9 00 67 67 67 00 4e 4e 4e 00 81 81 81 00 cb cb cb 00 c9 c9 c9 00 0b 0b 0b 00 ae ae ae 00 6a 6a 6a 00 d5 d5 d5 00 18 18 18 00 5d 5d 5d 00 82 82 82 00 46 46 46 00 df df df 00 d6 d6 d6 00 27 27 27 00 8a 8a 8a 00 32 32 32 00 4b 4b 4b 00 42 42 42 00 db db db 00 1c 1c 1c 00 9e 9e 9e 00 9c 9c 9c 00 3a 3a 3a 00 ca ca ca 00 25 25 25 00 7b 7b 7b 00 0d 0d 0d 00 71 71 71 00 5f 5f 5f 00 1f 1f 1f 00 f8 f8 f8 00 d7 d7 d7 00 3e 3e 3e 00 9d 9d 9d 00 7c 7c 7c 00 60 60 60 00 b9 b9 b9 = libgcrypt_sp0222\r\n      - bytes: 38 38 00 38 41 41 00 41 16 16 00 16 76 76 00 76 d9 d9 00 d9 93 93 00 93 60 60 00 60 f2 f2 00 f2 72 72 00 72 c2 c2 00 c2 ab ab 00 ab 9a 9a 00 9a 75 75 00 75 06 06 00 06 57 57 00 57 a0 a0 00 a0 91 91 00 91 f7 f7 00 f7 b5 b5 00 b5 c9 c9 00 c9 a2 a2 00 a2 8c 8c 00 8c d2 d2 00 d2 90 90 00 90 f6 f6 00 f6 07 07 00 07 a7 a7 00 a7 27 27 00 27 8e 8e 00 8e b2 b2 00 b2 49 49 00 49 de de 00 de 43 43 00 43 5c 5c 00 5c d7 d7 00 d7 c7 c7 00 c7 3e 3e 00 3e f5 f5 00 f5 8f 8f 00 8f 67 67 00 67 1f 1f 00 1f 18 18 00 18 6e 6e 00 = libgcrypt_sp3033\r\n      - bytes: 70 00 70 70 2c 00 2c 2c b3 00 b3 b3 c0 00 c0 c0 e4 00 e4 e4 57 00 57 57 ea 00 ea ea ae 00 ae ae 23 00 23 23 6b 00 6b 6b 45 00 45 45 a5 00 a5 a5 ed 00 ed ed 4f 00 4f 4f 1d 00 1d 1d 92 00 92 92 86 00 86 86 af 00 af af 7c 00 7c 7c 1f 00 1f 1f 3e 00 3e 3e dc 00 dc dc 5e 00 5e 5e 0b 00 0b 0b a6 00 a6 a6 39 00 39 39 d5 00 d5 d5 5d 00 5d 5d d9 00 d9 d9 5a 00 5a 5a 51 00 51 51 6c 00 6c 6c 8b 00 8b 8b 9a 00 9a 9a fb 00 fb fb b0 00 b0 b0 74 00 74 74 2b 00 2b 2b f0 00 f0 f0 84 00 84 84 df 00 df df cb 00 cb cb 34 00 34 = libgcrypt_sp4404\r\n      - bytes: 70 82 2c ec b3 27 c0 e5 e4 85 57 35 ea 0c ae 41 23 ef 6b 93 45 19 a5 21 ed 0e 4f 4e 1d 65 92 bd 86 b8 af 8f 7c eb 1f ce 3e 30 dc 5f 5e c5 0b 1a a6 e1 39 ca d5 47 5d 3d d9 01 5a d6 51 56 6c 4d 8b 0d 9a 66 fb cc b0 2d 74 12 2b 20 f0 b1 84 99 df 4c cb c2 34 7e 76 05 6d b7 a9 31 d1 17 04 d7 14 58 3a 61 de 1b 11 1c 32 0f 9c 16 53 18 f2 22 fe 44 cf b2 c3 b5 7a 91 24 08 e8 a8 60 fc 69 50 aa d0 a0 7d a1 89 62 97 54 5b 1e 95 e0 ff 64 d2 10 c4 00 48 a3 f7 75 db 8a 03 e6 da 09 3f dd 94 87 5c 83 02 cd 4a 90 33 73 67 f6 f3 9d 7f bf e2 52 9b d8 26 c8 37 c6 3b 81 96 6f 4b 13 be 63 2e e9 79 a7 8c 9f 6e bc 8e 29 f5 f9 b6 2f fd b4 59 78 98 06 6a e7 46 71 ba d4 25 ab 42 88 a2 8d fa 72 07 b9 55 f8 ee ac 0a 36 49 2a 68 3c 38 f1 a4 40 28 d3 7b bb c9 43 c1 15 e3 ad f4 77 c7 80 9e = calccrypto_sbox\r\n      - or:\r\n        - and:\r\n          - number: 0x3bcc908b = CAMELLIA_SIGMA1R\r\n          - number: 0xa09e667f = CAMELLIA_SIGMA1L\r\n          - number: 0x4caa73b2 = CAMELLIA_SIGMA2R\r\n          - number: 0xb67ae858 = CAMELLIA_SIGMA2L\r\n          - number: 0xc6ef372f = CAMELLIA_SIGMA3L\r\n          - number: 0xe94f82be = CAMELLIA_SIGMA3R\r\n          - number: 0x54ff53a5 = CAMELLIA_SIGMA4L\r\n          - number: 0xf1d36f1c = CAMELLIA_SIGMA4R\r\n          - number: 0x10e527fa = CAMELLIA_SIGMA5L\r\n          - number: 0xde682d1d = CAMELLIA_SIGMA5R\r\n          - number: 0xb05688c2 = CAMELLIA_SIGMA6L\r\n          - number: 0xb3e6c1fd = CAMELLIA_SIGMA6R\r\n        - and:\r\n          - bytes: 8b 90 cc 3b 7f 66 9e a0 = sigma1\r\n          - bytes: b2 73 aa 4c 58 e8 7a b6 = sigma2\r\n          - bytes: be 82 4f e9 2f 37 ef c6 = sigma3\r\n          - bytes: 1c 6f d3 f1 a5 53 ff 54 = sigma4\r\n          - bytes: 1d 2d 68 de fa 27 e5 10 = sigma5\r\n          - bytes: fd c1 e6 b3 c2 88 56 b0 = sigma6\r\n        - and:\r\n          - string: /A09E667F3BCC908B/i\r\n            description: sigma1_str\r\n          - string: \"/B67AE8584CAA73B\"\r\n            description: sigma2_str\r\n          - string: /C6EF372FE94F82BE/i\r\n            description: sigma3_str\r\n          - string: /54FF53A5F1D36F1C/i\r\n            description: sigma4_str\r\n          - string: /10E527FADE682D1D/i\r\n            description: sigma5_str\r\n          - string: /B05688C2B3E6C1FD/i\r\n            description: sigma6_str\r\n","matches":[[{"type":"absolute","value":1698811216},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698811883}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698811869}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698811468}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698811765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698811793}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698811839}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698811989}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698811977}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698812098}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698812105}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698812224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698812231}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698813712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698815168},{"type":"absolute","value":1698815200},{"type":"absolute","value":1698814692},{"type":"absolute","value":1698815366},{"type":"absolute","value":1698814890},{"type":"absolute","value":1698814609},{"type":"absolute","value":1698815028},{"type":"absolute","value":1698815060},{"type":"absolute","value":1698815285},{"type":"absolute","value":1698814938}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698814591}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698814629}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698814533}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698814598}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698814603}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698814739}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698814744}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698814861}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698814872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698814995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698815010}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[{"type":"absolute","value":1698815141}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[{"type":"absolute","value":1698815147}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[{"type":"absolute","value":1698815292}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[{"type":"absolute","value":1698815303}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698817344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698817356}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698817363}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698817370}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698817377}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698819552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698819564}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698819571}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698819578}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698819585}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698821760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698821772}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698821779}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698821786}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698821793}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698824720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698824732}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698824739}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698824746}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698824753}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698811216},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698811883}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698811869}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698811468}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698811765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698811793}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698811839}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698811989}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698811977}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698812098}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698812105}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698812224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698812231}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698813712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698815168},{"type":"absolute","value":1698815200},{"type":"absolute","value":1698814692},{"type":"absolute","value":1698815366},{"type":"absolute","value":1698814890},{"type":"absolute","value":1698814609},{"type":"absolute","value":1698815028},{"type":"absolute","value":1698815060},{"type":"absolute","value":1698815285},{"type":"absolute","value":1698814938}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698814591}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698814629}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698814533}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698814598}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698814603}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698814739}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698814744}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698814861}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698814872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698814995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698815010}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[{"type":"absolute","value":1698815141}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[{"type":"absolute","value":1698815147}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[{"type":"absolute","value":1698815292}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[{"type":"absolute","value":1698815303}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698889168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[{"type":"absolute","value":1698889251}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[{"type":"absolute","value":1698889468}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[{"type":"absolute","value":1698889685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[{"type":"absolute","value":1698889906}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[{"type":"absolute","value":1698890161}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[{"type":"absolute","value":1698890378}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using Curve25519":{"meta":{"name":"encrypt data using Curve25519","namespace":"data-manipulation/encryption/elliptic-curve","authors":["dimiter.andonov@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[],"references":[],"examples":["0a0882b8da225406cc838991b5f67d11:0x4135f6","0a0882b8da225406cc838991b5f67d11:0x416f51","80372de850597bd9e7e021a94f13f0a1:0x406480","80372de850597bd9e7e021a94f13f0a1:0x4086f4","b4a07cdd640bbaef21cd0493b4d62675:0x4098af"],"description":"Targets code that enforces Curve25519's secret key restrictions. The specification states \"The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32 uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte.\"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using Curve25519\r\n    namespace: data-manipulation/encryption/elliptic-curve\r\n    authors:\r\n      - dimiter.andonov@mandiant.com\r\n    description: Targets code that enforces Curve25519's secret key restrictions. The specification states \"The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32 uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte.\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires mnemonic features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    examples:\r\n      - 0a0882b8da225406cc838991b5f67d11:0x4135f6\r\n      - 0a0882b8da225406cc838991b5f67d11:0x416f51\r\n      - 80372de850597bd9e7e021a94f13f0a1:0x406480\r\n      - 80372de850597bd9e7e021a94f13f0a1:0x4086f4\r\n      - b4a07cdd640bbaef21cd0493b4d62675:0x4098af\r\n  features:\r\n    # Common corresponding C source code:\r\n    #    e[0] &= 0xf8;\r\n    #   e[31] &= 0x7f;\r\n    #   e[31] |= 0x40;\r\n    - and:\r\n      - instruction:\r\n        - description: clear bits 0, 1, and 2 of the first byte\r\n        - mnemonic: and\r\n        - number: 0xf8\r\n      - or:\r\n        - instruction:\r\n          - description: clear bit 7 of the last byte\r\n          - mnemonic: and\r\n          - number: 0x7f\r\n        - instruction:\r\n          - description: clear bits 6 and 7 of the last byte; clearing bit 6 in addition to bit 7 is fine because bit 6 is ultimately set\r\n          - mnemonic: and\r\n          - number: 0x3f\r\n      - instruction:\r\n        - description: set bit 6 of the last byte\r\n        - mnemonic: or\r\n        - number: 0x40\r\n","matches":[[{"type":"absolute","value":1699032508},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699032554}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699032554}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699032554}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699032566}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699032566}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699032566}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699032563}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":127}},"children":[],"locations":[{"type":"absolute","value":1699032563}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699032563}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/e482f6602dc54a6fa39ab47776a018f9"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699034480},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699034523}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699034523}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699034523}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699034533}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699034533}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699034533}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699034530}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":127}},"children":[],"locations":[{"type":"absolute","value":1699034530}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699034530}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/e482f6602dc54a6fa39ab47776a018f9"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052157},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052160}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699052160}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052160}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699052170}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699052170}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052170}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/750d298ee5e74fbf8e5e6483be8c7e9e"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052167}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63}},"children":[],"locations":[{"type":"absolute","value":1699052167}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052167}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052591},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052595}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699052595}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052595}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699052618}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699052618}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052618}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/750d298ee5e74fbf8e5e6483be8c7e9e"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052615}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63}},"children":[],"locations":[{"type":"absolute","value":1699052615}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052615}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using tiger":{"meta":{"name":"hash data using tiger","namespace":"data-manipulation/hashing/tiger","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","Tiger"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"Tiger","id":"C0029.005"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x65471B97"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data using tiger\r\n    namespace: data-manipulation/hashing/tiger\r\n    authors:\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires characteristic, bytes, mnemonic features\r\n    mbc:\r\n      - Cryptography::Cryptographic Hash::Tiger [C0029.005]\r\n    examples:\r\n      - 0761142efbda6c4b1e801223de723578:0x65471B97\r\n  features:\r\n    - or:\r\n      - bytes: 5e 0c e9 f7 7c b1 aa 02 ec a8 43 e2 03 4b 42 ac d3 fc d5 0d e3 5b cd 72 3a 7f f9 f6 93 9b 01 6d 93 91 1f d2 ff 78 99 cd e2 29 80 70 c9 a1 73 75 c3 83 2a 92 6b 32 64 b1 70 58 91 04 ee 3e 88 46 e6 ec 03 71 05 e3 ac ea 5c 53 a3 08 b8 69 41 c5 7c c4 de 8d 91 54 e7 4c 0c f4 0d dc df f4 a2 0a fa be 4d a7 18 6f b7 10 6a ab d1 5a 23 b6 cc c6 ff e2 2f 57 21 61 72 13 1e 92 9d 19 6f 8c 48 1a ca 07 00 da f4 f9 c9 4b c7 41 52 e8 f6 e6 f5 26 b6 47 59 ea db 79 90 85 92 8c 9e c9 c5 85 18 4f 4b 86 6f a9 1e 76 8e d7 7d c1 b5 = sbox1\r\n      - bytes: 38 21 a1 05 5a be a6 e6 98 7c f8 b4 a5 22 a1 b5 90 69 0b 14 89 60 3c 56 d5 5d 1f 39 2e cb 46 4c 34 94 b7 c9 db ad 32 d9 f5 af 15 20 e4 70 ea 08 f1 8c 47 3e 67 a6 65 d7 99 8d 27 ab 7e 75 fb c4 92 06 6e 2d 86 c6 11 df 16 3b 7f 0d f1 84 eb dd 04 ea 65 a6 04 f6 2e 6f b3 df e0 f0 0f 0f 8e 4a 51 ba bc 3d f8 ee ed a5 1e 37 a4 0e 2a 0a 4f fc 29 84 b3 5c a8 1d 3e e8 e2 1c 1b ba 82 f8 8f dc 0d e8 53 83 5e 50 45 cd 17 07 db d4 00 9a d1 18 01 81 f3 a5 ed cf a0 34 f2 ca 87 88 51 7e e7 0b 36 51 c4 b3 38 14 34 1e f9 cc 89 = sbox2\r\n      - bytes: 9b f3 da f1 2f cc 9f f4 81 92 f2 6f c6 d5 7f 48 3f a8 dc fc 67 06 a3 e8 63 ce fc d2 e3 4b 9b 2c c2 bb fb 93 4b f7 3f da 66 ba 70 fe d2 65 a1 2f d4 93 0e 97 79 e2 03 a1 71 5e e4 b0 77 ec cd be 97 e4 85 39 72 1e b4 cf 17 50 f7 5e 02 aa 0a b7 e0 b8 40 38 f0 09 23 d4 79 85 89 35 d0 1a fc 8e c5 ab b2 e2 0b 92 c6 96 72 91 5a 37 63 41 af 66 fb 27 71 ca dc ab 74 21 41 ff 72 4a a6 ce 3c b3 a5 66 30 08 33 49 4a f0 f5 9a 28 d7 cd 0a 97 8d 5e c2 c8 31 e0 e8 96 8f 47 5d 87 76 22 c0 fe f3 dd 90 61 05 10 f3 7b ec 91 14 0f = sbox3\r\n      - bytes: 55 3c 32 26 85 60 0e 5b f5 59 1b fa a9 c1 46 1a fa 8f 4c 7c a1 45 e2 a9 d7 55 29 db 59 51 ca 65 c2 af 35 ce 76 0a db 05 45 3d 11 a9 7e c7 ea 81 0d 0a ac b6 8a f8 8e 52 ff e3 7b 59 53 a2 9e a0 56 cd 48 ac b3 df 0d 43 6f e4 5c f4 7a a6 b3 c4 5e d0 e2 fb d8 cf ce 4e f0 35 99 b3 10 6f f5 3e c6 19 d6 9c 82 d6 22 0b 69 20 df 74 0a 46 fd 17 40 ed 10 85 8e cc f8 6c a7 ca 6e 3a bf 24 c8 d6 49 70 81 1a 58 3d 24 61 a2 63 c1 bb b6 ac 8b 04 32 cc 44 7d c2 8a a3 d9 ab 10 f4 aa 5b ff dd 7f 4b 82 04 a8 5a 49 6d ad 94 9f 8c = sbox4\r\n      - and:\r\n        - description: tiger key schedule\r\n        - number: 0xa5a5a5a5a5a5a5a5\r\n        - number: 0x0123456789abcdef\r\n        - number: 0x13\r\n        - number: 0x17\r\n        - count(mnemonic(shr)): 2 or more\r\n        - count(mnemonic(shl)): 2 or more\r\n        - characteristic: nzxor\r\n","matches":[[{"type":"absolute","value":1699158935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"5e0ce9f77cb1aa02eca843e2034b42acd3fcd50de35bcd723a7ff9f6939b016d93911fd2ff7899cde2298070c9a17375c3832a926b3264b170589104ee3e8846e6ec037105e3acea5c53a308b86941c57cc4de8d9154e74c0cf40ddcdff4a20afabe4da7186fb7106aabd15a23b6ccc6ffe22f57216172131e929d196f8c481aca0700daf4f9c94bc74152e8f6e6f526b64759eadb799085928c9ec9c585184f4b866fa91e768ed77dc1b5","description":"sbox1"}},"children":[],"locations":[{"type":"absolute","value":1699158975}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3821a1055abea6e6987cf8b4a522a1b590690b1489603c56d55d1f392ecb464c3494b7c9dbad32d9f5af1520e470ea08f18c473e67a665d7998d27ab7e75fbc492066e2d86c611df163b7f0df184ebdd04ea65a604f62e6fb3dfe0f00f0f8e4a51babc3df8eeeda51e37a40e2a0a4ffc2984b35ca81d3ee8e21c1bba82f88fdc0de853835e5045cd1707dbd4009ad1180181f3a5edcfa034f2ca8788517ee70b3651c4b33814341ef9cc89","description":"sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"9bf3daf12fcc9ff48192f26fc6d57f483fa8dcfc6706a3e863cefcd2e34b9b2cc2bbfb934bf73fda66ba70fed265a12fd4930e9779e203a1715ee4b077eccdbe97e48539721eb4cf1750f75e02aa0ab7e0b84038f00923d479858935d01afc8ec5abb2e20b92c69672915a376341af66fb2771cadcab742141ff724aa6ce3cb3a566300833494af0f59a28d7cd0a978d5ec2c831e0e8968f475d877622c0fef3dd90610510f37bec91140f","description":"sbox3"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"553c322685600e5bf5591bfaa9c1461afa8f4c7ca145e2a9d75529db5951ca65c2af35ce760adb05453d11a97ec7ea810d0aacb68af88e52ffe37b5953a29ea056cd48acb3df0d436fe45cf47aa6b3c45ed0e2fbd8cfce4ef03599b3106ff53ec619d69c82d6220b6920df740a46fd1740ed10858eccf86ca7ca6e3abf24c8d64970811a583d2461a263c1bbb6ac8b0432cc447dc28aa3d9ab10f4aa5bffdd7f4b8204a85a496dad949f8c","description":"sbox4"}},"children":[],"locations":[{"type":"absolute","value":1699158982}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"tiger key schedule"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11936128518282651045}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":81985529216486895}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":19}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":23}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shr"}}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shl"}}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699158994},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"5e0ce9f77cb1aa02eca843e2034b42acd3fcd50de35bcd723a7ff9f6939b016d93911fd2ff7899cde2298070c9a17375c3832a926b3264b170589104ee3e8846e6ec037105e3acea5c53a308b86941c57cc4de8d9154e74c0cf40ddcdff4a20afabe4da7186fb7106aabd15a23b6ccc6ffe22f57216172131e929d196f8c481aca0700daf4f9c94bc74152e8f6e6f526b64759eadb799085928c9ec9c585184f4b866fa91e768ed77dc1b5","description":"sbox1"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3821a1055abea6e6987cf8b4a522a1b590690b1489603c56d55d1f392ecb464c3494b7c9dbad32d9f5af1520e470ea08f18c473e67a665d7998d27ab7e75fbc492066e2d86c611df163b7f0df184ebdd04ea65a604f62e6fb3dfe0f00f0f8e4a51babc3df8eeeda51e37a40e2a0a4ffc2984b35ca81d3ee8e21c1bba82f88fdc0de853835e5045cd1707dbd4009ad1180181f3a5edcfa034f2ca8788517ee70b3651c4b33814341ef9cc89","description":"sbox2"}},"children":[],"locations":[{"type":"absolute","value":1699160770},{"type":"absolute","value":1699161064},{"type":"absolute","value":1699160040},{"type":"absolute","value":1699160329},{"type":"absolute","value":1699160623},{"type":"absolute","value":1699161359},{"type":"absolute","value":1699159057},{"type":"absolute","value":1699161620},{"type":"absolute","value":1699160917},{"type":"absolute","value":1699161211},{"type":"absolute","value":1699160476}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"9bf3daf12fcc9ff48192f26fc6d57f483fa8dcfc6706a3e863cefcd2e34b9b2cc2bbfb934bf73fda66ba70fed265a12fd4930e9779e203a1715ee4b077eccdbe97e48539721eb4cf1750f75e02aa0ab7e0b84038f00923d479858935d01afc8ec5abb2e20b92c69672915a376341af66fb2771cadcab742141ff724aa6ce3cb3a566300833494af0f59a28d7cd0a978d5ec2c831e0e8968f475d877622c0fef3dd90610510f37bec91140f","description":"sbox3"}},"children":[],"locations":[{"type":"absolute","value":1699161729},{"type":"absolute","value":1699160006},{"type":"absolute","value":1699161030},{"type":"absolute","value":1699161670},{"type":"absolute","value":1699160971},{"type":"absolute","value":1699160589},{"type":"absolute","value":1699161530},{"type":"absolute","value":1699160530},{"type":"absolute","value":1699161177},{"type":"absolute","value":1699159068},{"type":"absolute","value":1699161118},{"type":"absolute","value":1699160736},{"type":"absolute","value":1699160677},{"type":"absolute","value":1699160295},{"type":"absolute","value":1699160236},{"type":"absolute","value":1699161325},{"type":"absolute","value":1699161266},{"type":"absolute","value":1699160883},{"type":"absolute","value":1699161586},{"type":"absolute","value":1699161855},{"type":"absolute","value":1699160824},{"type":"absolute","value":1699160442},{"type":"absolute","value":1699160383}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"553c322685600e5bf5591bfaa9c1461afa8f4c7ca145e2a9d75529db5951ca65c2af35ce760adb05453d11a97ec7ea810d0aacb68af88e52ffe37b5953a29ea056cd48acb3df0d436fe45cf47aa6b3c45ed0e2fbd8cfce4ef03599b3106ff53ec619d69c82d6220b6920df740a46fd1740ed10858eccf86ca7ca6e3abf24c8d64970811a583d2461a263c1bbb6ac8b0432cc447dc28aa3d9ab10f4aa5bffdd7f4b8204a85a496dad949f8c","description":"sbox4"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"tiger key schedule"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11936128518282651045}},"children":[],"locations":[{"type":"absolute","value":1699161384},{"type":"absolute","value":1699160058}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":81985529216486895}},"children":[],"locations":[{"type":"absolute","value":1699160187},{"type":"absolute","value":1699162365}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":19}},"children":[],"locations":[{"type":"absolute","value":1699161416},{"type":"absolute","value":1699160149},{"type":"absolute","value":1699160102},{"type":"absolute","value":1699161463}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23}},"children":[],"locations":[{"type":"absolute","value":1699160171},{"type":"absolute","value":1699160124},{"type":"absolute","value":1699161485},{"type":"absolute","value":1699161438}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shr"}}},"children":[],"locations":[{"type":"absolute","value":1699161600},{"type":"absolute","value":1699160321},{"type":"absolute","value":1699159554},{"type":"absolute","value":1699160577},{"type":"absolute","value":1699162116},{"type":"absolute","value":1699161095},{"type":"absolute","value":1699161351},{"type":"absolute","value":1699159050},{"type":"absolute","value":1699159818},{"type":"absolute","value":1699159564},{"type":"absolute","value":1699161612},{"type":"absolute","value":1699159310},{"type":"absolute","value":1699160847},{"type":"absolute","value":1699161869},{"type":"absolute","value":1699161106},{"type":"absolute","value":1699159321},{"type":"absolute","value":1699161881},{"type":"absolute","value":1699160603},{"type":"absolute","value":1699162141},{"type":"absolute","value":1699162402},{"type":"absolute","value":1699159846},{"type":"absolute","value":1699160615},{"type":"absolute","value":1699159592},{"type":"absolute","value":1699160360},{"type":"absolute","value":1699160871},{"type":"absolute","value":1699162152},{"type":"absolute","value":1699161644},{"type":"absolute","value":1699161906},{"type":"absolute","value":1699159091},{"type":"absolute","value":1699160371},{"type":"absolute","value":1699161141},{"type":"absolute","value":1699162421},{"type":"absolute","value":1699161655},{"type":"absolute","value":1699159352},{"type":"absolute","value":1699159867},{"type":"absolute","value":1699160124},{"type":"absolute","value":1699161917},{"type":"absolute","value":1699159616},{"type":"absolute","value":1699160897},{"type":"absolute","value":1699162433},{"type":"absolute","value":1699162180},{"type":"absolute","value":1699159373},{"type":"absolute","value":1699160654},{"type":"absolute","value":1699160909},{"type":"absolute","value":1699161165},{"type":"absolute","value":1699159889},{"type":"absolute","value":1699159122},{"type":"absolute","value":1699159635},{"type":"absolute","value":1699160406},{"type":"absolute","value":1699162455},{"type":"absolute","value":1699160665},{"type":"absolute","value":1699161945},{"type":"absolute","value":1699162201},{"type":"absolute","value":1699159901},{"type":"absolute","value":1699161438},{"type":"absolute","value":1699159647},{"type":"absolute","value":1699159392},{"type":"absolute","value":1699161693},{"type":"absolute","value":1699162465},{"type":"absolute","value":1699159143},{"type":"absolute","value":1699161191},{"type":"absolute","value":1699160171},{"type":"absolute","value":1699159404},{"type":"absolute","value":1699160430},{"type":"absolute","value":1699162223},{"type":"absolute","value":1699161969},{"type":"absolute","value":1699159155},{"type":"absolute","value":1699160948},{"type":"absolute","value":1699161203},{"type":"absolute","value":1699161717},{"type":"absolute","value":1699159931},{"type":"absolute","value":1699160700},{"type":"absolute","value":1699159677},{"type":"absolute","value":1699162235},{"type":"absolute","value":1699160959},{"type":"absolute","value":1699162493},{"type":"absolute","value":1699161988},{"type":"absolute","value":1699159942},{"type":"absolute","value":1699159688},{"type":"absolute","value":1699160456},{"type":"absolute","value":1699159434},{"type":"absolute","value":1699161485},{"type":"absolute","value":1699161743},{"type":"absolute","value":1699162000},{"type":"absolute","value":1699159444},{"type":"absolute","value":1699160213},{"type":"absolute","value":1699160468},{"type":"absolute","value":1699160724},{"type":"absolute","value":1699159192},{"type":"absolute","value":1699162260},{"type":"absolute","value":1699161243},{"type":"absolute","value":1699161755},{"type":"absolute","value":1699162270},{"type":"absolute","value":1699160224},{"type":"absolute","value":1699159970},{"type":"absolute","value":1699159203},{"type":"absolute","value":1699160994},{"type":"absolute","value":1699161507},{"type":"absolute","value":1699161254},{"type":"absolute","value":1699159719},{"type":"absolute","value":1699162025},{"type":"absolute","value":1699160750},{"type":"absolute","value":1699161518},{"type":"absolute","value":1699159472},{"type":"absolute","value":1699161780},{"type":"absolute","value":1699162036},{"type":"absolute","value":1699159994},{"type":"absolute","value":1699160507},{"type":"absolute","value":1699160762},{"type":"absolute","value":1699161018},{"type":"absolute","value":1699162298},{"type":"absolute","value":1699159743},{"type":"absolute","value":1699159231},{"type":"absolute","value":1699161791},{"type":"absolute","value":1699160259},{"type":"absolute","value":1699159493},{"type":"absolute","value":1699160518},{"type":"absolute","value":1699161289},{"type":"absolute","value":1699162319},{"type":"absolute","value":1699162064},{"type":"absolute","value":1699161553},{"type":"absolute","value":1699159762},{"type":"absolute","value":1699159252},{"type":"absolute","value":1699160020},{"type":"absolute","value":1699161044},{"type":"absolute","value":1699159512},{"type":"absolute","value":1699160283},{"type":"absolute","value":1699159039},{"type":"absolute","value":1699161819},{"type":"absolute","value":1699159774},{"type":"absolute","value":1699160032},{"type":"absolute","value":1699160801},{"type":"absolute","value":1699161056},{"type":"absolute","value":1699161313},{"type":"absolute","value":1699159524},{"type":"absolute","value":1699162085},{"type":"absolute","value":1699161574},{"type":"absolute","value":1699159271},{"type":"absolute","value":1699162338},{"type":"absolute","value":1699160553},{"type":"absolute","value":1699160812},{"type":"absolute","value":1699162350},{"type":"absolute","value":1699159283},{"type":"absolute","value":1699161843},{"type":"absolute","value":1699160309},{"type":"absolute","value":1699162104},{"type":"absolute","value":1699161339},{"type":"absolute","value":1699159807}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shl"}}},"children":[],"locations":[{"type":"absolute","value":1699161416},{"type":"absolute","value":1699160149},{"type":"absolute","value":1699160102},{"type":"absolute","value":1699161463}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699161089},{"type":"absolute","value":1699160068},{"type":"absolute","value":1699161604},{"type":"absolute","value":1699162124},{"type":"absolute","value":1699160596},{"type":"absolute","value":1699160085},{"type":"absolute","value":1699162135},{"type":"absolute","value":1699159576},{"type":"absolute","value":1699161627},{"type":"absolute","value":1699160607},{"type":"absolute","value":1699159584},{"type":"absolute","value":1699159075},{"type":"absolute","value":1699161125},{"type":"absolute","value":1699161638},{"type":"absolute","value":1699160106},{"type":"absolute","value":1699159083},{"type":"absolute","value":1699161133},{"type":"absolute","value":1699159600},{"type":"absolute","value":1699160112},{"type":"absolute","value":1699162164},{"type":"absolute","value":1699160630},{"type":"absolute","value":1699159098},{"type":"absolute","value":1699162172},{"type":"absolute","value":1699161149},{"type":"absolute","value":1699160128},{"type":"absolute","value":1699160648},{"type":"absolute","value":1699160137},{"type":"absolute","value":1699159628},{"type":"absolute","value":1699161677},{"type":"absolute","value":1699162188},{"type":"absolute","value":1699161685},{"type":"absolute","value":1699159639},{"type":"absolute","value":1699160153},{"type":"absolute","value":1699160159},{"type":"absolute","value":1699159136},{"type":"absolute","value":1699161184},{"type":"absolute","value":1699161701},{"type":"absolute","value":1699159655},{"type":"absolute","value":1699162216},{"type":"absolute","value":1699159147},{"type":"absolute","value":1699160684},{"type":"absolute","value":1699161195},{"type":"absolute","value":1699160175},{"type":"absolute","value":1699162227},{"type":"absolute","value":1699160692},{"type":"absolute","value":1699160181},{"type":"absolute","value":1699159671},{"type":"absolute","value":1699159165},{"type":"absolute","value":1699161218},{"type":"absolute","value":1699162243},{"type":"absolute","value":1699160708},{"type":"absolute","value":1699160197},{"type":"absolute","value":1699161736},{"type":"absolute","value":1699162254},{"type":"absolute","value":1699160207},{"type":"absolute","value":1699159186},{"type":"absolute","value":1699161747},{"type":"absolute","value":1699161236},{"type":"absolute","value":1699159703},{"type":"absolute","value":1699159711},{"type":"absolute","value":1699161763},{"type":"absolute","value":1699160743},{"type":"absolute","value":1699162282},{"type":"absolute","value":1699161774},{"type":"absolute","value":1699159215},{"type":"absolute","value":1699159727},{"type":"absolute","value":1699160754},{"type":"absolute","value":1699160243},{"type":"absolute","value":1699162290},{"type":"absolute","value":1699159223},{"type":"absolute","value":1699161273},{"type":"absolute","value":1699160251},{"type":"absolute","value":1699161281},{"type":"absolute","value":1699162306},{"type":"absolute","value":1699159239},{"type":"absolute","value":1699160777},{"type":"absolute","value":1699159755},{"type":"absolute","value":1699160267},{"type":"absolute","value":1699161803},{"type":"absolute","value":1699161297},{"type":"absolute","value":1699161811},{"type":"absolute","value":1699159766},{"type":"absolute","value":1699160795},{"type":"absolute","value":1699162331},{"type":"absolute","value":1699159264},{"type":"absolute","value":1699161827},{"type":"absolute","value":1699162342},{"type":"absolute","value":1699159785},{"type":"absolute","value":1699159275},{"type":"absolute","value":1699160302},{"type":"absolute","value":1699161332},{"type":"absolute","value":1699162358},{"type":"absolute","value":1699159801},{"type":"absolute","value":1699160313},{"type":"absolute","value":1699159291},{"type":"absolute","value":1699161343},{"type":"absolute","value":1699160831},{"type":"absolute","value":1699159302},{"type":"absolute","value":1699160839},{"type":"absolute","value":1699161862},{"type":"absolute","value":1699162375},{"type":"absolute","value":1699162381},{"type":"absolute","value":1699160336},{"type":"absolute","value":1699161873},{"type":"absolute","value":1699159830},{"type":"absolute","value":1699160855},{"type":"absolute","value":1699161366},{"type":"absolute","value":1699159838},{"type":"absolute","value":1699161889},{"type":"absolute","value":1699160354},{"type":"absolute","value":1699159336},{"type":"absolute","value":1699161900},{"type":"absolute","value":1699162108},{"type":"absolute","value":1699159854},{"type":"absolute","value":1699162414},{"type":"absolute","value":1699159344},{"type":"absolute","value":1699161398},{"type":"absolute","value":1699162425},{"type":"absolute","value":1699160890},{"type":"absolute","value":1699161404},{"type":"absolute","value":1699159360},{"type":"absolute","value":1699160901},{"type":"absolute","value":1699160390},{"type":"absolute","value":1699161929},{"type":"absolute","value":1699159882},{"type":"absolute","value":1699162441},{"type":"absolute","value":1699161420},{"type":"absolute","value":1699160398},{"type":"absolute","value":1699161937},{"type":"absolute","value":1699161426},{"type":"absolute","value":1699159893},{"type":"absolute","value":1699159385},{"type":"absolute","value":1699160924},{"type":"absolute","value":1699160414},{"type":"absolute","value":1699161953},{"type":"absolute","value":1699161442},{"type":"absolute","value":1699159396},{"type":"absolute","value":1699159909},{"type":"absolute","value":1699161451},{"type":"absolute","value":1699162477},{"type":"absolute","value":1699160942},{"type":"absolute","value":1699159412},{"type":"absolute","value":1699159925},{"type":"absolute","value":1699162485},{"type":"absolute","value":1699161467},{"type":"absolute","value":1699161981},{"type":"absolute","value":1699160449},{"type":"absolute","value":1699161473},{"type":"absolute","value":1699159428},{"type":"absolute","value":1699162501},{"type":"absolute","value":1699161992},{"type":"absolute","value":1699160460},{"type":"absolute","value":1699161489},{"type":"absolute","value":1699159954},{"type":"absolute","value":1699160978},{"type":"absolute","value":1699162513},{"type":"absolute","value":1699161495},{"type":"absolute","value":1699162008},{"type":"absolute","value":1699159962},{"type":"absolute","value":1699160986},{"type":"absolute","value":1699161501},{"type":"absolute","value":1699159456},{"type":"absolute","value":1699160483},{"type":"absolute","value":1699162019},{"type":"absolute","value":1699159464},{"type":"absolute","value":1699159978},{"type":"absolute","value":1699161002},{"type":"absolute","value":1699160501},{"type":"absolute","value":1699159480},{"type":"absolute","value":1699162048},{"type":"absolute","value":1699161537},{"type":"absolute","value":1699162056},{"type":"absolute","value":1699161545},{"type":"absolute","value":1699160013},{"type":"absolute","value":1699161037},{"type":"absolute","value":1699159505},{"type":"absolute","value":1699160024},{"type":"absolute","value":1699160537},{"type":"absolute","value":1699161048},{"type":"absolute","value":1699161561},{"type":"absolute","value":1699159516},{"type":"absolute","value":1699162072},{"type":"absolute","value":1699160545},{"type":"absolute","value":1699159532},{"type":"absolute","value":1699160047},{"type":"absolute","value":1699161071},{"type":"absolute","value":1699160561},{"type":"absolute","value":1699162097},{"type":"absolute","value":1699159031},{"type":"absolute","value":1699161593},{"type":"absolute","value":1699159548}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via IOCTL":{"meta":{"name":"interact with driver via IOCTL","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x40108c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: interact with driver via IOCTL\r\n    namespace: host-interaction/driver\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    examples:\r\n      - Practical Malware Analysis Lab 10-03.exe_:0x40108c\r\n  features:\r\n    - or:\r\n      - api: DeviceIoControl\r\n","matches":[[{"type":"absolute","value":1699231874},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":1699231931}],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open registry key\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Registry::Create Registry Key [C0036.004]\r\n      - Operating System::Registry::Open Registry Key [C0036.003]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\r\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\r\n      - 493167E85E45363D09495D0841C30648:0x404D60\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: advapi32.RegOpenKey\r\n      - api: advapi32.RegOpenKeyEx\r\n      - api: advapi32.RegCreateKey\r\n      - api: advapi32.RegCreateKeyEx\r\n      - api: advapi32.RegOpenCurrentUser\r\n      - api: advapi32.RegOpenKeyTransacted\r\n      - api: advapi32.RegOpenUserClassesRoot\r\n      - api: advapi32.RegCreateKeyTransacted\r\n      - api: ZwOpenKey\r\n      - api: ZwOpenKeyEx\r\n      - api: ZwCreateKey\r\n      - api: ZwOpenKeyTransacted\r\n      - api: ZwOpenKeyTransactedEx\r\n      - api: ZwCreateKeyTransacted\r\n      - api: NtOpenKey\r\n      - api: NtCreateKey\r\n      - api: SHRegOpenUSKey\r\n      - api: SHRegCreateUSKey\r\n      - api: RtlCreateRegistryKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\r\n","matches":[[{"type":"absolute","value":1699232109},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":1699232142}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"change memory protection":{"meta":{"name":"change memory protection","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Change Memory Protection"],"objective":"Memory","behavior":"Change Memory Protection","method":"","id":"C0008"}],"references":[],"examples":["Practical Malware Analysis Lab 11-02.dll_:0x10001203"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: change memory protection\r\n    authors:\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Change Memory Protection [C0008]\r\n    examples:\r\n      - Practical Malware Analysis Lab 11-02.dll_:0x10001203\r\n  features:\r\n    - or:\r\n      - api: kernel32.VirtualProtect\r\n      - api: kernel32.VirtualProtectEx\r\n      - api: NtProtectVirtualMemory\r\n      - api: ZwProtectVirtualMemory\r\n      - and:\r\n        - match: link function at runtime on Windows\r\n        - or:\r\n          - string: \"VirtualProtect\"\r\n          - string: \"VirtualProtectEx\"\r\n          - string: \"NtProtectVirtualMemory\"\r\n          - string: \"ZwProtectVirtualMemory\"\r\n","matches":[[{"type":"absolute","value":1699278612},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":1699278646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699279074},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":1699279085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RWX memory":{"meta":{"name":"allocate or change RWX memory","namespace":"host-interaction/process/inject","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate or change RWX memory\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - \"@mr-tz\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\r\n      # ntdll\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate memory\r\n        - match: change memory protection\r\n      - or:\r\n        - number: 0x40 = PAGE_EXECUTE_READWRITE\r\n        # lea     r9d, [rcx+40h]  ; flProtect\r\n        # call    cs:VirtualAlloc\r\n        - instruction:\r\n          - mnemonic: lea\r\n          - offset: 0x40 = PAGE_EXECUTE_READWRITE\r\n","matches":[[{"type":"absolute","value":1699278612},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":1699278646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699278612}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":1699278624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain loop\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    examples:\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - characteristic: loop\r\n      - characteristic: tight loop\r\n      - characteristic: recursive call\r\n","matches":[[{"type":"absolute","value":1698435088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698435088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436432}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698454643},{"type":"absolute","value":1698454564}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698464016},{"type":"absolute","value":1698464260},{"type":"absolute","value":1698463772},{"type":"absolute","value":1698463669}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436704},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436752},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436752}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699243376},{"type":"absolute","value":1699243410}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437408}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437424}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437440}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438048}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699275381}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236836}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236992},{"type":"absolute","value":1699237059}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698480912},{"type":"absolute","value":1698480960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698440976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698440976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698518024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441424}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441584}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698529680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442944}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699210234}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698553472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443216},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443216}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699269728},{"type":"absolute","value":1699269653},{"type":"absolute","value":1699269367},{"type":"absolute","value":1699269562},{"type":"absolute","value":1699269292},{"type":"absolute","value":1699269486}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698446144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443392}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443600},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443712}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698444944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698444944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698445344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698445344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698445728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698445728}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698446144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698446304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698446304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698446864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698446928},{"type":"absolute","value":1698446960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698447040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698447040}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698447184},{"type":"absolute","value":1698447265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698448288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698448288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698451616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698451616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452192}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698453136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698453136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698453344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698453344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698453936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698453936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698454496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698454496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698454643},{"type":"absolute","value":1698454564}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698454736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698454736}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698454976},{"type":"absolute","value":1698455008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698460768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698460768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698461184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698461184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698461648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698461648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698461984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698461984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462176}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698463024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698463024}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698464016},{"type":"absolute","value":1698464260},{"type":"absolute","value":1698463772},{"type":"absolute","value":1698463669}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698464512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698464512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698465264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698465264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698466720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698466720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698467072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698467072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698468096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698468096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698468304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698468304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698468496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698468496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698468624},{"type":"absolute","value":1698468704},{"type":"absolute","value":1698468784},{"type":"absolute","value":1698468675},{"type":"absolute","value":1698468755},{"type":"absolute","value":1698468597},{"type":"absolute","value":1698468832},{"type":"absolute","value":1698468864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698469184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698469184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698470448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698470448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698470512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698470512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698470624},{"type":"absolute","value":1698470672},{"type":"absolute","value":1698470720},{"type":"absolute","value":1698470768},{"type":"absolute","value":1698470896},{"type":"absolute","value":1698470944},{"type":"absolute","value":1698470992},{"type":"absolute","value":1698471040}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698471072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698471072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698471344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698471360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698473280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698473280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698474496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698474496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698475088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698475088}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475232},{"type":"absolute","value":1698475264},{"type":"absolute","value":1698475173}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698475616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698475680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698475680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698475680}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698476064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476320},{"type":"absolute","value":1698476180}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698476416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476768},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698476416}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698477120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698477120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698477728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698477728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698478560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698478560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698478848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698478944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698480848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698480912},{"type":"absolute","value":1698480960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698482016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698482016}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487680},{"type":"absolute","value":1698491264},{"type":"absolute","value":1698491586},{"type":"absolute","value":1698490435},{"type":"absolute","value":1698493312},{"type":"absolute","value":1698487749},{"type":"absolute","value":1698488392},{"type":"absolute","value":1698487632},{"type":"absolute","value":1698489872},{"type":"absolute","value":1698492112},{"type":"absolute","value":1698492496},{"type":"absolute","value":1698491477},{"type":"absolute","value":1698488032},{"type":"absolute","value":1698490080},{"type":"absolute","value":1698490018},{"type":"absolute","value":1698490273},{"type":"absolute","value":1698490336},{"type":"absolute","value":1698490977},{"type":"absolute","value":1698491808},{"type":"absolute","value":1698492064},{"type":"absolute","value":1698492448},{"type":"absolute","value":1698488297},{"type":"absolute","value":1698491632},{"type":"absolute","value":1698490161},{"type":"absolute","value":1698490484},{"type":"absolute","value":1698487797},{"type":"absolute","value":1698491764}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698482784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698483136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672},{"type":"absolute","value":1698509257},{"type":"absolute","value":1698504194},{"type":"absolute","value":1698508950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698483648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568},{"type":"absolute","value":1698499280},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482},{"type":"absolute","value":1698510928},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698485696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698485696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698486048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698486144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698486368}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698486705},{"type":"absolute","value":1698486754},{"type":"absolute","value":1698486930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698487168}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487632},{"type":"absolute","value":1698487680},{"type":"absolute","value":1698488032},{"type":"absolute","value":1698487797},{"type":"absolute","value":1698487749},{"type":"absolute","value":1698488392},{"type":"absolute","value":1698488297}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698488592}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488912},{"type":"absolute","value":1698489056},{"type":"absolute","value":1698489186},{"type":"absolute","value":1698489297},{"type":"absolute","value":1698489108},{"type":"absolute","value":1698489346},{"type":"absolute","value":1698489443},{"type":"absolute","value":1698489488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698489552}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489872},{"type":"absolute","value":1698490161},{"type":"absolute","value":1698490018},{"type":"absolute","value":1698490080},{"type":"absolute","value":1698490273},{"type":"absolute","value":1698490336},{"type":"absolute","value":1698490435},{"type":"absolute","value":1698490484}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698490544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698490800}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490977}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698491056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491264},{"type":"absolute","value":1698491632},{"type":"absolute","value":1698491586},{"type":"absolute","value":1698491808},{"type":"absolute","value":1698491764},{"type":"absolute","value":1698491477}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698491888}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064},{"type":"absolute","value":1698492448},{"type":"absolute","value":1698492496},{"type":"absolute","value":1698492112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698492736}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698493136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698493136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698493312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698493632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698493632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698493872},{"type":"absolute","value":1698494064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698494544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698494721}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698495266}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495504},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698495266}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698495266}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698495536}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064},{"type":"absolute","value":1698492448},{"type":"absolute","value":1698492496},{"type":"absolute","value":1698492112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496016},{"type":"absolute","value":1698496080},{"type":"absolute","value":1698496128},{"type":"absolute","value":1698496192},{"type":"absolute","value":1698496243}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698496368}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497504},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698497680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497808}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698497936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698498240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698498240}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698498388}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698498752},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698499424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698499424}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698499824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698499824}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698500160},{"type":"absolute","value":1698500020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698501104},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698501104}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698501776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698501808},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698502768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698502896},{"type":"absolute","value":1698503584}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698503952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698504240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505824}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698506467}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698506528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698506528}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508115},{"type":"absolute","value":1698508087},{"type":"absolute","value":1698508155},{"type":"absolute","value":1698507069},{"type":"absolute","value":1698508015}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698508336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672},{"type":"absolute","value":1698509257},{"type":"absolute","value":1698508950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698509296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698509296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698510864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698510928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698511040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512080},{"type":"absolute","value":1698511849},{"type":"absolute","value":1698511881}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698512480}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512800},{"type":"absolute","value":1698513152},{"type":"absolute","value":1698513200},{"type":"absolute","value":1698512848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698513520}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513856},{"type":"absolute","value":1698513906},{"type":"absolute","value":1698514212},{"type":"absolute","value":1698514272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698514576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698514576}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698515312},{"type":"absolute","value":1698515731}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698516064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698516064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698516496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698516496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698517568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698517568}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698518024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698518512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698518512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698519936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698519936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698520032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698520032}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698520432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698520432}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698520624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698520624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698522176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698522176}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698522624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698522624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698526688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698526688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698527072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698527072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698527328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698527328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698527968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698527968}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698528016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698528288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698528640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528992},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698528992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698529680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529792}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529808},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529808}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698530224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698530224}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698530672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698530672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698531920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698531920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698532256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698534560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698534560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698534640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698534640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698534768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698534768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698535152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535696}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568},{"type":"absolute","value":1698499280},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482},{"type":"absolute","value":1698510928},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698536032}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698536080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672},{"type":"absolute","value":1698509257},{"type":"absolute","value":1698504194},{"type":"absolute","value":1698508950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698536560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698538704},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698538800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698538832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698538832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698539456},{"type":"absolute","value":1698539488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698539648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698539648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698541872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698541872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698542032},{"type":"absolute","value":1698543456},{"type":"absolute","value":1698543344},{"type":"absolute","value":1698543568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698543744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698543744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698544480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698544480}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698544896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698545520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698545520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698545968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698545968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698546096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698546096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698546224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698546224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698547712},{"type":"absolute","value":1698551463},{"type":"absolute","value":1698551582},{"type":"absolute","value":1698546960},{"type":"absolute","value":1698548976},{"type":"absolute","value":1698546738},{"type":"absolute","value":1698549234},{"type":"absolute","value":1698548117},{"type":"absolute","value":1698550526},{"type":"absolute","value":1698550431}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698552304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698552579}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698552848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698552848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698553440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698553472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698553520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698553520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698554240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698554240}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698554624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698555792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698555792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698557600},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698557600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698558112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698558112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698558112}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698558944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698558944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698559344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698559344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698559536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698561168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698561168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698561408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698561408}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698561797}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698562080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698562080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698563392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698563392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698563761}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698564176}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698564464},{"type":"absolute","value":1698564544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698565136},{"type":"absolute","value":1698565361},{"type":"absolute","value":1698565330},{"type":"absolute","value":1698565410},{"type":"absolute","value":1698565632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698565856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698565856}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698566176},{"type":"absolute","value":1698566208},{"type":"absolute","value":1698566402},{"type":"absolute","value":1698566117},{"type":"absolute","value":1698566085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698566768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698566768}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698566864},{"type":"absolute","value":1698566960},{"type":"absolute","value":1698567011}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698566768}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698567296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567364}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567632},{"type":"absolute","value":1698567776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698567872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567952}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568304},{"type":"absolute","value":1698568416}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698568512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568960},{"type":"absolute","value":1698568819},{"type":"absolute","value":1698570352},{"type":"absolute","value":1698570304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698571360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698571360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568960},{"type":"absolute","value":1698568819},{"type":"absolute","value":1698570352},{"type":"absolute","value":1698570304}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698571360}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698582416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698582592},{"type":"absolute","value":1698582628},{"type":"absolute","value":1698582704}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698582416}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698582592},{"type":"absolute","value":1698582628},{"type":"absolute","value":1698582704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583232},{"type":"absolute","value":1698583376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698583472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583904},{"type":"absolute","value":1698584016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698594336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698594336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698594352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698594624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698594624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698598144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698598144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698598432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698598432}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698598544},{"type":"absolute","value":1698599202},{"type":"absolute","value":1698598816}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698599616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698599616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698600080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698600080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698600149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698600352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698600352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698600416}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698600720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698600720}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698600784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698628160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698628160}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698628896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698628896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698629392},{"type":"absolute","value":1698629920},{"type":"absolute","value":1698629749},{"type":"absolute","value":1698629446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698630528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698630528}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698629392},{"type":"absolute","value":1698629920},{"type":"absolute","value":1698629749},{"type":"absolute","value":1698629446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698631904}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631984},{"type":"absolute","value":1698644352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698632160}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698632464}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698632544},{"type":"absolute","value":1698643152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698632720}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633473},{"type":"absolute","value":1698633138}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698643616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645024},{"type":"absolute","value":1698645360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698645968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698646304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698646304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698646688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698646688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698650976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698651248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698651568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698652880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698652880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698653760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698653760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698654656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698654656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698657376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698657376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698659472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698659472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698663648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698663648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698663908}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698664208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698664208}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698664468}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698664832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698664832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698665076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698665328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698665328}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698665533}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698666288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698666880},{"type":"absolute","value":1698666489}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698714000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698714000}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698719728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698719792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698719792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698720448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698720736},{"type":"absolute","value":1698720594},{"type":"absolute","value":1698720848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698721072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698721072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698721360},{"type":"absolute","value":1698721218}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698721712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698721856},{"type":"absolute","value":1698722098},{"type":"absolute","value":1698722000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698722288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698722288}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698722500}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698723440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698723440}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698723857},{"type":"absolute","value":1698723642}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698804144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698804512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698804848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698805664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698805664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698810640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698810640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698810640}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698829312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698829472},{"type":"absolute","value":1698829600},{"type":"absolute","value":1698829728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698829936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698829936}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698830096},{"type":"absolute","value":1698830224}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698830592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698830864},{"type":"absolute","value":1698830739},{"type":"absolute","value":1698830992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698831184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698831184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698831409},{"type":"absolute","value":1698831929}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698832432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698832432}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698832898},{"type":"absolute","value":1698832643},{"type":"absolute","value":1698833099}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698956128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698956128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698956256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698956256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698956864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698956976},{"type":"absolute","value":1698957216}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698957344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698957344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698957472},{"type":"absolute","value":1698957427}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698957344}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698958576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698958576}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698958816},{"type":"absolute","value":1698959173}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698959376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698959376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698959621}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698960344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698960344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698960840},{"type":"absolute","value":1698963474}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698965792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698965812}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698965856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698965856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698966320}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560},{"type":"absolute","value":1698966848},{"type":"absolute","value":1698966896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698967040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698967040}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560},{"type":"absolute","value":1698966848},{"type":"absolute","value":1698966896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698967072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698967072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698967344},{"type":"absolute","value":1698967648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698968192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698968192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698971433},{"type":"absolute","value":1698971027},{"type":"absolute","value":1698968773},{"type":"absolute","value":1698971071}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698971584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698971584}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698972233},{"type":"absolute","value":1698974315},{"type":"absolute","value":1698974685},{"type":"absolute","value":1698974359}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698981432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698981432}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698989792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698989792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698992576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698992576}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698994224},{"type":"absolute","value":1698995073},{"type":"absolute","value":1698995440},{"type":"absolute","value":1698994864},{"type":"absolute","value":1698996240},{"type":"absolute","value":1698997843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699000208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699000208}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699001888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699001888}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699002512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699002576}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699005488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699005488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699009184},{"type":"absolute","value":1699008522}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699011856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699011856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699016448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699016448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699016976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699016976}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699018496},{"type":"absolute","value":1699017873},{"type":"absolute","value":1699018640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699025232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699025232}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699031152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699031152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699031929},{"type":"absolute","value":1699031588},{"type":"absolute","value":1699032149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699039024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699039024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699039232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699039232}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699040544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699040544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699043008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699043008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699047088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699047408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699047488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699047488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699047648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699050976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699051360},{"type":"absolute","value":1699051123}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699051824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699052128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699052564}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699053616},{"type":"absolute","value":1699054016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699054608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699055562},{"type":"absolute","value":1699055446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699055984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699055984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058337},{"type":"absolute","value":1699059072},{"type":"absolute","value":1699059472},{"type":"absolute","value":1699058414}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058560},{"type":"absolute","value":1699058801},{"type":"absolute","value":1699060192},{"type":"absolute","value":1699060672},{"type":"absolute","value":1699058877}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059072},{"type":"absolute","value":1699059472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060192},{"type":"absolute","value":1699060672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699061584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699061584}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699061935}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699063456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699063568},{"type":"absolute","value":1699063858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699063920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699063920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699064016},{"type":"absolute","value":1699063970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699065232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699065232}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699065264},{"type":"absolute","value":1699065364}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699065760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699065776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699066096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699066240},{"type":"absolute","value":1699066368},{"type":"absolute","value":1699066739}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699067200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699067250}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699068688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699068704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699068752},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699068976},{"type":"absolute","value":1699068884}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699069168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699069232}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699071344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699071616},{"type":"absolute","value":1699071524}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699071856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699077520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699077536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699077584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699077728},{"type":"absolute","value":1699077824}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699079040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699079344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699090400},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699090704},{"type":"absolute","value":1699090532}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699090896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699090949}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699091024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699091024}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699091184},{"type":"absolute","value":1699093513}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699094768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699094768}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699094912},{"type":"absolute","value":1699097121}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699098368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699098368}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699098592},{"type":"absolute","value":1699100810},{"type":"absolute","value":1699101744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699104512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699104512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699104912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699111328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699111472},{"type":"absolute","value":1699111680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699111872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699111925}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699112016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699112075}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699126160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699126222}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699140352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699140352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699140544},{"type":"absolute","value":1699142992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699144704},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699144752}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699144784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699144784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699147264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699147264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699148608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699148608}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699151120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699151120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699152464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699152464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699154816},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699154816}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699156960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699156960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699157456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699157456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699158935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699158935}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699162583}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699162633},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699162840},{"type":"absolute","value":1699162793}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699163504},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699163504}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699163920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699163504}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699164256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699164256}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699163920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699164368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699164528},{"type":"absolute","value":1699164704},{"type":"absolute","value":1699164608},{"type":"absolute","value":1699164787},{"type":"absolute","value":1699164848},{"type":"absolute","value":1699164928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699165136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699165136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699167664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699167872}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699173744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699173888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699178336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699178464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699178864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699178963},{"type":"absolute","value":1699179316},{"type":"absolute","value":1699179246}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699179840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699179840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699180880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699181120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699181152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699181360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699181392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699181600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699181632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699182928},{"type":"absolute","value":1699182017}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699183344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699183344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699184016},{"type":"absolute","value":1699183761},{"type":"absolute","value":1699183618},{"type":"absolute","value":1699184304},{"type":"absolute","value":1699184817}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699187984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699188240}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699193120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699193392},{"type":"absolute","value":1699193252}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699193680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699193733}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699193888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699193888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699198016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699198016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699202000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699202000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699206160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699206160}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699206320},{"type":"absolute","value":1699207156},{"type":"absolute","value":1699206496},{"type":"absolute","value":1699206352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699207280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699207280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699207971},{"type":"absolute","value":1699207794},{"type":"absolute","value":1699207939}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699208304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699208304}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699208496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699208496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699209632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699209632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699209712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699209712}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699214528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699209840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699209840}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699210234}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699210384},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699210384}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699210832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699210832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699211136},{"type":"absolute","value":1699211223}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699211312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699211584}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699212992},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699212992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699213184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699213184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699214416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699214416}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699214528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699214928},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699214928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699214960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699215248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699215296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699215296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699215424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699215424}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699216240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699216240}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699216464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699216464}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699216485}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699216560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699216560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699217632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699217632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699218464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699218464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699218976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699218976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699219296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699219296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220928},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699223280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699223280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699224576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699224576}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699225296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699225296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226032}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226336}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699226730}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226871},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226871}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699227064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699227064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699227374},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699227374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699227920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699227920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699228093},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699228093}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699228369},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699228369}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699228894},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699228894}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699229592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699229592}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699230022}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699230544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699230544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699230864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699230864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699231472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699234544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699234544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699234992},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699234992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699235904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699235904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236432}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236608}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236836}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236992},{"type":"absolute","value":1699237059}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699237120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699237280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699237376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699237376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699238000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699238048},{"type":"absolute","value":1699238080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699238128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699238128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699238480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699238480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699239008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699239008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699239024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699239024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699239136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699239136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240976}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699243280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699243376},{"type":"absolute","value":1699243410}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699243568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699243568}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699244400},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699244400}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699244448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699244448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699244768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699244768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699245152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699245152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699245392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699245392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699250096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699250096}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699250352},{"type":"absolute","value":1699250480},{"type":"absolute","value":1699250181}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699250896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699250896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699250976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699250976}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699251088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699251264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699251264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699251440},{"type":"absolute","value":1699251728},{"type":"absolute","value":1699251664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699251776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237168},{"type":"absolute","value":1699251842}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699252016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699252096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699252544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699252544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699254128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699254128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699256016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699256064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699256096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699256096}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699256677},{"type":"absolute","value":1699256629},{"type":"absolute","value":1699256736}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699257232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699257296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699257344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699257344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699257409}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699257616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699257616}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699258304},{"type":"absolute","value":1699258131}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699257616}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699258800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699258800}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699258864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699259056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699259056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699259552},{"type":"absolute","value":1699259397}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699259056}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699259952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699259952}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699258864},{"type":"absolute","value":1699257409},{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699260192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699260192}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699260304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699260304}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699260416}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699260720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699260720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699260720}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699261792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699261792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699261984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699262128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262288},{"type":"absolute","value":1699262193}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699263008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699263008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699263648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699263648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699263904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699263904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699264336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699264336}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699264736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699264736}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699265552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699266048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699266048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699266816},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262288},{"type":"absolute","value":1699262193}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699266896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699266896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699267248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699267376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699267472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699267472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699268576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699047408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699269168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699269728},{"type":"absolute","value":1699269653},{"type":"absolute","value":1699269367},{"type":"absolute","value":1699269562},{"type":"absolute","value":1699269292},{"type":"absolute","value":1699269486}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699269856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699269856}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699271296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699271296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699272848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699272848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699275381}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699276464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276719},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699276960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699277379}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277424}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699277472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277536}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699277472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699278096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699278096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699278272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699278272}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699278592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699278784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699278784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699279904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699279904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699280640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699280640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699280880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699280880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699281141}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699282080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699282287}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699282448},{"type":"absolute","value":1699282496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699283936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699283936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write file on Windows":{"meta":{"name":"write file on Windows","namespace":"host-interaction/file-system/write","authors":["william.ballenthin@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Writes File"],"objective":"File System","behavior":"Writes File","method":"","id":"C0052"}],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x4011FC","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: write file on Windows\r\n    namespace: host-interaction/file-system/write\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Writes File [C0052]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\r\n      # ntdll\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - optional:\r\n          - basic block:\r\n            - or:\r\n              - number: 0x40000000 = GENERIC_WRITE\r\n              - number: 0x2 = FILE_WRITE_DATA\r\n              - match: create or open file\r\n          - call:\r\n            - or:\r\n              - number: 0x40000000 = GENERIC_WRITE\r\n              - number: 0x2 = FILE_WRITE_DATA\r\n              - match: create or open file\r\n        - or:\r\n          - api: kernel32.WriteFile\r\n          - api: kernel32.WriteFileEx\r\n          - api: NtWriteFile\r\n          - api: ZwWriteFile\r\n          - api: _fwrite\r\n          - api: fwrite\r\n      - api: System.IO.File::WriteAllBytes\r\n      - api: System.IO.File::WriteAllBytesAsync\r\n      - api: System.IO.File::WriteAllLines\r\n      - api: System.IO.File::WriteAllLinesAsync\r\n      - api: System.IO.File::WriteAllText\r\n      - api: System.IO.File::WriteAllTextAsync\r\n      - api: System.IO.File::AppendAllLines\r\n      - api: System.IO.File::AppendAllLinesAsync\r\n      - api: System.IO.File::AppendAllText\r\n      - api: System.IO.File::AppendAllTextAsync\r\n      - api: System.IO.File::AppendText\r\n      - api: System.IO.FileInfo::AppendText\r\n","matches":[[{"type":"absolute","value":1698441680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/5288e393f0714fcebc4149710147c7fc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698526848},{"type":"absolute","value":1698526874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698444080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444336}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444384}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444254}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698444288},{"type":"absolute","value":1698444336},{"type":"absolute","value":1698444194},{"type":"absolute","value":1698444384},{"type":"absolute","value":1698444254}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698444371},{"type":"absolute","value":1698444419},{"type":"absolute","value":1698444229}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698526688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/5288e393f0714fcebc4149710147c7fc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698526848},{"type":"absolute","value":1698526874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529808},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/5288e393f0714fcebc4149710147c7fc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698526848},{"type":"absolute","value":1698526874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699284592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1699284667},{"type":"absolute","value":1699284606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699284592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1699284657}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using murmur3":{"meta":{"name":"hash data using murmur3","namespace":"data-manipulation/hashing/murmur","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Data","Non-Cryptographic Hash","MurmurHash"],"objective":"Data","behavior":"Non-Cryptographic Hash","method":"MurmurHash","id":"C0030.001"}],"references":["https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp"],"examples":["c66172b12971a329f8d5ff01665f204b:0x404A18"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data using murmur3\r\n    namespace: data-manipulation/hashing/murmur\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic, mnemonic features\r\n    mbc:\r\n      - Data::Non-Cryptographic Hash::MurmurHash [C0030.001]\r\n    references:\r\n      - https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp\r\n    examples:\r\n      - c66172b12971a329f8d5ff01665f204b:0x404A18\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 0x85ebca6b = 32-bit finalization mix constant 1\r\n        - number: 0xc2b2ae35 = 32-bit finalization mix constant 2\r\n      - and:\r\n        - number: 0xff51afd7ed558ccd = 64-bit finalization mix constant 1\r\n        - number: 0xc4ceb9fe1a85ec53 = 64-bit finalization mix constant 2\r\n      - and:\r\n        - number: 0xcc9e2d51 = c1 32-bit hash\r\n        - number: 0x1b873593 = c2 32-bit hash\r\n      - and:\r\n        - number: 0x239b961b = 32-bit c1 for 128-bit hash\r\n        - number: 0xab0e9789 = 32-bit c2 for 128-bit hash\r\n        - number: 0x38b34ae5 = 32-bit c3 for 128-bit hash\r\n        - number: 0xa1e38b93 = 32-bit c4 for 128-bit hash\r\n      - and:\r\n        - number: 0x87c37b91114253d5 = 64-bit c1 for 128-bit hash\r\n        - number: 0x4cf5ad432745937f = 64-bit c2 for 128-bit hash\r\n      - basic block:\r\n        - and:\r\n          - description: 'hash >> 16; hash >> 13; hash >> 16'\r\n          - count(mnemonic(shr)): 3\r\n          - instruction:\r\n            - mnemonic: shr\r\n            - number: 16\r\n          - instruction:\r\n            - mnemonic: shr\r\n            - number: 13\r\n          - optional:\r\n            - count(characteristic(nzxor)): 3 or more\r\n      - and:\r\n        # Group this two blocks under an `and` as on their own they are not\r\n        # unique enough and would cause false positives\r\n        - instruction:\r\n          - description: k ROL r1\r\n          - mnemonic: rol\r\n          - number: 15 = r1\r\n        - instruction:\r\n          - description: hash ROL r2\r\n          - mnemonic: rol\r\n          - number: 13 = r2\r\n","matches":[[{"type":"absolute","value":1698475088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/3f63118238a943918187493b6e217c76"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1698475286}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1698475286}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698475286}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1698475283}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1698475283}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698475283}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699067200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/3f63118238a943918187493b6e217c76"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068458}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068458}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068558}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068558}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068645}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068645}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068350}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068350}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699068458},{"type":"absolute","value":1699068558},{"type":"absolute","value":1699068645},{"type":"absolute","value":1699068350}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699067937}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699067937}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068236}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699068236}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699067804}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699067804}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068079}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699068079}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699067937},{"type":"absolute","value":1699068236},{"type":"absolute","value":1699067804},{"type":"absolute","value":1699068079}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/3f63118238a943918187493b6e217c76"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072133}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072133}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073737}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699073737}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075535}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699075535}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074000}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699074000}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699074336}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073185}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699073185}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699075360}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699075685}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699076390}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699076390}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072423}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072423}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072360}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074663}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699074663}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073517}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699073517}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077236}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699077236}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699076537}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699076537}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072703}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072703}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699072133},{"type":"absolute","value":1699073737},{"type":"absolute","value":1699075535},{"type":"absolute","value":1699074000},{"type":"absolute","value":1699074336},{"type":"absolute","value":1699073185},{"type":"absolute","value":1699075360},{"type":"absolute","value":1699075685},{"type":"absolute","value":1699076390},{"type":"absolute","value":1699072423},{"type":"absolute","value":1699072360},{"type":"absolute","value":1699074663},{"type":"absolute","value":1699073517},{"type":"absolute","value":1699077236},{"type":"absolute","value":1699076537},{"type":"absolute","value":1699072703}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075073}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699075073}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073218}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699073218}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074242}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074242}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077058}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699077058}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074889}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074889}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075148}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699075148}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074065}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074065}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074844}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074844}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073117}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699073117}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074595}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074595}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699072293}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699076841}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699076841}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077097}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699077097}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074028}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074028}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699077293}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072574}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699072574}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699075073},{"type":"absolute","value":1699073218},{"type":"absolute","value":1699074242},{"type":"absolute","value":1699077058},{"type":"absolute","value":1699074889},{"type":"absolute","value":1699075148},{"type":"absolute","value":1699074065},{"type":"absolute","value":1699074844},{"type":"absolute","value":1699073117},{"type":"absolute","value":1699074595},{"type":"absolute","value":1699072293},{"type":"absolute","value":1699076841},{"type":"absolute","value":1699077097},{"type":"absolute","value":1699074028},{"type":"absolute","value":1699077293},{"type":"absolute","value":1699072574}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699079040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/3f63118238a943918187493b6e217c76"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082115}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082115}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089668}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089668}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081733}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081733}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087373}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087373}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084047}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084047}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085332}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085332}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084181}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084181}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089300}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089300}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088792}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088792}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083550}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083550}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084961}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084961}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083042}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083042}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081379}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081379}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086241}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086241}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084581}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084581}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089830}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089830}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082664}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082664}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087912}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088427}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088427}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085871}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085871}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082296}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087162}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087162}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086780}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086780}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085501}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085501}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088961}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088961}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088066}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088066}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087557}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087557}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081926}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081926}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083719}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083719}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081549}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083214}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083214}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085133}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085133}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089490}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089490}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086035}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086035}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086423}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086423}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088221}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088221}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084384}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084384}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082849}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082849}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086585}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086585}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088613}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088613}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089127}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089127}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084776}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083376}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085680}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082482}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082482}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083890}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087729}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087729}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086969}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086969}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699082115},{"type":"absolute","value":1699089668},{"type":"absolute","value":1699081733},{"type":"absolute","value":1699087373},{"type":"absolute","value":1699084047},{"type":"absolute","value":1699085332},{"type":"absolute","value":1699084181},{"type":"absolute","value":1699089300},{"type":"absolute","value":1699088792},{"type":"absolute","value":1699083550},{"type":"absolute","value":1699084961},{"type":"absolute","value":1699083042},{"type":"absolute","value":1699081379},{"type":"absolute","value":1699086241},{"type":"absolute","value":1699084581},{"type":"absolute","value":1699089830},{"type":"absolute","value":1699082664},{"type":"absolute","value":1699087912},{"type":"absolute","value":1699088427},{"type":"absolute","value":1699085871},{"type":"absolute","value":1699082296},{"type":"absolute","value":1699087162},{"type":"absolute","value":1699086780},{"type":"absolute","value":1699085501},{"type":"absolute","value":1699088961},{"type":"absolute","value":1699088066},{"type":"absolute","value":1699087557},{"type":"absolute","value":1699081926},{"type":"absolute","value":1699083719},{"type":"absolute","value":1699081549},{"type":"absolute","value":1699083214},{"type":"absolute","value":1699085133},{"type":"absolute","value":1699089490},{"type":"absolute","value":1699086035},{"type":"absolute","value":1699086423},{"type":"absolute","value":1699088221},{"type":"absolute","value":1699084384},{"type":"absolute","value":1699082849},{"type":"absolute","value":1699086585},{"type":"absolute","value":1699088613},{"type":"absolute","value":1699089127},{"type":"absolute","value":1699084776},{"type":"absolute","value":1699083376},{"type":"absolute","value":1699085680},{"type":"absolute","value":1699082482},{"type":"absolute","value":1699083890},{"type":"absolute","value":1699087729},{"type":"absolute","value":1699086969}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082112}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086603}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086603}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085324}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085324}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089420}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089420}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081742}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081742}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089678}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089678}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084054}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084054}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087383}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087383}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087896}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086233}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086233}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083547}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083547}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088796}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088796}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084957}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084957}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083038}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083038}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089313}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089313}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082660}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082660}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084585}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084585}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084204}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084204}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088431}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088431}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081394}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081394}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085875}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085875}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082293}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086777}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086777}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087165}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087165}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089855}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089855}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085504}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085504}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081922}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081922}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083715}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083715}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087561}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087561}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081546}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081546}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083211}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083211}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088074}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088074}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088970}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088970}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084375}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084375}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085143}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085143}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086426}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086426}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085662}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085662}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082853}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082853}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086057}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086057}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084780}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084780}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083373}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083373}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082478}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082478}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088239}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088239}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088623}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088623}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086961}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086961}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089140}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089140}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087733}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087733}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083898}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083898}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699082112},{"type":"absolute","value":1699086603},{"type":"absolute","value":1699085324},{"type":"absolute","value":1699089420},{"type":"absolute","value":1699081742},{"type":"absolute","value":1699089678},{"type":"absolute","value":1699084054},{"type":"absolute","value":1699087383},{"type":"absolute","value":1699087896},{"type":"absolute","value":1699086233},{"type":"absolute","value":1699083547},{"type":"absolute","value":1699088796},{"type":"absolute","value":1699084957},{"type":"absolute","value":1699083038},{"type":"absolute","value":1699089313},{"type":"absolute","value":1699082660},{"type":"absolute","value":1699084585},{"type":"absolute","value":1699084204},{"type":"absolute","value":1699088431},{"type":"absolute","value":1699081394},{"type":"absolute","value":1699085875},{"type":"absolute","value":1699082293},{"type":"absolute","value":1699086777},{"type":"absolute","value":1699087165},{"type":"absolute","value":1699089855},{"type":"absolute","value":1699085504},{"type":"absolute","value":1699081922},{"type":"absolute","value":1699083715},{"type":"absolute","value":1699087561},{"type":"absolute","value":1699081546},{"type":"absolute","value":1699083211},{"type":"absolute","value":1699088074},{"type":"absolute","value":1699088970},{"type":"absolute","value":1699084375},{"type":"absolute","value":1699085143},{"type":"absolute","value":1699086426},{"type":"absolute","value":1699085662},{"type":"absolute","value":1699082853},{"type":"absolute","value":1699086057},{"type":"absolute","value":1699084780},{"type":"absolute","value":1699083373},{"type":"absolute","value":1699082478},{"type":"absolute","value":1699088239},{"type":"absolute","value":1699088623},{"type":"absolute","value":1699086961},{"type":"absolute","value":1699089140},{"type":"absolute","value":1699087733},{"type":"absolute","value":1699083898}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"authenticate HMAC":{"meta":{"name":"authenticate HMAC","namespace":"data-manipulation/hmac","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Cryptography","Hashed Message Authentication Code"],"objective":"Cryptography","behavior":"Hashed Message Authentication Code","method":"","id":"C0061"}],"references":["https://tools.ietf.org/html/rfc2104","https://tools.ietf.org/html/rfc4634","https://github.com/ogay/hmac"],"examples":["mimikatz.exe_:0x403408"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: authenticate HMAC\r\n    namespace: data-manipulation/hmac\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    mbc:\r\n      - Cryptography::Hashed Message Authentication Code [C0061]\r\n    references:\r\n      - https://tools.ietf.org/html/rfc2104\r\n      - https://tools.ietf.org/html/rfc4634\r\n      - https://github.com/ogay/hmac\r\n    examples:\r\n      - mimikatz.exe_:0x403408\r\n  features:\r\n    - and:\r\n      # block-sized inner padding, consisting of repeated bytes valued 0x36\r\n      - number: 0x36 = inner padding byte value\r\n      # block-sized outer padding, consisting of repeated bytes valued 0x5c\r\n      - number: 0x5C = outer padding byte value\r\n      - match: contain loop\r\n      - count(characteristic(nzxor)): 2 or more\r\n      - optional:\r\n        - description: block size\r\n        - number: 64 = MD5, SHA-1, SHA-224, or SHA-256\r\n        - number: 128 = SHA-384 or SHA-512\r\n","matches":[[{"type":"absolute","value":1698476416},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":54,"description":"inner padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":92,"description":"outer padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698476729}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476768},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698476416}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698476416}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698476729},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"block size"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"MD5, SHA-1, SHA-224, or SHA-256"}},"children":[],"locations":[{"type":"absolute","value":1698476748},{"type":"absolute","value":1698476677}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":128,"description":"SHA-384 or SHA-512"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698530672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":54,"description":"inner padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531228}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":92,"description":"outer padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698531377},{"type":"absolute","value":1698531452}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698530672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698530672}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531377}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"block size"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"MD5, SHA-1, SHA-224, or SHA-256"}},"children":[],"locations":[{"type":"absolute","value":1698531170},{"type":"absolute","value":1698531112},{"type":"absolute","value":1698530792},{"type":"absolute","value":1698531116},{"type":"absolute","value":1698531180},{"type":"absolute","value":1698531566},{"type":"absolute","value":1698531184},{"type":"absolute","value":1698530802},{"type":"absolute","value":1698531099},{"type":"absolute","value":1698531580},{"type":"absolute","value":1698531102},{"type":"absolute","value":1698531167}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":128,"description":"SHA-384 or SHA-512"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535408},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":54,"description":"inner padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531228}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":92,"description":"outer padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698531377},{"type":"absolute","value":1698531452}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698535408}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531377}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"block size"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"MD5, SHA-1, SHA-224, or SHA-256"}},"children":[],"locations":[{"type":"absolute","value":1698531170},{"type":"absolute","value":1698531112},{"type":"absolute","value":1698530792},{"type":"absolute","value":1698531116},{"type":"absolute","value":1698531180},{"type":"absolute","value":1698531566},{"type":"absolute","value":1698531184},{"type":"absolute","value":1698530802},{"type":"absolute","value":1698531099},{"type":"absolute","value":1698531580},{"type":"absolute","value":1698531102},{"type":"absolute","value":1698531167}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":128,"description":"SHA-384 or SHA-512"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read file on Windows\r\n    namespace: host-interaction/file-system/read\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Read File [C0051]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - optional:\r\n          - and:\r\n            - number: 0x80000000 = GENERIC_READ\r\n            - match: create or open file\r\n        - or:\r\n          - api: kernel32.ReadFile\r\n          - api: ReadFileEx\r\n          - api: NtReadFile\r\n          - api: ZwReadFile\r\n          - api: LZRead\r\n          - api: _read\r\n          - api: fread\r\n      - api: System.IO.File::ReadAllBytes\r\n      - api: System.IO.File::ReadAllBytesAsync\r\n      - api: System.IO.File::ReadAllLines\r\n      - api: System.IO.File::ReadAllLinesAsync\r\n      - api: System.IO.File::ReadAllText\r\n      - api: System.IO.File::ReadAllTextAsync\r\n      - api: System.IO.File::ReadLines\r\n","matches":[[{"type":"absolute","value":1698477120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698477149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698477120}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[{"type":"absolute","value":1698477245}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[{"type":"absolute","value":1699211758}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using ADD XOR SUB operations":{"meta":{"name":"encode data using ADD XOR SUB operations","namespace":"data-manipulation/encoding","authors":["jakub.jozwiak@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Custom Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Custom Algorithm","id":"E1027.m03"}],"references":[],"examples":["df814d4b55912e4ba404c62080b3a7eda70a3c6283ea740f8a14a9116d803259:0x1000100F"],"description":"Data encoding using a sequence of ADD/XOR/SUB (or SUB/XOR/ADD) operations common for PlugX but also used by other malware families.","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encode data using ADD XOR SUB operations\r\n    namespace: data-manipulation/encoding\r\n    authors:\r\n      - jakub.jozwiak@mandiant.com\r\n    description: Data encoding using a sequence of ADD/XOR/SUB (or SUB/XOR/ADD) operations common for PlugX but also used by other malware families.\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires basic block, characteristic, mnemonic features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Custom Algorithm [E1027.m03]\r\n    examples:\r\n      - df814d4b55912e4ba404c62080b3a7eda70a3c6283ea740f8a14a9116d803259:0x1000100F\r\n  features:\r\n    - and:\r\n      - count(basic blocks): 6 or fewer\r\n      - basic block:\r\n        - and:\r\n          - characteristic: tight loop\r\n          - characteristic: nzxor\r\n          - count(mnemonic(add)): 1\r\n          - count(mnemonic(sub)): 1\r\n","matches":[[{"type":"absolute","value":1698505648},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698505664},{"type":"absolute","value":1698505674}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"add"}}},"children":[],"locations":[{"type":"absolute","value":1698505667}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"sub"}}},"children":[],"locations":[{"type":"absolute","value":1698505682}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":6,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698505648},{"type":"absolute","value":1698505688},{"type":"absolute","value":1698505653},{"type":"absolute","value":1698505664}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643312},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643461}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"add"}}},"children":[],"locations":[{"type":"absolute","value":1698643481}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"sub"}}},"children":[],"locations":[{"type":"absolute","value":1698643496}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":6,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698643312},{"type":"absolute","value":1698643456},{"type":"absolute","value":1698643454},{"type":"absolute","value":1698643502}],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using AES via x86 extensions":{"meta":{"name":"encrypt data using AES via x86 extensions","namespace":"data-manipulation/encryption/aes","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","AES"],"objective":"Cryptography","behavior":"Encrypt Data","method":"AES","id":"C0027.001"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using AES via x86 extensions\r\n    namespace: data-manipulation/encryption/aes\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\r\n      - Cryptography::Encrypt Data::AES [C0027.001]\r\n  features:\r\n    - or:\r\n      - mnemonic: aesenc = Perform One Round of an AES Encryption Flow\r\n      - mnemonic: vaesenc\r\n      - mnemonic: aesenclast = Perform Last Round of an AES Encryption Flow\r\n      - mnemonic: vaesenclast\r\n      - mnemonic: aesimc = Perform the AES InvMixColumn Transformation\r\n      - mnemonic: vaesimc\r\n      - mnemonic: aeskeygenassist = AES Round Key Generation Assist\r\n      - mnemonic: vaeskeygenassist\r\n","matches":[[{"type":"absolute","value":1698627360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[{"type":"absolute","value":1698650497},{"type":"absolute","value":1698650689},{"type":"absolute","value":1698650595},{"type":"absolute","value":1698650535},{"type":"absolute","value":1698650440},{"type":"absolute","value":1698650631},{"type":"absolute","value":1698650573},{"type":"absolute","value":1698650478},{"type":"absolute","value":1698650516},{"type":"absolute","value":1698650711},{"type":"absolute","value":1698650554},{"type":"absolute","value":1698650459},{"type":"absolute","value":1698650653}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653057},{"type":"absolute","value":1698653315},{"type":"absolute","value":1698653188},{"type":"absolute","value":1698653062},{"type":"absolute","value":1698653320},{"type":"absolute","value":1698653193},{"type":"absolute","value":1698653067},{"type":"absolute","value":1698653579},{"type":"absolute","value":1698653325},{"type":"absolute","value":1698653198},{"type":"absolute","value":1698653072},{"type":"absolute","value":1698653203},{"type":"absolute","value":1698653592},{"type":"absolute","value":1698653082},{"type":"absolute","value":1698653087},{"type":"absolute","value":1698653566},{"type":"absolute","value":1698653092},{"type":"absolute","value":1698653221},{"type":"absolute","value":1698653097},{"type":"absolute","value":1698653226},{"type":"absolute","value":1698653611},{"type":"absolute","value":1698653231},{"type":"absolute","value":1698653107},{"type":"absolute","value":1698653236},{"type":"absolute","value":1698652982},{"type":"absolute","value":1698653112},{"type":"absolute","value":1698653624},{"type":"absolute","value":1698652987},{"type":"absolute","value":1698653117},{"type":"absolute","value":1698652992},{"type":"absolute","value":1698653249},{"type":"absolute","value":1698653122},{"type":"absolute","value":1698653506},{"type":"absolute","value":1698652997},{"type":"absolute","value":1698653254},{"type":"absolute","value":1698653259},{"type":"absolute","value":1698653132},{"type":"absolute","value":1698653516},{"type":"absolute","value":1698653643},{"type":"absolute","value":1698653007},{"type":"absolute","value":1698653264},{"type":"absolute","value":1698653137},{"type":"absolute","value":1698653012},{"type":"absolute","value":1698653142},{"type":"absolute","value":1698653526},{"type":"absolute","value":1698653656},{"type":"absolute","value":1698653017},{"type":"absolute","value":1698653147},{"type":"absolute","value":1698653022},{"type":"absolute","value":1698653536},{"type":"absolute","value":1698653282},{"type":"absolute","value":1698653287},{"type":"absolute","value":1698653032},{"type":"absolute","value":1698653160},{"type":"absolute","value":1698653546},{"type":"absolute","value":1698653292},{"type":"absolute","value":1698653037},{"type":"absolute","value":1698653165},{"type":"absolute","value":1698653047},{"type":"absolute","value":1698653297},{"type":"absolute","value":1698653042},{"type":"absolute","value":1698653170},{"type":"absolute","value":1698653556},{"type":"absolute","value":1698653175},{"type":"absolute","value":1698653310}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653348},{"type":"absolute","value":1698653669},{"type":"absolute","value":1698653353},{"type":"absolute","value":1698653338},{"type":"absolute","value":1698653343}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651078},{"type":"absolute","value":1698651048},{"type":"absolute","value":1698651114},{"type":"absolute","value":1698651146},{"type":"absolute","value":1698651178},{"type":"absolute","value":1698651088},{"type":"absolute","value":1698651133},{"type":"absolute","value":1698651058},{"type":"absolute","value":1698651165},{"type":"absolute","value":1698651028},{"type":"absolute","value":1698651068},{"type":"absolute","value":1698651101},{"type":"absolute","value":1698651038}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651365},{"type":"absolute","value":1698651398},{"type":"absolute","value":1698651335},{"type":"absolute","value":1698651430},{"type":"absolute","value":1698651462},{"type":"absolute","value":1698651375},{"type":"absolute","value":1698651345},{"type":"absolute","value":1698651411},{"type":"absolute","value":1698651443},{"type":"absolute","value":1698651475},{"type":"absolute","value":1698651385},{"type":"absolute","value":1698651355},{"type":"absolute","value":1698651325}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698648368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[{"type":"absolute","value":1698649089},{"type":"absolute","value":1698648706},{"type":"absolute","value":1698648451},{"type":"absolute","value":1698649347},{"type":"absolute","value":1698650308},{"type":"absolute","value":1698649866},{"type":"absolute","value":1698649293},{"type":"absolute","value":1698649038},{"type":"absolute","value":1698648655},{"type":"absolute","value":1698648400},{"type":"absolute","value":1698649617},{"type":"absolute","value":1698650130},{"type":"absolute","value":1698649242},{"type":"absolute","value":1698649563},{"type":"absolute","value":1698648604},{"type":"absolute","value":1698648987},{"type":"absolute","value":1698648865},{"type":"absolute","value":1698649697},{"type":"absolute","value":1698650210},{"type":"absolute","value":1698649509},{"type":"absolute","value":1698649958},{"type":"absolute","value":1698649191},{"type":"absolute","value":1698648553},{"type":"absolute","value":1698648811},{"type":"absolute","value":1698649455},{"type":"absolute","value":1698650035},{"type":"absolute","value":1698649140},{"type":"absolute","value":1698648757},{"type":"absolute","value":1698648502},{"type":"absolute","value":1698649401},{"type":"absolute","value":1698649789}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650400},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[{"type":"absolute","value":1698650497},{"type":"absolute","value":1698650689},{"type":"absolute","value":1698650595},{"type":"absolute","value":1698650535},{"type":"absolute","value":1698650440},{"type":"absolute","value":1698650631},{"type":"absolute","value":1698650573},{"type":"absolute","value":1698650478},{"type":"absolute","value":1698650516},{"type":"absolute","value":1698650711},{"type":"absolute","value":1698650554},{"type":"absolute","value":1698650459},{"type":"absolute","value":1698650653}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698650852},{"type":"absolute","value":1698650822},{"type":"absolute","value":1698650940},{"type":"absolute","value":1698650792},{"type":"absolute","value":1698650927},{"type":"absolute","value":1698650832},{"type":"absolute","value":1698650865},{"type":"absolute","value":1698650802},{"type":"absolute","value":1698650896},{"type":"absolute","value":1698650842},{"type":"absolute","value":1698650812},{"type":"absolute","value":1698650909},{"type":"absolute","value":1698650878}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698650953}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651078},{"type":"absolute","value":1698651048},{"type":"absolute","value":1698651114},{"type":"absolute","value":1698651146},{"type":"absolute","value":1698651178},{"type":"absolute","value":1698651088},{"type":"absolute","value":1698651133},{"type":"absolute","value":1698651058},{"type":"absolute","value":1698651165},{"type":"absolute","value":1698651028},{"type":"absolute","value":1698651068},{"type":"absolute","value":1698651101},{"type":"absolute","value":1698651038}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651365},{"type":"absolute","value":1698651398},{"type":"absolute","value":1698651335},{"type":"absolute","value":1698651430},{"type":"absolute","value":1698651462},{"type":"absolute","value":1698651375},{"type":"absolute","value":1698651345},{"type":"absolute","value":1698651411},{"type":"absolute","value":1698651443},{"type":"absolute","value":1698651475},{"type":"absolute","value":1698651385},{"type":"absolute","value":1698651355},{"type":"absolute","value":1698651325}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652545},{"type":"absolute","value":1698652166},{"type":"absolute","value":1698652422},{"type":"absolute","value":1698651913},{"type":"absolute","value":1698652171},{"type":"absolute","value":1698652044},{"type":"absolute","value":1698651918},{"type":"absolute","value":1698652558},{"type":"absolute","value":1698652176},{"type":"absolute","value":1698652049},{"type":"absolute","value":1698652432},{"type":"absolute","value":1698651923},{"type":"absolute","value":1698652181},{"type":"absolute","value":1698652054},{"type":"absolute","value":1698651928},{"type":"absolute","value":1698652442},{"type":"absolute","value":1698652059},{"type":"absolute","value":1698651938},{"type":"absolute","value":1698652452},{"type":"absolute","value":1698651943},{"type":"absolute","value":1698651948},{"type":"absolute","value":1698652077},{"type":"absolute","value":1698652462},{"type":"absolute","value":1698651953},{"type":"absolute","value":1698652082},{"type":"absolute","value":1698652087},{"type":"absolute","value":1698651963},{"type":"absolute","value":1698652092},{"type":"absolute","value":1698652475},{"type":"absolute","value":1698651838},{"type":"absolute","value":1698651968},{"type":"absolute","value":1698651843},{"type":"absolute","value":1698651973},{"type":"absolute","value":1698651848},{"type":"absolute","value":1698652105},{"type":"absolute","value":1698651978},{"type":"absolute","value":1698652488},{"type":"absolute","value":1698651853},{"type":"absolute","value":1698652110},{"type":"absolute","value":1698652115},{"type":"absolute","value":1698651988},{"type":"absolute","value":1698651863},{"type":"absolute","value":1698652120},{"type":"absolute","value":1698651993},{"type":"absolute","value":1698651898},{"type":"absolute","value":1698651868},{"type":"absolute","value":1698651998},{"type":"absolute","value":1698652510},{"type":"absolute","value":1698651873},{"type":"absolute","value":1698652003},{"type":"absolute","value":1698651878},{"type":"absolute","value":1698652138},{"type":"absolute","value":1698652523},{"type":"absolute","value":1698652143},{"type":"absolute","value":1698651888},{"type":"absolute","value":1698652016},{"type":"absolute","value":1698652402},{"type":"absolute","value":1698651903},{"type":"absolute","value":1698652148},{"type":"absolute","value":1698651893},{"type":"absolute","value":1698652021},{"type":"absolute","value":1698652153},{"type":"absolute","value":1698652026},{"type":"absolute","value":1698652412},{"type":"absolute","value":1698652031}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652209},{"type":"absolute","value":1698652194},{"type":"absolute","value":1698652199},{"type":"absolute","value":1698652571},{"type":"absolute","value":1698652204}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698652880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653057},{"type":"absolute","value":1698653315},{"type":"absolute","value":1698653188},{"type":"absolute","value":1698653062},{"type":"absolute","value":1698653320},{"type":"absolute","value":1698653193},{"type":"absolute","value":1698653067},{"type":"absolute","value":1698653579},{"type":"absolute","value":1698653325},{"type":"absolute","value":1698653198},{"type":"absolute","value":1698653072},{"type":"absolute","value":1698653203},{"type":"absolute","value":1698653592},{"type":"absolute","value":1698653082},{"type":"absolute","value":1698653087},{"type":"absolute","value":1698653566},{"type":"absolute","value":1698653092},{"type":"absolute","value":1698653221},{"type":"absolute","value":1698653097},{"type":"absolute","value":1698653226},{"type":"absolute","value":1698653611},{"type":"absolute","value":1698653231},{"type":"absolute","value":1698653107},{"type":"absolute","value":1698653236},{"type":"absolute","value":1698652982},{"type":"absolute","value":1698653112},{"type":"absolute","value":1698653624},{"type":"absolute","value":1698652987},{"type":"absolute","value":1698653117},{"type":"absolute","value":1698652992},{"type":"absolute","value":1698653249},{"type":"absolute","value":1698653122},{"type":"absolute","value":1698653506},{"type":"absolute","value":1698652997},{"type":"absolute","value":1698653254},{"type":"absolute","value":1698653259},{"type":"absolute","value":1698653132},{"type":"absolute","value":1698653516},{"type":"absolute","value":1698653643},{"type":"absolute","value":1698653007},{"type":"absolute","value":1698653264},{"type":"absolute","value":1698653137},{"type":"absolute","value":1698653012},{"type":"absolute","value":1698653142},{"type":"absolute","value":1698653526},{"type":"absolute","value":1698653656},{"type":"absolute","value":1698653017},{"type":"absolute","value":1698653147},{"type":"absolute","value":1698653022},{"type":"absolute","value":1698653536},{"type":"absolute","value":1698653282},{"type":"absolute","value":1698653287},{"type":"absolute","value":1698653032},{"type":"absolute","value":1698653160},{"type":"absolute","value":1698653546},{"type":"absolute","value":1698653292},{"type":"absolute","value":1698653037},{"type":"absolute","value":1698653165},{"type":"absolute","value":1698653047},{"type":"absolute","value":1698653297},{"type":"absolute","value":1698653042},{"type":"absolute","value":1698653170},{"type":"absolute","value":1698653556},{"type":"absolute","value":1698653175},{"type":"absolute","value":1698653310}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653348},{"type":"absolute","value":1698653669},{"type":"absolute","value":1698653353},{"type":"absolute","value":1698653338},{"type":"absolute","value":1698653343}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698654656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698656771},{"type":"absolute","value":1698656776},{"type":"absolute","value":1698654985},{"type":"absolute","value":1698657292},{"type":"absolute","value":1698656781},{"type":"absolute","value":1698657305},{"type":"absolute","value":1698656794},{"type":"absolute","value":1698656799},{"type":"absolute","value":1698656804},{"type":"absolute","value":1698656809},{"type":"absolute","value":1698656822},{"type":"absolute","value":1698656827},{"type":"absolute","value":1698656832},{"type":"absolute","value":1698656837},{"type":"absolute","value":1698656855},{"type":"absolute","value":1698656860},{"type":"absolute","value":1698656865},{"type":"absolute","value":1698656870},{"type":"absolute","value":1698656616},{"type":"absolute","value":1698656621},{"type":"absolute","value":1698656626},{"type":"absolute","value":1698656883},{"type":"absolute","value":1698654837},{"type":"absolute","value":1698656631},{"type":"absolute","value":1698656888},{"type":"absolute","value":1698656893},{"type":"absolute","value":1698654847},{"type":"absolute","value":1698656641},{"type":"absolute","value":1698656898},{"type":"absolute","value":1698657157},{"type":"absolute","value":1698656646},{"type":"absolute","value":1698654857},{"type":"absolute","value":1698656651},{"type":"absolute","value":1698657167},{"type":"absolute","value":1698656656},{"type":"absolute","value":1698654867},{"type":"absolute","value":1698656916},{"type":"absolute","value":1698656921},{"type":"absolute","value":1698656666},{"type":"absolute","value":1698657177},{"type":"absolute","value":1698654877},{"type":"absolute","value":1698656926},{"type":"absolute","value":1698656671},{"type":"absolute","value":1698656931},{"type":"absolute","value":1698656676},{"type":"absolute","value":1698657187},{"type":"absolute","value":1698654887},{"type":"absolute","value":1698656681},{"type":"absolute","value":1698657197},{"type":"absolute","value":1698656944},{"type":"absolute","value":1698654897},{"type":"absolute","value":1698656691},{"type":"absolute","value":1698656949},{"type":"absolute","value":1698657207},{"type":"absolute","value":1698656696},{"type":"absolute","value":1698656954},{"type":"absolute","value":1698656701},{"type":"absolute","value":1698654910},{"type":"absolute","value":1698656959},{"type":"absolute","value":1698657217},{"type":"absolute","value":1698656706},{"type":"absolute","value":1698654923},{"type":"absolute","value":1698656716},{"type":"absolute","value":1698657230},{"type":"absolute","value":1698656721},{"type":"absolute","value":1698656726},{"type":"absolute","value":1698656731},{"type":"absolute","value":1698657243},{"type":"absolute","value":1698654941},{"type":"absolute","value":1698656741},{"type":"absolute","value":1698654954},{"type":"absolute","value":1698656746},{"type":"absolute","value":1698657261},{"type":"absolute","value":1698656751},{"type":"absolute","value":1698656756},{"type":"absolute","value":1698657274},{"type":"absolute","value":1698654972},{"type":"absolute","value":1698656766}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698656977},{"type":"absolute","value":1698654998},{"type":"absolute","value":1698656982},{"type":"absolute","value":1698657318},{"type":"absolute","value":1698656987},{"type":"absolute","value":1698656972}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698657376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698658562},{"type":"absolute","value":1698657539},{"type":"absolute","value":1698658057},{"type":"absolute","value":1698657549},{"type":"absolute","value":1698658062},{"type":"absolute","value":1698658067},{"type":"absolute","value":1698658580},{"type":"absolute","value":1698657559},{"type":"absolute","value":1698658072},{"type":"absolute","value":1698657569},{"type":"absolute","value":1698658082},{"type":"absolute","value":1698658593},{"type":"absolute","value":1698658087},{"type":"absolute","value":1698657579},{"type":"absolute","value":1698658092},{"type":"absolute","value":1698658097},{"type":"absolute","value":1698657592},{"type":"absolute","value":1698658107},{"type":"absolute","value":1698658112},{"type":"absolute","value":1698657605},{"type":"absolute","value":1698658117},{"type":"absolute","value":1698658122},{"type":"absolute","value":1698657623},{"type":"absolute","value":1698658135},{"type":"absolute","value":1698658140},{"type":"absolute","value":1698658145},{"type":"absolute","value":1698657636},{"type":"absolute","value":1698658150},{"type":"absolute","value":1698658163},{"type":"absolute","value":1698657654},{"type":"absolute","value":1698658168},{"type":"absolute","value":1698658173},{"type":"absolute","value":1698658178},{"type":"absolute","value":1698657667},{"type":"absolute","value":1698658445},{"type":"absolute","value":1698658196},{"type":"absolute","value":1698658455},{"type":"absolute","value":1698658201},{"type":"absolute","value":1698658206},{"type":"absolute","value":1698658465},{"type":"absolute","value":1698658211},{"type":"absolute","value":1698657957},{"type":"absolute","value":1698657962},{"type":"absolute","value":1698658475},{"type":"absolute","value":1698657967},{"type":"absolute","value":1698658224},{"type":"absolute","value":1698657972},{"type":"absolute","value":1698658229},{"type":"absolute","value":1698658485},{"type":"absolute","value":1698658234},{"type":"absolute","value":1698657982},{"type":"absolute","value":1698658239},{"type":"absolute","value":1698658495},{"type":"absolute","value":1698657987},{"type":"absolute","value":1698657992},{"type":"absolute","value":1698658505},{"type":"absolute","value":1698657997},{"type":"absolute","value":1698658257},{"type":"absolute","value":1698658262},{"type":"absolute","value":1698658007},{"type":"absolute","value":1698658518},{"type":"absolute","value":1698658267},{"type":"absolute","value":1698658012},{"type":"absolute","value":1698658272},{"type":"absolute","value":1698658017},{"type":"absolute","value":1698658531},{"type":"absolute","value":1698658022},{"type":"absolute","value":1698658285},{"type":"absolute","value":1698657519},{"type":"absolute","value":1698658032},{"type":"absolute","value":1698658290},{"type":"absolute","value":1698658037},{"type":"absolute","value":1698658549},{"type":"absolute","value":1698658295},{"type":"absolute","value":1698657529},{"type":"absolute","value":1698658042},{"type":"absolute","value":1698658300},{"type":"absolute","value":1698658047}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698657680},{"type":"absolute","value":1698658606},{"type":"absolute","value":1698658323},{"type":"absolute","value":1698658328},{"type":"absolute","value":1698658313},{"type":"absolute","value":1698658318}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698833800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698849280},{"type":"absolute","value":1698836481},{"type":"absolute","value":1698849285},{"type":"absolute","value":1698836486},{"type":"absolute","value":1698849290},{"type":"absolute","value":1698836491},{"type":"absolute","value":1698849295},{"type":"absolute","value":1698836496},{"type":"absolute","value":1698849300},{"type":"absolute","value":1698836501},{"type":"absolute","value":1698849305},{"type":"absolute","value":1698836506},{"type":"absolute","value":1698840605},{"type":"absolute","value":1698849310},{"type":"absolute","value":1698840610},{"type":"absolute","value":1698849315},{"type":"absolute","value":1698854947},{"type":"absolute","value":1698840615},{"type":"absolute","value":1698854952},{"type":"absolute","value":1698840620},{"type":"absolute","value":1698854957},{"type":"absolute","value":1698840625},{"type":"absolute","value":1698854962},{"type":"absolute","value":1698840630},{"type":"absolute","value":1698854967},{"type":"absolute","value":1698840635},{"type":"absolute","value":1698854972},{"type":"absolute","value":1698844221},{"type":"absolute","value":1698840640},{"type":"absolute","value":1698854977},{"type":"absolute","value":1698844226},{"type":"absolute","value":1698854982},{"type":"absolute","value":1698844231},{"type":"absolute","value":1698844236},{"type":"absolute","value":1698844241},{"type":"absolute","value":1698844246},{"type":"absolute","value":1698844251},{"type":"absolute","value":1698844256},{"type":"absolute","value":1698835567},{"type":"absolute","value":1698835572},{"type":"absolute","value":1698848373},{"type":"absolute","value":1698835577},{"type":"absolute","value":1698848378},{"type":"absolute","value":1698835582},{"type":"absolute","value":1698848383},{"type":"absolute","value":1698835587},{"type":"absolute","value":1698848388},{"type":"absolute","value":1698835592},{"type":"absolute","value":1698848393},{"type":"absolute","value":1698835597},{"type":"absolute","value":1698848398},{"type":"absolute","value":1698839183},{"type":"absolute","value":1698835602},{"type":"absolute","value":1698848403},{"type":"absolute","value":1698839188},{"type":"absolute","value":1698848408},{"type":"absolute","value":1698839193},{"type":"absolute","value":1698854040},{"type":"absolute","value":1698854045},{"type":"absolute","value":1698839198},{"type":"absolute","value":1698854050},{"type":"absolute","value":1698839203},{"type":"absolute","value":1698854055},{"type":"absolute","value":1698839208},{"type":"absolute","value":1698854060},{"type":"absolute","value":1698839213},{"type":"absolute","value":1698854065},{"type":"absolute","value":1698839218},{"type":"absolute","value":1698843317},{"type":"absolute","value":1698854070},{"type":"absolute","value":1698843322},{"type":"absolute","value":1698854075},{"type":"absolute","value":1698843327},{"type":"absolute","value":1698843332},{"type":"absolute","value":1698857668},{"type":"absolute","value":1698843337},{"type":"absolute","value":1698857673},{"type":"absolute","value":1698843342},{"type":"absolute","value":1698857678},{"type":"absolute","value":1698843347},{"type":"absolute","value":1698857683},{"type":"absolute","value":1698843352},{"type":"absolute","value":1698857688},{"type":"absolute","value":1698857693},{"type":"absolute","value":1698857698},{"type":"absolute","value":1698834663},{"type":"absolute","value":1698857703},{"type":"absolute","value":1698847466},{"type":"absolute","value":1698834668},{"type":"absolute","value":1698847471},{"type":"absolute","value":1698834673},{"type":"absolute","value":1698847476},{"type":"absolute","value":1698834678},{"type":"absolute","value":1698847481},{"type":"absolute","value":1698834683},{"type":"absolute","value":1698847486},{"type":"absolute","value":1698834688},{"type":"absolute","value":1698847491},{"type":"absolute","value":1698834693},{"type":"absolute","value":1698838279},{"type":"absolute","value":1698847496},{"type":"absolute","value":1698834698},{"type":"absolute","value":1698838284},{"type":"absolute","value":1698847501},{"type":"absolute","value":1698853133},{"type":"absolute","value":1698838289},{"type":"absolute","value":1698853138},{"type":"absolute","value":1698838294},{"type":"absolute","value":1698851094},{"type":"absolute","value":1698853143},{"type":"absolute","value":1698838299},{"type":"absolute","value":1698851099},{"type":"absolute","value":1698853148},{"type":"absolute","value":1698838304},{"type":"absolute","value":1698851104},{"type":"absolute","value":1698853153},{"type":"absolute","value":1698838309},{"type":"absolute","value":1698851109},{"type":"absolute","value":1698853158},{"type":"absolute","value":1698838314},{"type":"absolute","value":1698851114},{"type":"absolute","value":1698853163},{"type":"absolute","value":1698842413},{"type":"absolute","value":1698851119},{"type":"absolute","value":1698853168},{"type":"absolute","value":1698842418},{"type":"absolute","value":1698851124},{"type":"absolute","value":1698842423},{"type":"absolute","value":1698851129},{"type":"absolute","value":1698856761},{"type":"absolute","value":1698842428},{"type":"absolute","value":1698856766},{"type":"absolute","value":1698842433},{"type":"absolute","value":1698856771},{"type":"absolute","value":1698842438},{"type":"absolute","value":1698856776},{"type":"absolute","value":1698842443},{"type":"absolute","value":1698856781},{"type":"absolute","value":1698842448},{"type":"absolute","value":1698856786},{"type":"absolute","value":1698856791},{"type":"absolute","value":1698856796},{"type":"absolute","value":1698846559},{"type":"absolute","value":1698846564},{"type":"absolute","value":1698846569},{"type":"absolute","value":1698846574},{"type":"absolute","value":1698846579},{"type":"absolute","value":1698846584},{"type":"absolute","value":1698846589},{"type":"absolute","value":1698837375},{"type":"absolute","value":1698846594},{"type":"absolute","value":1698837380},{"type":"absolute","value":1698837385},{"type":"absolute","value":1698850187},{"type":"absolute","value":1698837390},{"type":"absolute","value":1698850192},{"type":"absolute","value":1698837395},{"type":"absolute","value":1698850197},{"type":"absolute","value":1698837400},{"type":"absolute","value":1698850202},{"type":"absolute","value":1698837405},{"type":"absolute","value":1698850207},{"type":"absolute","value":1698837410},{"type":"absolute","value":1698850212},{"type":"absolute","value":1698841509},{"type":"absolute","value":1698850217},{"type":"absolute","value":1698841514},{"type":"absolute","value":1698850222},{"type":"absolute","value":1698841519},{"type":"absolute","value":1698855854},{"type":"absolute","value":1698855859},{"type":"absolute","value":1698841524},{"type":"absolute","value":1698855864},{"type":"absolute","value":1698841529},{"type":"absolute","value":1698855869},{"type":"absolute","value":1698841534},{"type":"absolute","value":1698855874},{"type":"absolute","value":1698841539},{"type":"absolute","value":1698845125},{"type":"absolute","value":1698855879},{"type":"absolute","value":1698841544},{"type":"absolute","value":1698845130},{"type":"absolute","value":1698855884},{"type":"absolute","value":1698845135},{"type":"absolute","value":1698855889},{"type":"absolute","value":1698845140},{"type":"absolute","value":1698845145},{"type":"absolute","value":1698845150},{"type":"absolute","value":1698845155},{"type":"absolute","value":1698845160},{"type":"absolute","value":1698836471},{"type":"absolute","value":1698836476}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698858208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698863616},{"type":"absolute","value":1698872833},{"type":"absolute","value":1698863621},{"type":"absolute","value":1698872838},{"type":"absolute","value":1698863626},{"type":"absolute","value":1698863631},{"type":"absolute","value":1698863636},{"type":"absolute","value":1698876950},{"type":"absolute","value":1698863641},{"type":"absolute","value":1698876955},{"type":"absolute","value":1698863646},{"type":"absolute","value":1698876960},{"type":"absolute","value":1698863651},{"type":"absolute","value":1698876965},{"type":"absolute","value":1698876970},{"type":"absolute","value":1698876975},{"type":"absolute","value":1698860023},{"type":"absolute","value":1698876980},{"type":"absolute","value":1698867765},{"type":"absolute","value":1698876985},{"type":"absolute","value":1698867770},{"type":"absolute","value":1698867775},{"type":"absolute","value":1698880578},{"type":"absolute","value":1698867780},{"type":"absolute","value":1698880583},{"type":"absolute","value":1698859081},{"type":"absolute","value":1698867785},{"type":"absolute","value":1698880588},{"type":"absolute","value":1698859086},{"type":"absolute","value":1698867790},{"type":"absolute","value":1698880593},{"type":"absolute","value":1698859091},{"type":"absolute","value":1698867795},{"type":"absolute","value":1698880598},{"type":"absolute","value":1698859096},{"type":"absolute","value":1698867800},{"type":"absolute","value":1698871899},{"type":"absolute","value":1698880603},{"type":"absolute","value":1698859101},{"type":"absolute","value":1698871904},{"type":"absolute","value":1698880608},{"type":"absolute","value":1698859106},{"type":"absolute","value":1698871909},{"type":"absolute","value":1698880613},{"type":"absolute","value":1698859111},{"type":"absolute","value":1698871914},{"type":"absolute","value":1698859116},{"type":"absolute","value":1698871919},{"type":"absolute","value":1698871924},{"type":"absolute","value":1698862709},{"type":"absolute","value":1698871929},{"type":"absolute","value":1698862714},{"type":"absolute","value":1698875515},{"type":"absolute","value":1698871934},{"type":"absolute","value":1698862719},{"type":"absolute","value":1698875520},{"type":"absolute","value":1698862724},{"type":"absolute","value":1698875525},{"type":"absolute","value":1698862729},{"type":"absolute","value":1698875530},{"type":"absolute","value":1698862734},{"type":"absolute","value":1698875535},{"type":"absolute","value":1698862739},{"type":"absolute","value":1698875540},{"type":"absolute","value":1698862744},{"type":"absolute","value":1698875545},{"type":"absolute","value":1698875550},{"type":"absolute","value":1698866861},{"type":"absolute","value":1698866866},{"type":"absolute","value":1698866871},{"type":"absolute","value":1698879671},{"type":"absolute","value":1698866876},{"type":"absolute","value":1698879676},{"type":"absolute","value":1698866881},{"type":"absolute","value":1698879681},{"type":"absolute","value":1698866886},{"type":"absolute","value":1698879686},{"type":"absolute","value":1698866891},{"type":"absolute","value":1698879691},{"type":"absolute","value":1698866896},{"type":"absolute","value":1698879696},{"type":"absolute","value":1698870995},{"type":"absolute","value":1698879701},{"type":"absolute","value":1698871000},{"type":"absolute","value":1698879706},{"type":"absolute","value":1698871005},{"type":"absolute","value":1698871010},{"type":"absolute","value":1698871015},{"type":"absolute","value":1698861802},{"type":"absolute","value":1698871020},{"type":"absolute","value":1698861807},{"type":"absolute","value":1698871025},{"type":"absolute","value":1698874611},{"type":"absolute","value":1698861812},{"type":"absolute","value":1698871030},{"type":"absolute","value":1698874616},{"type":"absolute","value":1698861817},{"type":"absolute","value":1698874621},{"type":"absolute","value":1698861822},{"type":"absolute","value":1698874626},{"type":"absolute","value":1698861827},{"type":"absolute","value":1698874631},{"type":"absolute","value":1698861832},{"type":"absolute","value":1698874636},{"type":"absolute","value":1698861837},{"type":"absolute","value":1698874641},{"type":"absolute","value":1698874646},{"type":"absolute","value":1698865957},{"type":"absolute","value":1698865962},{"type":"absolute","value":1698878764},{"type":"absolute","value":1698865967},{"type":"absolute","value":1698878769},{"type":"absolute","value":1698865972},{"type":"absolute","value":1698878774},{"type":"absolute","value":1698865977},{"type":"absolute","value":1698878779},{"type":"absolute","value":1698865982},{"type":"absolute","value":1698878784},{"type":"absolute","value":1698865987},{"type":"absolute","value":1698869573},{"type":"absolute","value":1698878789},{"type":"absolute","value":1698865992},{"type":"absolute","value":1698869578},{"type":"absolute","value":1698878794},{"type":"absolute","value":1698869583},{"type":"absolute","value":1698878799},{"type":"absolute","value":1698869588},{"type":"absolute","value":1698869593},{"type":"absolute","value":1698869598},{"type":"absolute","value":1698860895},{"type":"absolute","value":1698869603},{"type":"absolute","value":1698860900},{"type":"absolute","value":1698869608},{"type":"absolute","value":1698860905},{"type":"absolute","value":1698873707},{"type":"absolute","value":1698860910},{"type":"absolute","value":1698873712},{"type":"absolute","value":1698860915},{"type":"absolute","value":1698873717},{"type":"absolute","value":1698860920},{"type":"absolute","value":1698873722},{"type":"absolute","value":1698860925},{"type":"absolute","value":1698873727},{"type":"absolute","value":1698860930},{"type":"absolute","value":1698873732},{"type":"absolute","value":1698873737},{"type":"absolute","value":1698873742},{"type":"absolute","value":1698865053},{"type":"absolute","value":1698877857},{"type":"absolute","value":1698865058},{"type":"absolute","value":1698877862},{"type":"absolute","value":1698865063},{"type":"absolute","value":1698877867},{"type":"absolute","value":1698865068},{"type":"absolute","value":1698877872},{"type":"absolute","value":1698865073},{"type":"absolute","value":1698877877},{"type":"absolute","value":1698865078},{"type":"absolute","value":1698877882},{"type":"absolute","value":1698865083},{"type":"absolute","value":1698868669},{"type":"absolute","value":1698877887},{"type":"absolute","value":1698865088},{"type":"absolute","value":1698868674},{"type":"absolute","value":1698877892},{"type":"absolute","value":1698868679},{"type":"absolute","value":1698868684},{"type":"absolute","value":1698881485},{"type":"absolute","value":1698868689},{"type":"absolute","value":1698881490},{"type":"absolute","value":1698859988},{"type":"absolute","value":1698868694},{"type":"absolute","value":1698881495},{"type":"absolute","value":1698859993},{"type":"absolute","value":1698868699},{"type":"absolute","value":1698881500},{"type":"absolute","value":1698859998},{"type":"absolute","value":1698868704},{"type":"absolute","value":1698881505},{"type":"absolute","value":1698860003},{"type":"absolute","value":1698872803},{"type":"absolute","value":1698881510},{"type":"absolute","value":1698860008},{"type":"absolute","value":1698872808},{"type":"absolute","value":1698881515},{"type":"absolute","value":1698860013},{"type":"absolute","value":1698872813},{"type":"absolute","value":1698881520},{"type":"absolute","value":1698860018},{"type":"absolute","value":1698872818},{"type":"absolute","value":1698872823},{"type":"absolute","value":1698872828}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698892616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698890468},{"type":"absolute","value":1698889341},{"type":"absolute","value":1698886950},{"type":"absolute","value":1698887591},{"type":"absolute","value":1698890251},{"type":"absolute","value":1698889996},{"type":"absolute","value":1698889775},{"type":"absolute","value":1698887376},{"type":"absolute","value":1698889558},{"type":"absolute","value":1698887165}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698892936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698900992},{"type":"absolute","value":1698903040},{"type":"absolute","value":1698911235},{"type":"absolute","value":1698913284},{"type":"absolute","value":1698903045},{"type":"absolute","value":1698911240},{"type":"absolute","value":1698913289},{"type":"absolute","value":1698903050},{"type":"absolute","value":1698911245},{"type":"absolute","value":1698913294},{"type":"absolute","value":1698902033},{"type":"absolute","value":1698911250},{"type":"absolute","value":1698913299},{"type":"absolute","value":1698902038},{"type":"absolute","value":1698911255},{"type":"absolute","value":1698913304},{"type":"absolute","value":1698893849},{"type":"absolute","value":1698902043},{"type":"absolute","value":1698904091},{"type":"absolute","value":1698913309},{"type":"absolute","value":1698893854},{"type":"absolute","value":1698902048},{"type":"absolute","value":1698904096},{"type":"absolute","value":1698913314},{"type":"absolute","value":1698893859},{"type":"absolute","value":1698902053},{"type":"absolute","value":1698904101},{"type":"absolute","value":1698913319},{"type":"absolute","value":1698893864},{"type":"absolute","value":1698902058},{"type":"absolute","value":1698904106},{"type":"absolute","value":1698912299},{"type":"absolute","value":1698893869},{"type":"absolute","value":1698902063},{"type":"absolute","value":1698904111},{"type":"absolute","value":1698912304},{"type":"absolute","value":1698893874},{"type":"absolute","value":1698902068},{"type":"absolute","value":1698904116},{"type":"absolute","value":1698912309},{"type":"absolute","value":1698893879},{"type":"absolute","value":1698904121},{"type":"absolute","value":1698912314},{"type":"absolute","value":1698893884},{"type":"absolute","value":1698904126},{"type":"absolute","value":1698912319},{"type":"absolute","value":1698912324},{"type":"absolute","value":1698903109},{"type":"absolute","value":1698912329},{"type":"absolute","value":1698903114},{"type":"absolute","value":1698894925},{"type":"absolute","value":1698912334},{"type":"absolute","value":1698903119},{"type":"absolute","value":1698905167},{"type":"absolute","value":1698894930},{"type":"absolute","value":1698903124},{"type":"absolute","value":1698905172},{"type":"absolute","value":1698894935},{"type":"absolute","value":1698903129},{"type":"absolute","value":1698905177},{"type":"absolute","value":1698894940},{"type":"absolute","value":1698903134},{"type":"absolute","value":1698905182},{"type":"absolute","value":1698894945},{"type":"absolute","value":1698913378},{"type":"absolute","value":1698903139},{"type":"absolute","value":1698905187},{"type":"absolute","value":1698894950},{"type":"absolute","value":1698913383},{"type":"absolute","value":1698903144},{"type":"absolute","value":1698905192},{"type":"absolute","value":1698894955},{"type":"absolute","value":1698913388},{"type":"absolute","value":1698905197},{"type":"absolute","value":1698894960},{"type":"absolute","value":1698913393},{"type":"absolute","value":1698905202},{"type":"absolute","value":1698913398},{"type":"absolute","value":1698893943},{"type":"absolute","value":1698904185},{"type":"absolute","value":1698913403},{"type":"absolute","value":1698893948},{"type":"absolute","value":1698904190},{"type":"absolute","value":1698913408},{"type":"absolute","value":1698893953},{"type":"absolute","value":1698896001},{"type":"absolute","value":1698904195},{"type":"absolute","value":1698906243},{"type":"absolute","value":1698913413},{"type":"absolute","value":1698893958},{"type":"absolute","value":1698896006},{"type":"absolute","value":1698904200},{"type":"absolute","value":1698906248},{"type":"absolute","value":1698893963},{"type":"absolute","value":1698896011},{"type":"absolute","value":1698904205},{"type":"absolute","value":1698906253},{"type":"absolute","value":1698893968},{"type":"absolute","value":1698896016},{"type":"absolute","value":1698904210},{"type":"absolute","value":1698906258},{"type":"absolute","value":1698893973},{"type":"absolute","value":1698896021},{"type":"absolute","value":1698904215},{"type":"absolute","value":1698906263},{"type":"absolute","value":1698893978},{"type":"absolute","value":1698896026},{"type":"absolute","value":1698904220},{"type":"absolute","value":1698906268},{"type":"absolute","value":1698896031},{"type":"absolute","value":1698906273},{"type":"absolute","value":1698896036},{"type":"absolute","value":1698906278},{"type":"absolute","value":1698895019},{"type":"absolute","value":1698905261},{"type":"absolute","value":1698895024},{"type":"absolute","value":1698905266},{"type":"absolute","value":1698895029},{"type":"absolute","value":1698897077},{"type":"absolute","value":1698905271},{"type":"absolute","value":1698895034},{"type":"absolute","value":1698897082},{"type":"absolute","value":1698905276},{"type":"absolute","value":1698895039},{"type":"absolute","value":1698897087},{"type":"absolute","value":1698905281},{"type":"absolute","value":1698895044},{"type":"absolute","value":1698897092},{"type":"absolute","value":1698905286},{"type":"absolute","value":1698895049},{"type":"absolute","value":1698897097},{"type":"absolute","value":1698905291},{"type":"absolute","value":1698895054},{"type":"absolute","value":1698897102},{"type":"absolute","value":1698905296},{"type":"absolute","value":1698897107},{"type":"absolute","value":1698897112},{"type":"absolute","value":1698915546},{"type":"absolute","value":1698896095},{"type":"absolute","value":1698915551},{"type":"absolute","value":1698906337},{"type":"absolute","value":1698896100},{"type":"absolute","value":1698915556},{"type":"absolute","value":1698906342},{"type":"absolute","value":1698896105},{"type":"absolute","value":1698898153},{"type":"absolute","value":1698906347},{"type":"absolute","value":1698915561},{"type":"absolute","value":1698896110},{"type":"absolute","value":1698898158},{"type":"absolute","value":1698906352},{"type":"absolute","value":1698915566},{"type":"absolute","value":1698896115},{"type":"absolute","value":1698898163},{"type":"absolute","value":1698906357},{"type":"absolute","value":1698915571},{"type":"absolute","value":1698896120},{"type":"absolute","value":1698898168},{"type":"absolute","value":1698906362},{"type":"absolute","value":1698915576},{"type":"absolute","value":1698896125},{"type":"absolute","value":1698898173},{"type":"absolute","value":1698906367},{"type":"absolute","value":1698915581},{"type":"absolute","value":1698896130},{"type":"absolute","value":1698898178},{"type":"absolute","value":1698906372},{"type":"absolute","value":1698898183},{"type":"absolute","value":1698898188},{"type":"absolute","value":1698916625},{"type":"absolute","value":1698897171},{"type":"absolute","value":1698916630},{"type":"absolute","value":1698897176},{"type":"absolute","value":1698916635},{"type":"absolute","value":1698897181},{"type":"absolute","value":1698899229},{"type":"absolute","value":1698916640},{"type":"absolute","value":1698897186},{"type":"absolute","value":1698899234},{"type":"absolute","value":1698916645},{"type":"absolute","value":1698897191},{"type":"absolute","value":1698899239},{"type":"absolute","value":1698916650},{"type":"absolute","value":1698897196},{"type":"absolute","value":1698899244},{"type":"absolute","value":1698916655},{"type":"absolute","value":1698897201},{"type":"absolute","value":1698899249},{"type":"absolute","value":1698916660},{"type":"absolute","value":1698897206},{"type":"absolute","value":1698899254},{"type":"absolute","value":1698915640},{"type":"absolute","value":1698899259},{"type":"absolute","value":1698915645},{"type":"absolute","value":1698899264},{"type":"absolute","value":1698915650},{"type":"absolute","value":1698898247},{"type":"absolute","value":1698915655},{"type":"absolute","value":1698917704},{"type":"absolute","value":1698898252},{"type":"absolute","value":1698915660},{"type":"absolute","value":1698917709},{"type":"absolute","value":1698898257},{"type":"absolute","value":1698915665},{"type":"absolute","value":1698917714},{"type":"absolute","value":1698898262},{"type":"absolute","value":1698915670},{"type":"absolute","value":1698917719},{"type":"absolute","value":1698898267},{"type":"absolute","value":1698915675},{"type":"absolute","value":1698917724},{"type":"absolute","value":1698898272},{"type":"absolute","value":1698917729},{"type":"absolute","value":1698898277},{"type":"absolute","value":1698917734},{"type":"absolute","value":1698898282},{"type":"absolute","value":1698917739},{"type":"absolute","value":1698916719},{"type":"absolute","value":1698916724},{"type":"absolute","value":1698916729},{"type":"absolute","value":1698899323},{"type":"absolute","value":1698916734},{"type":"absolute","value":1698918783},{"type":"absolute","value":1698899328},{"type":"absolute","value":1698916739},{"type":"absolute","value":1698918788},{"type":"absolute","value":1698899333},{"type":"absolute","value":1698903035},{"type":"absolute","value":1698916744},{"type":"absolute","value":1698918793},{"type":"absolute","value":1698899338},{"type":"absolute","value":1698916749},{"type":"absolute","value":1698918798},{"type":"absolute","value":1698899343},{"type":"absolute","value":1698916754},{"type":"absolute","value":1698918803},{"type":"absolute","value":1698899348},{"type":"absolute","value":1698918808},{"type":"absolute","value":1698899353},{"type":"absolute","value":1698918813},{"type":"absolute","value":1698899358},{"type":"absolute","value":1698918818},{"type":"absolute","value":1698917798},{"type":"absolute","value":1698917803},{"type":"absolute","value":1698917808},{"type":"absolute","value":1698917813},{"type":"absolute","value":1698919862},{"type":"absolute","value":1698917818},{"type":"absolute","value":1698919867},{"type":"absolute","value":1698917823},{"type":"absolute","value":1698919872},{"type":"absolute","value":1698917828},{"type":"absolute","value":1698919877},{"type":"absolute","value":1698917833},{"type":"absolute","value":1698919882},{"type":"absolute","value":1698919887},{"type":"absolute","value":1698919892},{"type":"absolute","value":1698919897},{"type":"absolute","value":1698918877},{"type":"absolute","value":1698918882},{"type":"absolute","value":1698918887},{"type":"absolute","value":1698918892},{"type":"absolute","value":1698920941},{"type":"absolute","value":1698918897},{"type":"absolute","value":1698920946},{"type":"absolute","value":1698918902},{"type":"absolute","value":1698920951},{"type":"absolute","value":1698918907},{"type":"absolute","value":1698920956},{"type":"absolute","value":1698918912},{"type":"absolute","value":1698920961},{"type":"absolute","value":1698920966},{"type":"absolute","value":1698920971},{"type":"absolute","value":1698920976},{"type":"absolute","value":1698919956},{"type":"absolute","value":1698919961},{"type":"absolute","value":1698919966},{"type":"absolute","value":1698919971},{"type":"absolute","value":1698919976},{"type":"absolute","value":1698919981},{"type":"absolute","value":1698919986},{"type":"absolute","value":1698919991},{"type":"absolute","value":1698921035},{"type":"absolute","value":1698921040},{"type":"absolute","value":1698921045},{"type":"absolute","value":1698921050},{"type":"absolute","value":1698921055},{"type":"absolute","value":1698921060},{"type":"absolute","value":1698921065},{"type":"absolute","value":1698921070},{"type":"absolute","value":1698907889},{"type":"absolute","value":1698907894},{"type":"absolute","value":1698907899},{"type":"absolute","value":1698907904},{"type":"absolute","value":1698907909},{"type":"absolute","value":1698907914},{"type":"absolute","value":1698907919},{"type":"absolute","value":1698907924},{"type":"absolute","value":1698908968},{"type":"absolute","value":1698908973},{"type":"absolute","value":1698908978},{"type":"absolute","value":1698908983},{"type":"absolute","value":1698908988},{"type":"absolute","value":1698908993},{"type":"absolute","value":1698908998},{"type":"absolute","value":1698909003},{"type":"absolute","value":1698907983},{"type":"absolute","value":1698907988},{"type":"absolute","value":1698907993},{"type":"absolute","value":1698907998},{"type":"absolute","value":1698910047},{"type":"absolute","value":1698908003},{"type":"absolute","value":1698910052},{"type":"absolute","value":1698908008},{"type":"absolute","value":1698910057},{"type":"absolute","value":1698908013},{"type":"absolute","value":1698910062},{"type":"absolute","value":1698908018},{"type":"absolute","value":1698910067},{"type":"absolute","value":1698910072},{"type":"absolute","value":1698910077},{"type":"absolute","value":1698900863},{"type":"absolute","value":1698910082},{"type":"absolute","value":1698900868},{"type":"absolute","value":1698909062},{"type":"absolute","value":1698900873},{"type":"absolute","value":1698909067},{"type":"absolute","value":1698900878},{"type":"absolute","value":1698909072},{"type":"absolute","value":1698900883},{"type":"absolute","value":1698909077},{"type":"absolute","value":1698911126},{"type":"absolute","value":1698900888},{"type":"absolute","value":1698909082},{"type":"absolute","value":1698911131},{"type":"absolute","value":1698900893},{"type":"absolute","value":1698909087},{"type":"absolute","value":1698911136},{"type":"absolute","value":1698900898},{"type":"absolute","value":1698909092},{"type":"absolute","value":1698911141},{"type":"absolute","value":1698909097},{"type":"absolute","value":1698911146},{"type":"absolute","value":1698911151},{"type":"absolute","value":1698901939},{"type":"absolute","value":1698911156},{"type":"absolute","value":1698901944},{"type":"absolute","value":1698911161},{"type":"absolute","value":1698901949},{"type":"absolute","value":1698910141},{"type":"absolute","value":1698901954},{"type":"absolute","value":1698910146},{"type":"absolute","value":1698901959},{"type":"absolute","value":1698910151},{"type":"absolute","value":1698901964},{"type":"absolute","value":1698910156},{"type":"absolute","value":1698912205},{"type":"absolute","value":1698901969},{"type":"absolute","value":1698910161},{"type":"absolute","value":1698912210},{"type":"absolute","value":1698901974},{"type":"absolute","value":1698910166},{"type":"absolute","value":1698912215},{"type":"absolute","value":1698910171},{"type":"absolute","value":1698912220},{"type":"absolute","value":1698900957},{"type":"absolute","value":1698910176},{"type":"absolute","value":1698912225},{"type":"absolute","value":1698900962},{"type":"absolute","value":1698912230},{"type":"absolute","value":1698900967},{"type":"absolute","value":1698903015},{"type":"absolute","value":1698912235},{"type":"absolute","value":1698900972},{"type":"absolute","value":1698903020},{"type":"absolute","value":1698912240},{"type":"absolute","value":1698900977},{"type":"absolute","value":1698903025},{"type":"absolute","value":1698911220},{"type":"absolute","value":1698900982},{"type":"absolute","value":1698903030},{"type":"absolute","value":1698911225},{"type":"absolute","value":1698900987},{"type":"absolute","value":1698911230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698921616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698930689},{"type":"absolute","value":1698940931},{"type":"absolute","value":1698930694},{"type":"absolute","value":1698940936},{"type":"absolute","value":1698929677},{"type":"absolute","value":1698939919},{"type":"absolute","value":1698929682},{"type":"absolute","value":1698939924},{"type":"absolute","value":1698929687},{"type":"absolute","value":1698931735},{"type":"absolute","value":1698939929},{"type":"absolute","value":1698941977},{"type":"absolute","value":1698929692},{"type":"absolute","value":1698931740},{"type":"absolute","value":1698939934},{"type":"absolute","value":1698941982},{"type":"absolute","value":1698929697},{"type":"absolute","value":1698931745},{"type":"absolute","value":1698939939},{"type":"absolute","value":1698941987},{"type":"absolute","value":1698929702},{"type":"absolute","value":1698931750},{"type":"absolute","value":1698939944},{"type":"absolute","value":1698941992},{"type":"absolute","value":1698922539},{"type":"absolute","value":1698929707},{"type":"absolute","value":1698931755},{"type":"absolute","value":1698939949},{"type":"absolute","value":1698941997},{"type":"absolute","value":1698922544},{"type":"absolute","value":1698929712},{"type":"absolute","value":1698931760},{"type":"absolute","value":1698939954},{"type":"absolute","value":1698942002},{"type":"absolute","value":1698922549},{"type":"absolute","value":1698931765},{"type":"absolute","value":1698942007},{"type":"absolute","value":1698922554},{"type":"absolute","value":1698931770},{"type":"absolute","value":1698942012},{"type":"absolute","value":1698922559},{"type":"absolute","value":1698930753},{"type":"absolute","value":1698940995},{"type":"absolute","value":1698922564},{"type":"absolute","value":1698930758},{"type":"absolute","value":1698941000},{"type":"absolute","value":1698922569},{"type":"absolute","value":1698930763},{"type":"absolute","value":1698932811},{"type":"absolute","value":1698941005},{"type":"absolute","value":1698922574},{"type":"absolute","value":1698930768},{"type":"absolute","value":1698932816},{"type":"absolute","value":1698941010},{"type":"absolute","value":1698930773},{"type":"absolute","value":1698932821},{"type":"absolute","value":1698941015},{"type":"absolute","value":1698930778},{"type":"absolute","value":1698932826},{"type":"absolute","value":1698941020},{"type":"absolute","value":1698930783},{"type":"absolute","value":1698932831},{"type":"absolute","value":1698941025},{"type":"absolute","value":1698923618},{"type":"absolute","value":1698930788},{"type":"absolute","value":1698932836},{"type":"absolute","value":1698941030},{"type":"absolute","value":1698923623},{"type":"absolute","value":1698932841},{"type":"absolute","value":1698923628},{"type":"absolute","value":1698932846},{"type":"absolute","value":1698923633},{"type":"absolute","value":1698931829},{"type":"absolute","value":1698923638},{"type":"absolute","value":1698942071},{"type":"absolute","value":1698931834},{"type":"absolute","value":1698923643},{"type":"absolute","value":1698942076},{"type":"absolute","value":1698931839},{"type":"absolute","value":1698923648},{"type":"absolute","value":1698933887},{"type":"absolute","value":1698942081},{"type":"absolute","value":1698931844},{"type":"absolute","value":1698923653},{"type":"absolute","value":1698933892},{"type":"absolute","value":1698942086},{"type":"absolute","value":1698922633},{"type":"absolute","value":1698931849},{"type":"absolute","value":1698933897},{"type":"absolute","value":1698942091},{"type":"absolute","value":1698922638},{"type":"absolute","value":1698931854},{"type":"absolute","value":1698933902},{"type":"absolute","value":1698942096},{"type":"absolute","value":1698922643},{"type":"absolute","value":1698931859},{"type":"absolute","value":1698933907},{"type":"absolute","value":1698942101},{"type":"absolute","value":1698922648},{"type":"absolute","value":1698924697},{"type":"absolute","value":1698931864},{"type":"absolute","value":1698933912},{"type":"absolute","value":1698942106},{"type":"absolute","value":1698922653},{"type":"absolute","value":1698924702},{"type":"absolute","value":1698933917},{"type":"absolute","value":1698922658},{"type":"absolute","value":1698924707},{"type":"absolute","value":1698933922},{"type":"absolute","value":1698922663},{"type":"absolute","value":1698924712},{"type":"absolute","value":1698932905},{"type":"absolute","value":1698922668},{"type":"absolute","value":1698924717},{"type":"absolute","value":1698932910},{"type":"absolute","value":1698924722},{"type":"absolute","value":1698932915},{"type":"absolute","value":1698934963},{"type":"absolute","value":1698924727},{"type":"absolute","value":1698932920},{"type":"absolute","value":1698934968},{"type":"absolute","value":1698924732},{"type":"absolute","value":1698932925},{"type":"absolute","value":1698934973},{"type":"absolute","value":1698923712},{"type":"absolute","value":1698932930},{"type":"absolute","value":1698934978},{"type":"absolute","value":1698923717},{"type":"absolute","value":1698932935},{"type":"absolute","value":1698934983},{"type":"absolute","value":1698923722},{"type":"absolute","value":1698932940},{"type":"absolute","value":1698934988},{"type":"absolute","value":1698923727},{"type":"absolute","value":1698925776},{"type":"absolute","value":1698934993},{"type":"absolute","value":1698923732},{"type":"absolute","value":1698925781},{"type":"absolute","value":1698934998},{"type":"absolute","value":1698923737},{"type":"absolute","value":1698925786},{"type":"absolute","value":1698933981},{"type":"absolute","value":1698923742},{"type":"absolute","value":1698925791},{"type":"absolute","value":1698933986},{"type":"absolute","value":1698923747},{"type":"absolute","value":1698925796},{"type":"absolute","value":1698933991},{"type":"absolute","value":1698925801},{"type":"absolute","value":1698933996},{"type":"absolute","value":1698925806},{"type":"absolute","value":1698934001},{"type":"absolute","value":1698925811},{"type":"absolute","value":1698934006},{"type":"absolute","value":1698924791},{"type":"absolute","value":1698934011},{"type":"absolute","value":1698924796},{"type":"absolute","value":1698934016},{"type":"absolute","value":1698924801},{"type":"absolute","value":1698924806},{"type":"absolute","value":1698926855},{"type":"absolute","value":1698924811},{"type":"absolute","value":1698926860},{"type":"absolute","value":1698924816},{"type":"absolute","value":1698926865},{"type":"absolute","value":1698935057},{"type":"absolute","value":1698924821},{"type":"absolute","value":1698926870},{"type":"absolute","value":1698935062},{"type":"absolute","value":1698924826},{"type":"absolute","value":1698926875},{"type":"absolute","value":1698935067},{"type":"absolute","value":1698926880},{"type":"absolute","value":1698935072},{"type":"absolute","value":1698926885},{"type":"absolute","value":1698935077},{"type":"absolute","value":1698926890},{"type":"absolute","value":1698935082},{"type":"absolute","value":1698925870},{"type":"absolute","value":1698935087},{"type":"absolute","value":1698925875},{"type":"absolute","value":1698935092},{"type":"absolute","value":1698925880},{"type":"absolute","value":1698925885},{"type":"absolute","value":1698927934},{"type":"absolute","value":1698925890},{"type":"absolute","value":1698927939},{"type":"absolute","value":1698925895},{"type":"absolute","value":1698927944},{"type":"absolute","value":1698925900},{"type":"absolute","value":1698927949},{"type":"absolute","value":1698925905},{"type":"absolute","value":1698927954},{"type":"absolute","value":1698927959},{"type":"absolute","value":1698927964},{"type":"absolute","value":1698927969},{"type":"absolute","value":1698926949},{"type":"absolute","value":1698926954},{"type":"absolute","value":1698926959},{"type":"absolute","value":1698926964},{"type":"absolute","value":1698926969},{"type":"absolute","value":1698926974},{"type":"absolute","value":1698926979},{"type":"absolute","value":1698926984},{"type":"absolute","value":1698928028},{"type":"absolute","value":1698928033},{"type":"absolute","value":1698928038},{"type":"absolute","value":1698928043},{"type":"absolute","value":1698928048},{"type":"absolute","value":1698928053},{"type":"absolute","value":1698928058},{"type":"absolute","value":1698928063},{"type":"absolute","value":1698938873},{"type":"absolute","value":1698938878},{"type":"absolute","value":1698943583},{"type":"absolute","value":1698943588},{"type":"absolute","value":1698943593},{"type":"absolute","value":1698943598},{"type":"absolute","value":1698943603},{"type":"absolute","value":1698943608},{"type":"absolute","value":1698943613},{"type":"absolute","value":1698943618},{"type":"absolute","value":1698944662},{"type":"absolute","value":1698944667},{"type":"absolute","value":1698944672},{"type":"absolute","value":1698944677},{"type":"absolute","value":1698944682},{"type":"absolute","value":1698944687},{"type":"absolute","value":1698944692},{"type":"absolute","value":1698944697},{"type":"absolute","value":1698943677},{"type":"absolute","value":1698943682},{"type":"absolute","value":1698943687},{"type":"absolute","value":1698943692},{"type":"absolute","value":1698945741},{"type":"absolute","value":1698943697},{"type":"absolute","value":1698945746},{"type":"absolute","value":1698943702},{"type":"absolute","value":1698945751},{"type":"absolute","value":1698943707},{"type":"absolute","value":1698945756},{"type":"absolute","value":1698943712},{"type":"absolute","value":1698945761},{"type":"absolute","value":1698945766},{"type":"absolute","value":1698945771},{"type":"absolute","value":1698945776},{"type":"absolute","value":1698944756},{"type":"absolute","value":1698944761},{"type":"absolute","value":1698944766},{"type":"absolute","value":1698944771},{"type":"absolute","value":1698946820},{"type":"absolute","value":1698944776},{"type":"absolute","value":1698946825},{"type":"absolute","value":1698944781},{"type":"absolute","value":1698946830},{"type":"absolute","value":1698944786},{"type":"absolute","value":1698946835},{"type":"absolute","value":1698936597},{"type":"absolute","value":1698944791},{"type":"absolute","value":1698946840},{"type":"absolute","value":1698936602},{"type":"absolute","value":1698946845},{"type":"absolute","value":1698936607},{"type":"absolute","value":1698946850},{"type":"absolute","value":1698936612},{"type":"absolute","value":1698946855},{"type":"absolute","value":1698936617},{"type":"absolute","value":1698945835},{"type":"absolute","value":1698936622},{"type":"absolute","value":1698945840},{"type":"absolute","value":1698936627},{"type":"absolute","value":1698945845},{"type":"absolute","value":1698936632},{"type":"absolute","value":1698945850},{"type":"absolute","value":1698947899},{"type":"absolute","value":1698945855},{"type":"absolute","value":1698947904},{"type":"absolute","value":1698945860},{"type":"absolute","value":1698947909},{"type":"absolute","value":1698937673},{"type":"absolute","value":1698945865},{"type":"absolute","value":1698947914},{"type":"absolute","value":1698937678},{"type":"absolute","value":1698945870},{"type":"absolute","value":1698947919},{"type":"absolute","value":1698937683},{"type":"absolute","value":1698947924},{"type":"absolute","value":1698937688},{"type":"absolute","value":1698947929},{"type":"absolute","value":1698937693},{"type":"absolute","value":1698947934},{"type":"absolute","value":1698937698},{"type":"absolute","value":1698946914},{"type":"absolute","value":1698937703},{"type":"absolute","value":1698946919},{"type":"absolute","value":1698937708},{"type":"absolute","value":1698946924},{"type":"absolute","value":1698946929},{"type":"absolute","value":1698948978},{"type":"absolute","value":1698936691},{"type":"absolute","value":1698946934},{"type":"absolute","value":1698948983},{"type":"absolute","value":1698936696},{"type":"absolute","value":1698946939},{"type":"absolute","value":1698948988},{"type":"absolute","value":1698936701},{"type":"absolute","value":1698938749},{"type":"absolute","value":1698946944},{"type":"absolute","value":1698948993},{"type":"absolute","value":1698936706},{"type":"absolute","value":1698938754},{"type":"absolute","value":1698946949},{"type":"absolute","value":1698948998},{"type":"absolute","value":1698936711},{"type":"absolute","value":1698938759},{"type":"absolute","value":1698949003},{"type":"absolute","value":1698936716},{"type":"absolute","value":1698938764},{"type":"absolute","value":1698949008},{"type":"absolute","value":1698936721},{"type":"absolute","value":1698938769},{"type":"absolute","value":1698949013},{"type":"absolute","value":1698936726},{"type":"absolute","value":1698938774},{"type":"absolute","value":1698947993},{"type":"absolute","value":1698938779},{"type":"absolute","value":1698947998},{"type":"absolute","value":1698938784},{"type":"absolute","value":1698948003},{"type":"absolute","value":1698937767},{"type":"absolute","value":1698948008},{"type":"absolute","value":1698937772},{"type":"absolute","value":1698948013},{"type":"absolute","value":1698929583},{"type":"absolute","value":1698937777},{"type":"absolute","value":1698939825},{"type":"absolute","value":1698948018},{"type":"absolute","value":1698929588},{"type":"absolute","value":1698937782},{"type":"absolute","value":1698939830},{"type":"absolute","value":1698948023},{"type":"absolute","value":1698929593},{"type":"absolute","value":1698937787},{"type":"absolute","value":1698939835},{"type":"absolute","value":1698948028},{"type":"absolute","value":1698929598},{"type":"absolute","value":1698937792},{"type":"absolute","value":1698939840},{"type":"absolute","value":1698929603},{"type":"absolute","value":1698937797},{"type":"absolute","value":1698939845},{"type":"absolute","value":1698929608},{"type":"absolute","value":1698937802},{"type":"absolute","value":1698939850},{"type":"absolute","value":1698929613},{"type":"absolute","value":1698939855},{"type":"absolute","value":1698949072},{"type":"absolute","value":1698929618},{"type":"absolute","value":1698939860},{"type":"absolute","value":1698949077},{"type":"absolute","value":1698949082},{"type":"absolute","value":1698938843},{"type":"absolute","value":1698949087},{"type":"absolute","value":1698938848},{"type":"absolute","value":1698930659},{"type":"absolute","value":1698949092},{"type":"absolute","value":1698938853},{"type":"absolute","value":1698940901},{"type":"absolute","value":1698930664},{"type":"absolute","value":1698949097},{"type":"absolute","value":1698938858},{"type":"absolute","value":1698940906},{"type":"absolute","value":1698930669},{"type":"absolute","value":1698949102},{"type":"absolute","value":1698938863},{"type":"absolute","value":1698940911},{"type":"absolute","value":1698930674},{"type":"absolute","value":1698949107},{"type":"absolute","value":1698938868},{"type":"absolute","value":1698940916},{"type":"absolute","value":1698930679},{"type":"absolute","value":1698940921},{"type":"absolute","value":1698930684},{"type":"absolute","value":1698940926}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"resolve function by parsing PE exports":{"meta":{"name":"resolve function by parsing PE exports","namespace":"load-code/pe","authors":["sara-rn"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["73CE04892E5F39EC82B00C02FC04C70F:0x406BA1"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: resolve function by parsing PE exports\r\n    namespace: load-code/pe\r\n    authors:\r\n      - sara-rn\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\r\n    examples:\r\n      - 73CE04892E5F39EC82B00C02FC04C70F:0x406BA1\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - characteristic: loop\r\n        - mnemonic: movzx\r\n      - and:\r\n        - offset: 0x3C = IMAGE_DOS_HEADER.PE.e_lfanew\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - offset: 0x78 = offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]\r\n          - and:\r\n            - arch: amd64\r\n            - offset: 0x88 = offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]\r\n        - 3 or more:\r\n          - offset: 0x14 = IMAGE_EXPORT_DIRECTORY.NumberOfFunctions\r\n          - offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals\r\n          - offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames\r\n          - offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames\r\n          - offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions\r\n      - optional:\r\n        - or:\r\n          - api: LoadLibrary\r\n          - api: strcmp\r\n","matches":[[{"type":"absolute","value":1698634064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698635778},{"type":"absolute","value":1698637827},{"type":"absolute","value":1698637830},{"type":"absolute","value":1698637833},{"type":"absolute","value":1698636810},{"type":"absolute","value":1698634765},{"type":"absolute","value":1698636813},{"type":"absolute","value":1698637839},{"type":"absolute","value":1698634768},{"type":"absolute","value":1698635792},{"type":"absolute","value":1698635795},{"type":"absolute","value":1698634782},{"type":"absolute","value":1698634785},{"type":"absolute","value":1698637869},{"type":"absolute","value":1698636846},{"type":"absolute","value":1698637872},{"type":"absolute","value":1698636849},{"type":"absolute","value":1698635829},{"type":"absolute","value":1698637878},{"type":"absolute","value":1698635832},{"type":"absolute","value":1698637884},{"type":"absolute","value":1698636863},{"type":"absolute","value":1698634816},{"type":"absolute","value":1698636866},{"type":"absolute","value":1698634819},{"type":"absolute","value":1698635846},{"type":"absolute","value":1698637896},{"type":"absolute","value":1698635849},{"type":"absolute","value":1698637899},{"type":"absolute","value":1698637902},{"type":"absolute","value":1698634833},{"type":"absolute","value":1698634836},{"type":"absolute","value":1698637908},{"type":"absolute","value":1698636895},{"type":"absolute","value":1698636898},{"type":"absolute","value":1698635882},{"type":"absolute","value":1698635885},{"type":"absolute","value":1698636912},{"type":"absolute","value":1698634866},{"type":"absolute","value":1698636915},{"type":"absolute","value":1698634869},{"type":"absolute","value":1698637942},{"type":"absolute","value":1698637945},{"type":"absolute","value":1698635899},{"type":"absolute","value":1698635902},{"type":"absolute","value":1698637951},{"type":"absolute","value":1698634883},{"type":"absolute","value":1698637957},{"type":"absolute","value":1698634886},{"type":"absolute","value":1698637969},{"type":"absolute","value":1698637972},{"type":"absolute","value":1698636950},{"type":"absolute","value":1698637975},{"type":"absolute","value":1698636953},{"type":"absolute","value":1698637981},{"type":"absolute","value":1698634912},{"type":"absolute","value":1698634915},{"type":"absolute","value":1698635942},{"type":"absolute","value":1698636967},{"type":"absolute","value":1698635945},{"type":"absolute","value":1698636970},{"type":"absolute","value":1698635951},{"type":"absolute","value":1698634929},{"type":"absolute","value":1698634932},{"type":"absolute","value":1698635957},{"type":"absolute","value":1698635963},{"type":"absolute","value":1698638013},{"type":"absolute","value":1698635966},{"type":"absolute","value":1698638016},{"type":"absolute","value":1698635969},{"type":"absolute","value":1698638022},{"type":"absolute","value":1698635975},{"type":"absolute","value":1698637004},{"type":"absolute","value":1698638028},{"type":"absolute","value":1698637007},{"type":"absolute","value":1698634964},{"type":"absolute","value":1698634967},{"type":"absolute","value":1698638039},{"type":"absolute","value":1698638042},{"type":"absolute","value":1698637021},{"type":"absolute","value":1698638045},{"type":"absolute","value":1698637024},{"type":"absolute","value":1698638051},{"type":"absolute","value":1698634981},{"type":"absolute","value":1698636005},{"type":"absolute","value":1698634984},{"type":"absolute","value":1698636008},{"type":"absolute","value":1698636014},{"type":"absolute","value":1698636020},{"type":"absolute","value":1698636032},{"type":"absolute","value":1698637057},{"type":"absolute","value":1698636035},{"type":"absolute","value":1698637060},{"type":"absolute","value":1698636038},{"type":"absolute","value":1698635015},{"type":"absolute","value":1698635018},{"type":"absolute","value":1698636044},{"type":"absolute","value":1698637074},{"type":"absolute","value":1698637077},{"type":"absolute","value":1698635032},{"type":"absolute","value":1698635035},{"type":"absolute","value":1698636078},{"type":"absolute","value":1698636081},{"type":"absolute","value":1698637106},{"type":"absolute","value":1698637109},{"type":"absolute","value":1698636087},{"type":"absolute","value":1698635065},{"type":"absolute","value":1698637115},{"type":"absolute","value":1698635068},{"type":"absolute","value":1698636093},{"type":"absolute","value":1698637121},{"type":"absolute","value":1698637127},{"type":"absolute","value":1698636105},{"type":"absolute","value":1698635082},{"type":"absolute","value":1698637130},{"type":"absolute","value":1698636108},{"type":"absolute","value":1698635085},{"type":"absolute","value":1698637133},{"type":"absolute","value":1698636111},{"type":"absolute","value":1698637139},{"type":"absolute","value":1698636117},{"type":"absolute","value":1698635111},{"type":"absolute","value":1698635114},{"type":"absolute","value":1698637169},{"type":"absolute","value":1698637172},{"type":"absolute","value":1698636149},{"type":"absolute","value":1698635128},{"type":"absolute","value":1698636152},{"type":"absolute","value":1698637178},{"type":"absolute","value":1698635131},{"type":"absolute","value":1698636158},{"type":"absolute","value":1698637184},{"type":"absolute","value":1698634116},{"type":"absolute","value":1698636164},{"type":"absolute","value":1698634119},{"type":"absolute","value":1698637196},{"type":"absolute","value":1698636175},{"type":"absolute","value":1698637199},{"type":"absolute","value":1698636178},{"type":"absolute","value":1698637202},{"type":"absolute","value":1698634133},{"type":"absolute","value":1698636181},{"type":"absolute","value":1698634136},{"type":"absolute","value":1698637208},{"type":"absolute","value":1698635163},{"type":"absolute","value":1698636187},{"type":"absolute","value":1698635166},{"type":"absolute","value":1698635180},{"type":"absolute","value":1698635183},{"type":"absolute","value":1698634168},{"type":"absolute","value":1698637242},{"type":"absolute","value":1698634171},{"type":"absolute","value":1698637245},{"type":"absolute","value":1698637251},{"type":"absolute","value":1698634185},{"type":"absolute","value":1698637257},{"type":"absolute","value":1698634188},{"type":"absolute","value":1698635214},{"type":"absolute","value":1698635217},{"type":"absolute","value":1698637269},{"type":"absolute","value":1698637272},{"type":"absolute","value":1698637275},{"type":"absolute","value":1698635231},{"type":"absolute","value":1698637281},{"type":"absolute","value":1698635234},{"type":"absolute","value":1698636262},{"type":"absolute","value":1698636265},{"type":"absolute","value":1698634219},{"type":"absolute","value":1698634222},{"type":"absolute","value":1698636279},{"type":"absolute","value":1698636282},{"type":"absolute","value":1698634236},{"type":"absolute","value":1698634239},{"type":"absolute","value":1698635264},{"type":"absolute","value":1698637313},{"type":"absolute","value":1698635267},{"type":"absolute","value":1698637316},{"type":"absolute","value":1698637322},{"type":"absolute","value":1698637328},{"type":"absolute","value":1698635281},{"type":"absolute","value":1698635284},{"type":"absolute","value":1698637339},{"type":"absolute","value":1698634269},{"type":"absolute","value":1698636317},{"type":"absolute","value":1698637342},{"type":"absolute","value":1698634272},{"type":"absolute","value":1698636320},{"type":"absolute","value":1698637345},{"type":"absolute","value":1698637351},{"type":"absolute","value":1698634286},{"type":"absolute","value":1698635310},{"type":"absolute","value":1698636334},{"type":"absolute","value":1698634289},{"type":"absolute","value":1698635313},{"type":"absolute","value":1698636337},{"type":"absolute","value":1698635327},{"type":"absolute","value":1698635330},{"type":"absolute","value":1698637384},{"type":"absolute","value":1698634315},{"type":"absolute","value":1698637387},{"type":"absolute","value":1698634318},{"type":"absolute","value":1698636371},{"type":"absolute","value":1698636374},{"type":"absolute","value":1698637401},{"type":"absolute","value":1698634332},{"type":"absolute","value":1698637404},{"type":"absolute","value":1698634335},{"type":"absolute","value":1698635362},{"type":"absolute","value":1698636388},{"type":"absolute","value":1698635365},{"type":"absolute","value":1698636391},{"type":"absolute","value":1698635379},{"type":"absolute","value":1698635382},{"type":"absolute","value":1698634367},{"type":"absolute","value":1698637439},{"type":"absolute","value":1698634370},{"type":"absolute","value":1698637442},{"type":"absolute","value":1698636424},{"type":"absolute","value":1698636427},{"type":"absolute","value":1698634384},{"type":"absolute","value":1698637456},{"type":"absolute","value":1698634387},{"type":"absolute","value":1698637459},{"type":"absolute","value":1698635413},{"type":"absolute","value":1698635416},{"type":"absolute","value":1698636441},{"type":"absolute","value":1698636444},{"type":"absolute","value":1698635430},{"type":"absolute","value":1698635433},{"type":"absolute","value":1698634418},{"type":"absolute","value":1698634421},{"type":"absolute","value":1698637493},{"type":"absolute","value":1698637496},{"type":"absolute","value":1698636473},{"type":"absolute","value":1698636476},{"type":"absolute","value":1698634435},{"type":"absolute","value":1698634438},{"type":"absolute","value":1698635463},{"type":"absolute","value":1698637510},{"type":"absolute","value":1698637513},{"type":"absolute","value":1698635466},{"type":"absolute","value":1698636490},{"type":"absolute","value":1698636493},{"type":"absolute","value":1698635480},{"type":"absolute","value":1698635483},{"type":"absolute","value":1698634468},{"type":"absolute","value":1698634471},{"type":"absolute","value":1698637546},{"type":"absolute","value":1698637549},{"type":"absolute","value":1698636528},{"type":"absolute","value":1698636531},{"type":"absolute","value":1698634485},{"type":"absolute","value":1698635509},{"type":"absolute","value":1698635512},{"type":"absolute","value":1698634488},{"type":"absolute","value":1698637563},{"type":"absolute","value":1698637566},{"type":"absolute","value":1698636545},{"type":"absolute","value":1698636548},{"type":"absolute","value":1698635526},{"type":"absolute","value":1698635529},{"type":"absolute","value":1698634514},{"type":"absolute","value":1698634517},{"type":"absolute","value":1698637595},{"type":"absolute","value":1698637598},{"type":"absolute","value":1698634531},{"type":"absolute","value":1698634534},{"type":"absolute","value":1698636582},{"type":"absolute","value":1698636585},{"type":"absolute","value":1698635564},{"type":"absolute","value":1698637612},{"type":"absolute","value":1698635567},{"type":"absolute","value":1698637615},{"type":"absolute","value":1698636599},{"type":"absolute","value":1698636602},{"type":"absolute","value":1698635581},{"type":"absolute","value":1698635584},{"type":"absolute","value":1698634566},{"type":"absolute","value":1698634569},{"type":"absolute","value":1698637650},{"type":"absolute","value":1698637653},{"type":"absolute","value":1698634583},{"type":"absolute","value":1698634586},{"type":"absolute","value":1698636635},{"type":"absolute","value":1698636638},{"type":"absolute","value":1698635618},{"type":"absolute","value":1698637667},{"type":"absolute","value":1698635621},{"type":"absolute","value":1698637670},{"type":"absolute","value":1698636652},{"type":"absolute","value":1698636655},{"type":"absolute","value":1698635635},{"type":"absolute","value":1698635638},{"type":"absolute","value":1698634617},{"type":"absolute","value":1698634620},{"type":"absolute","value":1698637704},{"type":"absolute","value":1698634634},{"type":"absolute","value":1698637707},{"type":"absolute","value":1698636684},{"type":"absolute","value":1698634637},{"type":"absolute","value":1698636687},{"type":"absolute","value":1698635671},{"type":"absolute","value":1698637721},{"type":"absolute","value":1698635674},{"type":"absolute","value":1698637724},{"type":"absolute","value":1698636701},{"type":"absolute","value":1698636704},{"type":"absolute","value":1698635688},{"type":"absolute","value":1698634667},{"type":"absolute","value":1698635691},{"type":"absolute","value":1698634670},{"type":"absolute","value":1698634684},{"type":"absolute","value":1698637757},{"type":"absolute","value":1698634687},{"type":"absolute","value":1698637760},{"type":"absolute","value":1698636739},{"type":"absolute","value":1698636742},{"type":"absolute","value":1698635720},{"type":"absolute","value":1698635723},{"type":"absolute","value":1698637774},{"type":"absolute","value":1698637777},{"type":"absolute","value":1698636756},{"type":"absolute","value":1698636759},{"type":"absolute","value":1698634713},{"type":"absolute","value":1698635737},{"type":"absolute","value":1698634716},{"type":"absolute","value":1698635740},{"type":"absolute","value":1698634730},{"type":"absolute","value":1698634733},{"type":"absolute","value":1698637806},{"type":"absolute","value":1698637809},{"type":"absolute","value":1698637815},{"type":"absolute","value":1698636793},{"type":"absolute","value":1698636796},{"type":"absolute","value":1698637821},{"type":"absolute","value":1698635775}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698634597}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698635444}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698635649}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698634300}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698634499}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698634346},{"type":"absolute","value":1698634086},{"type":"absolute","value":1698636231}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698634081},{"type":"absolute","value":1698634250},{"type":"absolute","value":1698636236}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698634199}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698638088},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698641921},{"type":"absolute","value":1698641924},{"type":"absolute","value":1698638343},{"type":"absolute","value":1698638855},{"type":"absolute","value":1698638346},{"type":"absolute","value":1698638858},{"type":"absolute","value":1698639884},{"type":"absolute","value":1698640906},{"type":"absolute","value":1698640909},{"type":"absolute","value":1698639887},{"type":"absolute","value":1698641938},{"type":"absolute","value":1698641941},{"type":"absolute","value":1698639383},{"type":"absolute","value":1698639386},{"type":"absolute","value":1698639901},{"type":"absolute","value":1698640413},{"type":"absolute","value":1698639904},{"type":"absolute","value":1698640416},{"type":"absolute","value":1698641444},{"type":"absolute","value":1698641447},{"type":"absolute","value":1698638376},{"type":"absolute","value":1698638889},{"type":"absolute","value":1698639400},{"type":"absolute","value":1698638379},{"type":"absolute","value":1698638892},{"type":"absolute","value":1698639403},{"type":"absolute","value":1698640430},{"type":"absolute","value":1698640942},{"type":"absolute","value":1698640433},{"type":"absolute","value":1698640945},{"type":"absolute","value":1698641461},{"type":"absolute","value":1698641975},{"type":"absolute","value":1698641464},{"type":"absolute","value":1698638393},{"type":"absolute","value":1698638906},{"type":"absolute","value":1698641978},{"type":"absolute","value":1698638396},{"type":"absolute","value":1698638909},{"type":"absolute","value":1698639934},{"type":"absolute","value":1698640959},{"type":"absolute","value":1698639937},{"type":"absolute","value":1698640962},{"type":"absolute","value":1698641992},{"type":"absolute","value":1698639435},{"type":"absolute","value":1698641995},{"type":"absolute","value":1698639438},{"type":"absolute","value":1698639951},{"type":"absolute","value":1698639954},{"type":"absolute","value":1698640467},{"type":"absolute","value":1698640470},{"type":"absolute","value":1698638939},{"type":"absolute","value":1698639452},{"type":"absolute","value":1698641499},{"type":"absolute","value":1698638942},{"type":"absolute","value":1698638431},{"type":"absolute","value":1698639455},{"type":"absolute","value":1698640991},{"type":"absolute","value":1698638434},{"type":"absolute","value":1698640994},{"type":"absolute","value":1698640484},{"type":"absolute","value":1698641502},{"type":"absolute","value":1698640487},{"type":"absolute","value":1698638956},{"type":"absolute","value":1698639980},{"type":"absolute","value":1698641516},{"type":"absolute","value":1698638959},{"type":"absolute","value":1698638448},{"type":"absolute","value":1698639983},{"type":"absolute","value":1698641008},{"type":"absolute","value":1698638451},{"type":"absolute","value":1698641011},{"type":"absolute","value":1698639989},{"type":"absolute","value":1698641519},{"type":"absolute","value":1698642031},{"type":"absolute","value":1698642045},{"type":"absolute","value":1698639486},{"type":"absolute","value":1698639998},{"type":"absolute","value":1698642048},{"type":"absolute","value":1698639489},{"type":"absolute","value":1698640007},{"type":"absolute","value":1698640520},{"type":"absolute","value":1698638985},{"type":"absolute","value":1698640010},{"type":"absolute","value":1698640523},{"type":"absolute","value":1698638988},{"type":"absolute","value":1698640013},{"type":"absolute","value":1698639503},{"type":"absolute","value":1698641553},{"type":"absolute","value":1698639506},{"type":"absolute","value":1698641556},{"type":"absolute","value":1698638485},{"type":"absolute","value":1698640022},{"type":"absolute","value":1698641046},{"type":"absolute","value":1698638488},{"type":"absolute","value":1698640537},{"type":"absolute","value":1698639002},{"type":"absolute","value":1698641049},{"type":"absolute","value":1698640540},{"type":"absolute","value":1698639005},{"type":"absolute","value":1698641570},{"type":"absolute","value":1698641573},{"type":"absolute","value":1698638502},{"type":"absolute","value":1698641063},{"type":"absolute","value":1698638505},{"type":"absolute","value":1698641066},{"type":"absolute","value":1698639536},{"type":"absolute","value":1698639539},{"type":"absolute","value":1698640051},{"type":"absolute","value":1698640054},{"type":"absolute","value":1698640569},{"type":"absolute","value":1698640060},{"type":"absolute","value":1698639037},{"type":"absolute","value":1698640572},{"type":"absolute","value":1698639040},{"type":"absolute","value":1698639553},{"type":"absolute","value":1698639556},{"type":"absolute","value":1698640069},{"type":"absolute","value":1698641606},{"type":"absolute","value":1698641609},{"type":"absolute","value":1698638538},{"type":"absolute","value":1698640586},{"type":"absolute","value":1698641100},{"type":"absolute","value":1698638541},{"type":"absolute","value":1698639054},{"type":"absolute","value":1698640589},{"type":"absolute","value":1698641103},{"type":"absolute","value":1698639057},{"type":"absolute","value":1698640084},{"type":"absolute","value":1698640087},{"type":"absolute","value":1698641623},{"type":"absolute","value":1698640090},{"type":"absolute","value":1698638555},{"type":"absolute","value":1698641626},{"type":"absolute","value":1698641117},{"type":"absolute","value":1698638558},{"type":"absolute","value":1698639582},{"type":"absolute","value":1698641120},{"type":"absolute","value":1698639585},{"type":"absolute","value":1698640099},{"type":"absolute","value":1698639599},{"type":"absolute","value":1698639088},{"type":"absolute","value":1698640624},{"type":"absolute","value":1698639602},{"type":"absolute","value":1698639091},{"type":"absolute","value":1698640627},{"type":"absolute","value":1698641655},{"type":"absolute","value":1698641658},{"type":"absolute","value":1698638587},{"type":"absolute","value":1698638590},{"type":"absolute","value":1698639105},{"type":"absolute","value":1698640641},{"type":"absolute","value":1698641153},{"type":"absolute","value":1698639108},{"type":"absolute","value":1698640133},{"type":"absolute","value":1698640644},{"type":"absolute","value":1698641156},{"type":"absolute","value":1698640136},{"type":"absolute","value":1698641672},{"type":"absolute","value":1698641675},{"type":"absolute","value":1698638604},{"type":"absolute","value":1698640142},{"type":"absolute","value":1698638607},{"type":"absolute","value":1698639634},{"type":"absolute","value":1698641170},{"type":"absolute","value":1698639637},{"type":"absolute","value":1698641173},{"type":"absolute","value":1698640151},{"type":"absolute","value":1698639138},{"type":"absolute","value":1698639651},{"type":"absolute","value":1698639141},{"type":"absolute","value":1698639654},{"type":"absolute","value":1698640166},{"type":"absolute","value":1698640678},{"type":"absolute","value":1698640169},{"type":"absolute","value":1698640681},{"type":"absolute","value":1698640172},{"type":"absolute","value":1698641710},{"type":"absolute","value":1698638639},{"type":"absolute","value":1698641713},{"type":"absolute","value":1698638642},{"type":"absolute","value":1698639155},{"type":"absolute","value":1698641202},{"type":"absolute","value":1698640181},{"type":"absolute","value":1698639158},{"type":"absolute","value":1698641205},{"type":"absolute","value":1698640695},{"type":"absolute","value":1698640698},{"type":"absolute","value":1698638841},{"type":"absolute","value":1698641727},{"type":"absolute","value":1698638656},{"type":"absolute","value":1698641730},{"type":"absolute","value":1698638659},{"type":"absolute","value":1698641219},{"type":"absolute","value":1698639685},{"type":"absolute","value":1698641222},{"type":"absolute","value":1698639688},{"type":"absolute","value":1698639184},{"type":"absolute","value":1698639187},{"type":"absolute","value":1698638164},{"type":"absolute","value":1698640213},{"type":"absolute","value":1698639702},{"type":"absolute","value":1698638167},{"type":"absolute","value":1698640216},{"type":"absolute","value":1698639705},{"type":"absolute","value":1698640731},{"type":"absolute","value":1698640222},{"type":"absolute","value":1698640734},{"type":"absolute","value":1698639201},{"type":"absolute","value":1698638690},{"type":"absolute","value":1698640375},{"type":"absolute","value":1698639204},{"type":"absolute","value":1698638181},{"type":"absolute","value":1698638693},{"type":"absolute","value":1698640231},{"type":"absolute","value":1698638184},{"type":"absolute","value":1698641257},{"type":"absolute","value":1698641764},{"type":"absolute","value":1698641767},{"type":"absolute","value":1698640748},{"type":"absolute","value":1698641260},{"type":"absolute","value":1698640751},{"type":"absolute","value":1698640378},{"type":"absolute","value":1698638707},{"type":"absolute","value":1698640245},{"type":"absolute","value":1698638710},{"type":"absolute","value":1698639735},{"type":"absolute","value":1698640248},{"type":"absolute","value":1698641781},{"type":"absolute","value":1698639738},{"type":"absolute","value":1698640251},{"type":"absolute","value":1698641274},{"type":"absolute","value":1698641277},{"type":"absolute","value":1698640889},{"type":"absolute","value":1698641784},{"type":"absolute","value":1698639236},{"type":"absolute","value":1698640260},{"type":"absolute","value":1698639239},{"type":"absolute","value":1698639752},{"type":"absolute","value":1698638219},{"type":"absolute","value":1698639755},{"type":"absolute","value":1698640780},{"type":"absolute","value":1698638222},{"type":"absolute","value":1698640783},{"type":"absolute","value":1698638740},{"type":"absolute","value":1698639253},{"type":"absolute","value":1698638743},{"type":"absolute","value":1698639256},{"type":"absolute","value":1698641817},{"type":"absolute","value":1698638236},{"type":"absolute","value":1698640797},{"type":"absolute","value":1698641820},{"type":"absolute","value":1698638239},{"type":"absolute","value":1698641311},{"type":"absolute","value":1698640800},{"type":"absolute","value":1698641314},{"type":"absolute","value":1698638757},{"type":"absolute","value":1698639781},{"type":"absolute","value":1698638760},{"type":"absolute","value":1698639784},{"type":"absolute","value":1698641834},{"type":"absolute","value":1698641837},{"type":"absolute","value":1698641328},{"type":"absolute","value":1698641331},{"type":"absolute","value":1698639798},{"type":"absolute","value":1698639287},{"type":"absolute","value":1698639801},{"type":"absolute","value":1698639290},{"type":"absolute","value":1698638273},{"type":"absolute","value":1698638786},{"type":"absolute","value":1698640835},{"type":"absolute","value":1698638276},{"type":"absolute","value":1698638789},{"type":"absolute","value":1698640838},{"type":"absolute","value":1698639304},{"type":"absolute","value":1698641866},{"type":"absolute","value":1698639307},{"type":"absolute","value":1698641869},{"type":"absolute","value":1698638290},{"type":"absolute","value":1698638803},{"type":"absolute","value":1698640852},{"type":"absolute","value":1698638293},{"type":"absolute","value":1698638806},{"type":"absolute","value":1698641364},{"type":"absolute","value":1698640855},{"type":"absolute","value":1698639833},{"type":"absolute","value":1698641367},{"type":"absolute","value":1698641883},{"type":"absolute","value":1698639836},{"type":"absolute","value":1698641886},{"type":"absolute","value":1698642028},{"type":"absolute","value":1698641381},{"type":"absolute","value":1698640358},{"type":"absolute","value":1698641384},{"type":"absolute","value":1698639337},{"type":"absolute","value":1698639850},{"type":"absolute","value":1698640361},{"type":"absolute","value":1698639340},{"type":"absolute","value":1698639853},{"type":"absolute","value":1698638326},{"type":"absolute","value":1698638838},{"type":"absolute","value":1698638329},{"type":"absolute","value":1698639354},{"type":"absolute","value":1698640892},{"type":"absolute","value":1698639357}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698639567}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698638721}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698638516}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698639864}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698639665}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698639613},{"type":"absolute","value":1698638110},{"type":"absolute","value":1698640303}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698638105},{"type":"absolute","value":1698639915},{"type":"absolute","value":1698640308}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698639965}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698659472},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698659472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698663425},{"type":"absolute","value":1698662402},{"type":"absolute","value":1698663433},{"type":"absolute","value":1698662413},{"type":"absolute","value":1698663437},{"type":"absolute","value":1698663441},{"type":"absolute","value":1698663450},{"type":"absolute","value":1698662427},{"type":"absolute","value":1698662431},{"type":"absolute","value":1698663458},{"type":"absolute","value":1698663462},{"type":"absolute","value":1698662439},{"type":"absolute","value":1698663466},{"type":"absolute","value":1698662443},{"type":"absolute","value":1698663475},{"type":"absolute","value":1698662452},{"type":"absolute","value":1698662456},{"type":"absolute","value":1698663483},{"type":"absolute","value":1698663487},{"type":"absolute","value":1698661440},{"type":"absolute","value":1698661444},{"type":"absolute","value":1698661449},{"type":"absolute","value":1698662473},{"type":"absolute","value":1698661453},{"type":"absolute","value":1698663503},{"type":"absolute","value":1698662484},{"type":"absolute","value":1698663512},{"type":"absolute","value":1698662491},{"type":"absolute","value":1698661468},{"type":"absolute","value":1698663516},{"type":"absolute","value":1698660448},{"type":"absolute","value":1698661472},{"type":"absolute","value":1698660452},{"type":"absolute","value":1698663524},{"type":"absolute","value":1698663528},{"type":"absolute","value":1698660461},{"type":"absolute","value":1698661485},{"type":"absolute","value":1698663536},{"type":"absolute","value":1698660478},{"type":"absolute","value":1698663552},{"type":"absolute","value":1698660482},{"type":"absolute","value":1698663556},{"type":"absolute","value":1698660486},{"type":"absolute","value":1698661512},{"type":"absolute","value":1698660493},{"type":"absolute","value":1698661517},{"type":"absolute","value":1698663565},{"type":"absolute","value":1698663569},{"type":"absolute","value":1698661522},{"type":"absolute","value":1698660503},{"type":"absolute","value":1698663577},{"type":"absolute","value":1698663581},{"type":"absolute","value":1698660516},{"type":"absolute","value":1698663589},{"type":"absolute","value":1698660520},{"type":"absolute","value":1698660524},{"type":"absolute","value":1698660531},{"type":"absolute","value":1698662585},{"type":"absolute","value":1698662590},{"type":"absolute","value":1698661571},{"type":"absolute","value":1698660548},{"type":"absolute","value":1698660556},{"type":"absolute","value":1698661580},{"type":"absolute","value":1698662609},{"type":"absolute","value":1698662613},{"type":"absolute","value":1698662617},{"type":"absolute","value":1698662621},{"type":"absolute","value":1698660575},{"type":"absolute","value":1698662625},{"type":"absolute","value":1698659556},{"type":"absolute","value":1698659559},{"type":"absolute","value":1698660583},{"type":"absolute","value":1698662634},{"type":"absolute","value":1698662638},{"type":"absolute","value":1698659571},{"type":"absolute","value":1698661619},{"type":"absolute","value":1698659575},{"type":"absolute","value":1698662647},{"type":"absolute","value":1698661628},{"type":"absolute","value":1698662656},{"type":"absolute","value":1698662660},{"type":"absolute","value":1698662664},{"type":"absolute","value":1698659597},{"type":"absolute","value":1698659601},{"type":"absolute","value":1698662673},{"type":"absolute","value":1698662681},{"type":"absolute","value":1698662685},{"type":"absolute","value":1698659614},{"type":"absolute","value":1698662689},{"type":"absolute","value":1698661667},{"type":"absolute","value":1698661676},{"type":"absolute","value":1698662702},{"type":"absolute","value":1698662707},{"type":"absolute","value":1698660662},{"type":"absolute","value":1698659641},{"type":"absolute","value":1698660667},{"type":"absolute","value":1698659646},{"type":"absolute","value":1698659651},{"type":"absolute","value":1698662723},{"type":"absolute","value":1698662727},{"type":"absolute","value":1698660684},{"type":"absolute","value":1698660688},{"type":"absolute","value":1698662736},{"type":"absolute","value":1698661715},{"type":"absolute","value":1698660692},{"type":"absolute","value":1698662740},{"type":"absolute","value":1698660696},{"type":"absolute","value":1698662745},{"type":"absolute","value":1698660700},{"type":"absolute","value":1698661724},{"type":"absolute","value":1698660708},{"type":"absolute","value":1698662758},{"type":"absolute","value":1698660712},{"type":"absolute","value":1698662762},{"type":"absolute","value":1698660717},{"type":"absolute","value":1698662766},{"type":"absolute","value":1698659700},{"type":"absolute","value":1698662775},{"type":"absolute","value":1698660729},{"type":"absolute","value":1698659709},{"type":"absolute","value":1698660738},{"type":"absolute","value":1698661763},{"type":"absolute","value":1698662787},{"type":"absolute","value":1698660746},{"type":"absolute","value":1698661772},{"type":"absolute","value":1698662796},{"type":"absolute","value":1698660758},{"type":"absolute","value":1698662808},{"type":"absolute","value":1698662813},{"type":"absolute","value":1698660770},{"type":"absolute","value":1698659748},{"type":"absolute","value":1698662823},{"type":"absolute","value":1698659757},{"type":"absolute","value":1698660782},{"type":"absolute","value":1698662831},{"type":"absolute","value":1698661811},{"type":"absolute","value":1698662835},{"type":"absolute","value":1698660796},{"type":"absolute","value":1698662844},{"type":"absolute","value":1698660800},{"type":"absolute","value":1698662848},{"type":"absolute","value":1698660808},{"type":"absolute","value":1698662856},{"type":"absolute","value":1698660812},{"type":"absolute","value":1698662860},{"type":"absolute","value":1698662864},{"type":"absolute","value":1698661843},{"type":"absolute","value":1698659796},{"type":"absolute","value":1698660821},{"type":"absolute","value":1698661847},{"type":"absolute","value":1698660825},{"type":"absolute","value":1698662873},{"type":"absolute","value":1698659805},{"type":"absolute","value":1698660833},{"type":"absolute","value":1698662881},{"type":"absolute","value":1698661860},{"type":"absolute","value":1698660837},{"type":"absolute","value":1698662885},{"type":"absolute","value":1698661864},{"type":"absolute","value":1698662889},{"type":"absolute","value":1698661868},{"type":"absolute","value":1698661873},{"type":"absolute","value":1698662898},{"type":"absolute","value":1698660853},{"type":"absolute","value":1698662906},{"type":"absolute","value":1698661885},{"type":"absolute","value":1698662910},{"type":"absolute","value":1698660862},{"type":"absolute","value":1698659844},{"type":"absolute","value":1698660874},{"type":"absolute","value":1698659853},{"type":"absolute","value":1698662926},{"type":"absolute","value":1698660883},{"type":"absolute","value":1698662935},{"type":"absolute","value":1698662939},{"type":"absolute","value":1698661916},{"type":"absolute","value":1698661920},{"type":"absolute","value":1698662947},{"type":"absolute","value":1698661925},{"type":"absolute","value":1698662951},{"type":"absolute","value":1698662959},{"type":"absolute","value":1698659892},{"type":"absolute","value":1698659901},{"type":"absolute","value":1698662975},{"type":"absolute","value":1698660931},{"type":"absolute","value":1698662979},{"type":"absolute","value":1698660936},{"type":"absolute","value":1698662988},{"type":"absolute","value":1698662992},{"type":"absolute","value":1698660945},{"type":"absolute","value":1698660951},{"type":"absolute","value":1698663000},{"type":"absolute","value":1698663004},{"type":"absolute","value":1698661981},{"type":"absolute","value":1698663012},{"type":"absolute","value":1698661989},{"type":"absolute","value":1698659966},{"type":"absolute","value":1698659971},{"type":"absolute","value":1698659975},{"type":"absolute","value":1698662026},{"type":"absolute","value":1698659980},{"type":"absolute","value":1698661008},{"type":"absolute","value":1698662034},{"type":"absolute","value":1698663060},{"type":"absolute","value":1698661013},{"type":"absolute","value":1698663065},{"type":"absolute","value":1698659998},{"type":"absolute","value":1698661022},{"type":"absolute","value":1698663074},{"type":"absolute","value":1698661028},{"type":"absolute","value":1698660007},{"type":"absolute","value":1698663080},{"type":"absolute","value":1698661034},{"type":"absolute","value":1698660011},{"type":"absolute","value":1698661039},{"type":"absolute","value":1698662071},{"type":"absolute","value":1698662079},{"type":"absolute","value":1698661056},{"type":"absolute","value":1698661060},{"type":"absolute","value":1698660038},{"type":"absolute","value":1698661064},{"type":"absolute","value":1698660043},{"type":"absolute","value":1698661068},{"type":"absolute","value":1698660048},{"type":"absolute","value":1698661072},{"type":"absolute","value":1698661080},{"type":"absolute","value":1698661084},{"type":"absolute","value":1698663136},{"type":"absolute","value":1698661089},{"type":"absolute","value":1698662116},{"type":"absolute","value":1698663141},{"type":"absolute","value":1698662124},{"type":"absolute","value":1698661101},{"type":"absolute","value":1698663150},{"type":"absolute","value":1698663156},{"type":"absolute","value":1698661110},{"type":"absolute","value":1698663162},{"type":"absolute","value":1698661118},{"type":"absolute","value":1698663167},{"type":"absolute","value":1698660097},{"type":"absolute","value":1698660106},{"type":"absolute","value":1698661130},{"type":"absolute","value":1698663186},{"type":"absolute","value":1698661142},{"type":"absolute","value":1698663190},{"type":"absolute","value":1698663194},{"type":"absolute","value":1698662171},{"type":"absolute","value":1698663198},{"type":"absolute","value":1698662175},{"type":"absolute","value":1698661154},{"type":"absolute","value":1698663202},{"type":"absolute","value":1698663211},{"type":"absolute","value":1698663215},{"type":"absolute","value":1698661168},{"type":"absolute","value":1698660145},{"type":"absolute","value":1698661172},{"type":"absolute","value":1698663224},{"type":"absolute","value":1698660154},{"type":"absolute","value":1698661180},{"type":"absolute","value":1698661184},{"type":"absolute","value":1698663233},{"type":"absolute","value":1698663237},{"type":"absolute","value":1698661193},{"type":"absolute","value":1698663241},{"type":"absolute","value":1698661197},{"type":"absolute","value":1698663250},{"type":"absolute","value":1698661205},{"type":"absolute","value":1698661209},{"type":"absolute","value":1698663258},{"type":"absolute","value":1698663262},{"type":"absolute","value":1698660193},{"type":"absolute","value":1698663266},{"type":"absolute","value":1698661225},{"type":"absolute","value":1698660202},{"type":"absolute","value":1698663279},{"type":"absolute","value":1698662257},{"type":"absolute","value":1698661234},{"type":"absolute","value":1698663284},{"type":"absolute","value":1698662262},{"type":"absolute","value":1698661246},{"type":"absolute","value":1698662270},{"type":"absolute","value":1698663300},{"type":"absolute","value":1698661255},{"type":"absolute","value":1698663304},{"type":"absolute","value":1698662287},{"type":"absolute","value":1698660241},{"type":"absolute","value":1698662290},{"type":"absolute","value":1698663313},{"type":"absolute","value":1698663317},{"type":"absolute","value":1698662294},{"type":"absolute","value":1698660250},{"type":"absolute","value":1698663322},{"type":"absolute","value":1698662301},{"type":"absolute","value":1698662305},{"type":"absolute","value":1698663335},{"type":"absolute","value":1698662314},{"type":"absolute","value":1698663339},{"type":"absolute","value":1698662318},{"type":"absolute","value":1698663343},{"type":"absolute","value":1698662325},{"type":"absolute","value":1698663352},{"type":"absolute","value":1698662329},{"type":"absolute","value":1698663364},{"type":"absolute","value":1698660293},{"type":"absolute","value":1698662341},{"type":"absolute","value":1698660298},{"type":"absolute","value":1698663373},{"type":"absolute","value":1698662354},{"type":"absolute","value":1698662357},{"type":"absolute","value":1698660310},{"type":"absolute","value":1698663385},{"type":"absolute","value":1698662365},{"type":"absolute","value":1698663390},{"type":"absolute","value":1698662369},{"type":"absolute","value":1698663400},{"type":"absolute","value":1698662378},{"type":"absolute","value":1698662382},{"type":"absolute","value":1698663408},{"type":"absolute","value":1698663412},{"type":"absolute","value":1698662389},{"type":"absolute","value":1698662393},{"type":"absolute","value":1698663421}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698660218},{"type":"absolute","value":1698661692},{"type":"absolute","value":1698659821},{"type":"absolute","value":1698662094}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698660416},{"type":"absolute","value":1698660611},{"type":"absolute","value":1698662534},{"type":"absolute","value":1698662247}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698662840},{"type":"absolute","value":1698663417},{"type":"absolute","value":1698661619}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698659507},{"type":"absolute","value":1698661309}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698662585},{"type":"absolute","value":1698663162},{"type":"absolute","value":1698661843}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698662808},{"type":"absolute","value":1698663385},{"type":"absolute","value":1698662026}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698714000},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698714000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698714693},{"type":"absolute","value":1698714087}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698715395}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698715607}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698714396}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698714633}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698714594}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698714427}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698714418}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698811216},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698812165},{"type":"absolute","value":1698812298},{"type":"absolute","value":1698812171},{"type":"absolute","value":1698811916},{"type":"absolute","value":1698811985},{"type":"absolute","value":1698812241},{"type":"absolute","value":1698812115},{"type":"absolute","value":1698811862},{"type":"absolute","value":1698811927},{"type":"absolute","value":1698812313},{"type":"absolute","value":1698812063},{"type":"absolute","value":1698812191},{"type":"absolute","value":1698811999},{"type":"absolute","value":1698812257},{"type":"absolute","value":1698812323},{"type":"absolute","value":1698811940},{"type":"absolute","value":1698812070},{"type":"absolute","value":1698812141},{"type":"absolute","value":1698812015},{"type":"absolute","value":1698812144},{"type":"absolute","value":1698811830},{"type":"absolute","value":1698811898},{"type":"absolute","value":1698812283},{"type":"absolute","value":1698812029}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698813161},{"type":"absolute","value":1698812811},{"type":"absolute","value":1698813198}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698813238},{"type":"absolute","value":1698813421},{"type":"absolute","value":1698811454}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698813329},{"type":"absolute","value":1698813396},{"type":"absolute","value":1698811645}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698812770},{"type":"absolute","value":1698812964},{"type":"absolute","value":1698812903},{"type":"absolute","value":1698813337},{"type":"absolute","value":1698813614}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698813033},{"type":"absolute","value":1698812467},{"type":"absolute","value":1698813180},{"type":"absolute","value":1698813015}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698813041},{"type":"absolute","value":1698813094},{"type":"absolute","value":1698813038},{"type":"absolute","value":1698812375}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698812792},{"type":"absolute","value":1698812889},{"type":"absolute","value":1698813619},{"type":"absolute","value":1698812988}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698813506},{"type":"absolute","value":1698813021},{"type":"absolute","value":1698811677},{"type":"absolute","value":1698812871}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698813712},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698815234},{"type":"absolute","value":1698815245},{"type":"absolute","value":1698814618},{"type":"absolute","value":1698815388},{"type":"absolute","value":1698814753},{"type":"absolute","value":1698814883},{"type":"absolute","value":1698815018},{"type":"absolute","value":1698815406},{"type":"absolute","value":1698814641},{"type":"absolute","value":1698815158},{"type":"absolute","value":1698814777},{"type":"absolute","value":1698814651},{"type":"absolute","value":1698814917},{"type":"absolute","value":1698814791},{"type":"absolute","value":1698814920},{"type":"absolute","value":1698815047},{"type":"absolute","value":1698814668},{"type":"absolute","value":1698815053},{"type":"absolute","value":1698814799},{"type":"absolute","value":1698814928},{"type":"absolute","value":1698815312},{"type":"absolute","value":1698815187},{"type":"absolute","value":1698814679},{"type":"absolute","value":1698815193},{"type":"absolute","value":1698815067},{"type":"absolute","value":1698814689},{"type":"absolute","value":1698815329},{"type":"absolute","value":1698814820},{"type":"absolute","value":1698815207},{"type":"absolute","value":1698814830},{"type":"absolute","value":1698814962},{"type":"absolute","value":1698815092},{"type":"absolute","value":1698815350},{"type":"absolute","value":1698814968},{"type":"absolute","value":1698815098},{"type":"absolute","value":1698815358}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698815504},{"type":"absolute","value":1698816250},{"type":"absolute","value":1698816371},{"type":"absolute","value":1698816423}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698816649},{"type":"absolute","value":1698816478},{"type":"absolute","value":1698813830}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698816642},{"type":"absolute","value":1698816754},{"type":"absolute","value":1698814039}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698817196},{"type":"absolute","value":1698815927},{"type":"absolute","value":1698813738},{"type":"absolute","value":1698816091},{"type":"absolute","value":1698816314},{"type":"absolute","value":1698816890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698816297},{"type":"absolute","value":1698816203},{"type":"absolute","value":1698814276},{"type":"absolute","value":1698816293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698813944},{"type":"absolute","value":1698816288},{"type":"absolute","value":1698816614},{"type":"absolute","value":1698815943}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698817200},{"type":"absolute","value":1698816055},{"type":"absolute","value":1698813741},{"type":"absolute","value":1698815948},{"type":"absolute","value":1698816221}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698816245},{"type":"absolute","value":1698814343},{"type":"absolute","value":1698813752},{"type":"absolute","value":1698816411},{"type":"absolute","value":1698815918},{"type":"absolute","value":1698816254}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698817344},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698819076},{"type":"absolute","value":1698819333},{"type":"absolute","value":1698818314},{"type":"absolute","value":1698818570},{"type":"absolute","value":1698817804},{"type":"absolute","value":1698818829},{"type":"absolute","value":1698817551},{"type":"absolute","value":1698819088},{"type":"absolute","value":1698818321},{"type":"absolute","value":1698818578},{"type":"absolute","value":1698818325},{"type":"absolute","value":1698817559},{"type":"absolute","value":1698819355},{"type":"absolute","value":1698818850},{"type":"absolute","value":1698819110},{"type":"absolute","value":1698818091},{"type":"absolute","value":1698818347},{"type":"absolute","value":1698818610},{"type":"absolute","value":1698817591},{"type":"absolute","value":1698817850},{"type":"absolute","value":1698818107},{"type":"absolute","value":1698818874},{"type":"absolute","value":1698819389},{"type":"absolute","value":1698818368},{"type":"absolute","value":1698817857},{"type":"absolute","value":1698817860},{"type":"absolute","value":1698819396},{"type":"absolute","value":1698819400},{"type":"absolute","value":1698818124},{"type":"absolute","value":1698819151},{"type":"absolute","value":1698817619},{"type":"absolute","value":1698818131},{"type":"absolute","value":1698818644},{"type":"absolute","value":1698818390},{"type":"absolute","value":1698819158},{"type":"absolute","value":1698817881},{"type":"absolute","value":1698819162},{"type":"absolute","value":1698817628},{"type":"absolute","value":1698818653},{"type":"absolute","value":1698819422},{"type":"absolute","value":1698817631},{"type":"absolute","value":1698818657},{"type":"absolute","value":1698818922},{"type":"absolute","value":1698817901},{"type":"absolute","value":1698818158},{"type":"absolute","value":1698819184},{"type":"absolute","value":1698817393},{"type":"absolute","value":1698817652},{"type":"absolute","value":1698818165},{"type":"absolute","value":1698818676},{"type":"absolute","value":1698818932},{"type":"absolute","value":1698818936},{"type":"absolute","value":1698818684},{"type":"absolute","value":1698818430},{"type":"absolute","value":1698817921},{"type":"absolute","value":1698817411},{"type":"absolute","value":1698819205},{"type":"absolute","value":1698819461},{"type":"absolute","value":1698817673},{"type":"absolute","value":1698818443},{"type":"absolute","value":1698819469},{"type":"absolute","value":1698818958},{"type":"absolute","value":1698818451},{"type":"absolute","value":1698817429},{"type":"absolute","value":1698817432},{"type":"absolute","value":1698817691},{"type":"absolute","value":1698817947},{"type":"absolute","value":1698818716},{"type":"absolute","value":1698819227},{"type":"absolute","value":1698817954},{"type":"absolute","value":1698818211},{"type":"absolute","value":1698818979},{"type":"absolute","value":1698818471},{"type":"absolute","value":1698818218},{"type":"absolute","value":1698817453},{"type":"absolute","value":1698817967},{"type":"absolute","value":1698818479},{"type":"absolute","value":1698818232},{"type":"absolute","value":1698819001},{"type":"absolute","value":1698817981},{"type":"absolute","value":1698817475},{"type":"absolute","value":1698817731},{"type":"absolute","value":1698818246},{"type":"absolute","value":1698817738},{"type":"absolute","value":1698818511},{"type":"absolute","value":1698819280},{"type":"absolute","value":1698818002},{"type":"absolute","value":1698818258},{"type":"absolute","value":1698817751},{"type":"absolute","value":1698819287},{"type":"absolute","value":1698819291},{"type":"absolute","value":1698818781},{"type":"absolute","value":1698819038},{"type":"absolute","value":1698819042},{"type":"absolute","value":1698818020},{"type":"absolute","value":1698817765},{"type":"absolute","value":1698818790},{"type":"absolute","value":1698818538},{"type":"absolute","value":1698817516},{"type":"absolute","value":1698818286},{"type":"absolute","value":1698819313},{"type":"absolute","value":1698818547},{"type":"absolute","value":1698818804},{"type":"absolute","value":1698817526},{"type":"absolute","value":1698818551},{"type":"absolute","value":1698819064},{"type":"absolute","value":1698817786},{"type":"absolute","value":1698817531}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698818039}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698818731}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698818896}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698817511}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698817706}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698817713}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698817471}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698817609}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698819552},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698820610},{"type":"absolute","value":1698821122},{"type":"absolute","value":1698819846},{"type":"absolute","value":1698820102},{"type":"absolute","value":1698821384},{"type":"absolute","value":1698820105},{"type":"absolute","value":1698820873},{"type":"absolute","value":1698821643},{"type":"absolute","value":1698819855},{"type":"absolute","value":1698820367},{"type":"absolute","value":1698821391},{"type":"absolute","value":1698819858},{"type":"absolute","value":1698821395},{"type":"absolute","value":1698819604},{"type":"absolute","value":1698820631},{"type":"absolute","value":1698820126},{"type":"absolute","value":1698820384},{"type":"absolute","value":1698819879},{"type":"absolute","value":1698820391},{"type":"absolute","value":1698821417},{"type":"absolute","value":1698819626},{"type":"absolute","value":1698820907},{"type":"absolute","value":1698821164},{"type":"absolute","value":1698820653},{"type":"absolute","value":1698820146},{"type":"absolute","value":1698821682},{"type":"absolute","value":1698820916},{"type":"absolute","value":1698821174},{"type":"absolute","value":1698820920},{"type":"absolute","value":1698821178},{"type":"absolute","value":1698821690},{"type":"absolute","value":1698819644},{"type":"absolute","value":1698819900},{"type":"absolute","value":1698821438},{"type":"absolute","value":1698819647},{"type":"absolute","value":1698820418},{"type":"absolute","value":1698820166},{"type":"absolute","value":1698820425},{"type":"absolute","value":1698820939},{"type":"absolute","value":1698819918},{"type":"absolute","value":1698821200},{"type":"absolute","value":1698820947},{"type":"absolute","value":1698819668},{"type":"absolute","value":1698820693},{"type":"absolute","value":1698821460},{"type":"absolute","value":1698820192},{"type":"absolute","value":1698820706},{"type":"absolute","value":1698821221},{"type":"absolute","value":1698820199},{"type":"absolute","value":1698820714},{"type":"absolute","value":1698819693},{"type":"absolute","value":1698820979},{"type":"absolute","value":1698820212},{"type":"absolute","value":1698820474},{"type":"absolute","value":1698821243},{"type":"absolute","value":1698819964},{"type":"absolute","value":1698821501},{"type":"absolute","value":1698820734},{"type":"absolute","value":1698820481},{"type":"absolute","value":1698820226},{"type":"absolute","value":1698819971},{"type":"absolute","value":1698820351},{"type":"absolute","value":1698821508},{"type":"absolute","value":1698820742},{"type":"absolute","value":1698821512},{"type":"absolute","value":1698820495},{"type":"absolute","value":1698819984},{"type":"absolute","value":1698820247},{"type":"absolute","value":1698819740},{"type":"absolute","value":1698820509},{"type":"absolute","value":1698819998},{"type":"absolute","value":1698821277},{"type":"absolute","value":1698821534},{"type":"absolute","value":1698821281},{"type":"absolute","value":1698819750},{"type":"absolute","value":1698820774},{"type":"absolute","value":1698820265},{"type":"absolute","value":1698820521},{"type":"absolute","value":1698819755},{"type":"absolute","value":1698821035},{"type":"absolute","value":1698821554},{"type":"absolute","value":1698820019},{"type":"absolute","value":1698821044},{"type":"absolute","value":1698821303},{"type":"absolute","value":1698819775},{"type":"absolute","value":1698820801},{"type":"absolute","value":1698821058},{"type":"absolute","value":1698821315},{"type":"absolute","value":1698820037},{"type":"absolute","value":1698820549},{"type":"absolute","value":1698819783},{"type":"absolute","value":1698821576},{"type":"absolute","value":1698820810},{"type":"absolute","value":1698820814},{"type":"absolute","value":1698821327},{"type":"absolute","value":1698821080},{"type":"absolute","value":1698820577},{"type":"absolute","value":1698820833},{"type":"absolute","value":1698821349},{"type":"absolute","value":1698819815},{"type":"absolute","value":1698820584},{"type":"absolute","value":1698820841},{"type":"absolute","value":1698821610},{"type":"absolute","value":1698820588},{"type":"absolute","value":1698821101},{"type":"absolute","value":1698821617},{"type":"absolute","value":1698821621},{"type":"absolute","value":1698820095}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698821073}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698820432}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698820302}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698821706}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698821478}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698821475}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698821494}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698821491}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698821760},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698822147},{"type":"absolute","value":1698822662},{"type":"absolute","value":1698822154},{"type":"absolute","value":1698824205},{"type":"absolute","value":1698823696},{"type":"absolute","value":1698824209},{"type":"absolute","value":1698822674},{"type":"absolute","value":1698822167},{"type":"absolute","value":1698823703},{"type":"absolute","value":1698823707},{"type":"absolute","value":1698823197},{"type":"absolute","value":1698822181},{"type":"absolute","value":1698823206},{"type":"absolute","value":1698824231},{"type":"absolute","value":1698822702},{"type":"absolute","value":1698823729},{"type":"absolute","value":1698824243},{"type":"absolute","value":1698823220},{"type":"absolute","value":1698822202},{"type":"absolute","value":1698824255},{"type":"absolute","value":1698823749},{"type":"absolute","value":1698822220},{"type":"absolute","value":1698822733},{"type":"absolute","value":1698823245},{"type":"absolute","value":1698822737},{"type":"absolute","value":1698824277},{"type":"absolute","value":1698823771},{"type":"absolute","value":1698823266},{"type":"absolute","value":1698822759},{"type":"absolute","value":1698822771},{"type":"absolute","value":1698823799},{"type":"absolute","value":1698822266},{"type":"absolute","value":1698823290},{"type":"absolute","value":1698823806},{"type":"absolute","value":1698822784},{"type":"absolute","value":1698822273},{"type":"absolute","value":1698823810},{"type":"absolute","value":1698822276},{"type":"absolute","value":1698824330},{"type":"absolute","value":1698824337},{"type":"absolute","value":1698824341},{"type":"absolute","value":1698822806},{"type":"absolute","value":1698823832},{"type":"absolute","value":1698822297},{"type":"absolute","value":1698823338},{"type":"absolute","value":1698824363},{"type":"absolute","value":1698822317},{"type":"absolute","value":1698823853},{"type":"absolute","value":1698821809},{"type":"absolute","value":1698823348},{"type":"absolute","value":1698823352},{"type":"absolute","value":1698824384},{"type":"absolute","value":1698822337},{"type":"absolute","value":1698821827},{"type":"absolute","value":1698823875},{"type":"absolute","value":1698822855},{"type":"absolute","value":1698822861},{"type":"absolute","value":1698823374},{"type":"absolute","value":1698822867},{"type":"absolute","value":1698821845},{"type":"absolute","value":1698824406},{"type":"absolute","value":1698821848},{"type":"absolute","value":1698822363},{"type":"absolute","value":1698822370},{"type":"absolute","value":1698823395},{"type":"absolute","value":1698822887},{"type":"absolute","value":1698821869},{"type":"absolute","value":1698822383},{"type":"absolute","value":1698822895},{"type":"absolute","value":1698824434},{"type":"absolute","value":1698824441},{"type":"absolute","value":1698823417},{"type":"absolute","value":1698824445},{"type":"absolute","value":1698822397},{"type":"absolute","value":1698823938},{"type":"absolute","value":1698821891},{"type":"absolute","value":1698823942},{"type":"absolute","value":1698822927},{"type":"absolute","value":1698822418},{"type":"absolute","value":1698824467},{"type":"absolute","value":1698823962},{"type":"absolute","value":1698823454},{"type":"absolute","value":1698823458},{"type":"absolute","value":1698822436},{"type":"absolute","value":1698824487},{"type":"absolute","value":1698822954},{"type":"absolute","value":1698821932},{"type":"absolute","value":1698822963},{"type":"absolute","value":1698821942},{"type":"absolute","value":1698822967},{"type":"absolute","value":1698823480},{"type":"absolute","value":1698821947},{"type":"absolute","value":1698823996},{"type":"absolute","value":1698824509},{"type":"absolute","value":1698823492},{"type":"absolute","value":1698822986},{"type":"absolute","value":1698821967},{"type":"absolute","value":1698823504},{"type":"absolute","value":1698824017},{"type":"absolute","value":1698822994},{"type":"absolute","value":1698821975},{"type":"absolute","value":1698824035},{"type":"absolute","value":1698823526},{"type":"absolute","value":1698822507},{"type":"absolute","value":1698824556},{"type":"absolute","value":1698823026},{"type":"absolute","value":1698824563},{"type":"absolute","value":1698822007},{"type":"absolute","value":1698824567},{"type":"absolute","value":1698822523},{"type":"absolute","value":1698822540},{"type":"absolute","value":1698824589},{"type":"absolute","value":1698823567},{"type":"absolute","value":1698822035},{"type":"absolute","value":1698822547},{"type":"absolute","value":1698823060},{"type":"absolute","value":1698823574},{"type":"absolute","value":1698824083},{"type":"absolute","value":1698823578},{"type":"absolute","value":1698822044},{"type":"absolute","value":1698823069},{"type":"absolute","value":1698822047},{"type":"absolute","value":1698823073},{"type":"absolute","value":1698824105},{"type":"absolute","value":1698824109},{"type":"absolute","value":1698822574},{"type":"absolute","value":1698823600},{"type":"absolute","value":1698822068},{"type":"absolute","value":1698822581},{"type":"absolute","value":1698823092},{"type":"absolute","value":1698824628},{"type":"absolute","value":1698823100},{"type":"absolute","value":1698824636},{"type":"absolute","value":1698824131},{"type":"absolute","value":1698823621},{"type":"absolute","value":1698822089},{"type":"absolute","value":1698824152},{"type":"absolute","value":1698822107},{"type":"absolute","value":1698823132},{"type":"absolute","value":1698823643},{"type":"absolute","value":1698822627},{"type":"absolute","value":1698822634},{"type":"absolute","value":1698824174},{"type":"absolute","value":1698822648}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698822455}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698823147}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698823312}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698821927}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698822122}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698822129}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698821887}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698822025}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698824720},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698825729},{"type":"absolute","value":1698827268},{"type":"absolute","value":1698826248},{"type":"absolute","value":1698826257},{"type":"absolute","value":1698826770},{"type":"absolute","value":1698826271},{"type":"absolute","value":1698825760},{"type":"absolute","value":1698825764},{"type":"absolute","value":1698826792},{"type":"absolute","value":1698827309},{"type":"absolute","value":1698825263},{"type":"absolute","value":1698827316},{"type":"absolute","value":1698826293},{"type":"absolute","value":1698825270},{"type":"absolute","value":1698827320},{"type":"absolute","value":1698825273},{"type":"absolute","value":1698825786},{"type":"absolute","value":1698824772},{"type":"absolute","value":1698826820},{"type":"absolute","value":1698825798},{"type":"absolute","value":1698826314},{"type":"absolute","value":1698826827},{"type":"absolute","value":1698825294},{"type":"absolute","value":1698826831},{"type":"absolute","value":1698827342},{"type":"absolute","value":1698825811},{"type":"absolute","value":1698824794},{"type":"absolute","value":1698826335},{"type":"absolute","value":1698825314},{"type":"absolute","value":1698827363},{"type":"absolute","value":1698826853},{"type":"absolute","value":1698825833},{"type":"absolute","value":1698824812},{"type":"absolute","value":1698824815},{"type":"absolute","value":1698825334},{"type":"absolute","value":1698827385},{"type":"absolute","value":1698826874},{"type":"absolute","value":1698824836},{"type":"absolute","value":1698826380},{"type":"absolute","value":1698825360},{"type":"absolute","value":1698826896},{"type":"absolute","value":1698827413},{"type":"absolute","value":1698826390},{"type":"absolute","value":1698825367},{"type":"absolute","value":1698826394},{"type":"absolute","value":1698827420},{"type":"absolute","value":1698824861},{"type":"absolute","value":1698827424},{"type":"absolute","value":1698825380},{"type":"absolute","value":1698825894},{"type":"absolute","value":1698825900},{"type":"absolute","value":1698826416},{"type":"absolute","value":1698825394},{"type":"absolute","value":1698825906},{"type":"absolute","value":1698827446},{"type":"absolute","value":1698826947},{"type":"absolute","value":1698826437},{"type":"absolute","value":1698825926},{"type":"absolute","value":1698825415},{"type":"absolute","value":1698826951},{"type":"absolute","value":1698827466},{"type":"absolute","value":1698824908},{"type":"absolute","value":1698825934},{"type":"absolute","value":1698824918},{"type":"absolute","value":1698826968},{"type":"absolute","value":1698825433},{"type":"absolute","value":1698824923},{"type":"absolute","value":1698826459},{"type":"absolute","value":1698827488},{"type":"absolute","value":1698825966},{"type":"absolute","value":1698824943},{"type":"absolute","value":1698826999},{"type":"absolute","value":1698824951},{"type":"absolute","value":1698826493},{"type":"absolute","value":1698826497},{"type":"absolute","value":1698825993},{"type":"absolute","value":1698827529},{"type":"absolute","value":1698827020},{"type":"absolute","value":1698827536},{"type":"absolute","value":1698826002},{"type":"absolute","value":1698827540},{"type":"absolute","value":1698826006},{"type":"absolute","value":1698824983},{"type":"absolute","value":1698826519},{"type":"absolute","value":1698827038},{"type":"absolute","value":1698826531},{"type":"absolute","value":1698826025},{"type":"absolute","value":1698827562},{"type":"absolute","value":1698825519},{"type":"absolute","value":1698826543},{"type":"absolute","value":1698826033},{"type":"absolute","value":1698825014},{"type":"absolute","value":1698825023},{"type":"absolute","value":1698825026},{"type":"absolute","value":1698825538},{"type":"absolute","value":1698826565},{"type":"absolute","value":1698827080},{"type":"absolute","value":1698826065},{"type":"absolute","value":1698827601},{"type":"absolute","value":1698825555},{"type":"absolute","value":1698825047},{"type":"absolute","value":1698827096},{"type":"absolute","value":1698827609},{"type":"absolute","value":1698825562},{"type":"absolute","value":1698827100},{"type":"absolute","value":1698826600},{"type":"absolute","value":1698825068},{"type":"absolute","value":1698826607},{"type":"absolute","value":1698827122},{"type":"absolute","value":1698826611},{"type":"absolute","value":1698825589},{"type":"absolute","value":1698826105},{"type":"absolute","value":1698825596},{"type":"absolute","value":1698825086},{"type":"absolute","value":1698826114},{"type":"absolute","value":1698826118},{"type":"absolute","value":1698827143},{"type":"absolute","value":1698826633},{"type":"absolute","value":1698826137},{"type":"absolute","value":1698827165},{"type":"absolute","value":1698826654},{"type":"absolute","value":1698826145},{"type":"absolute","value":1698825132},{"type":"absolute","value":1698825139},{"type":"absolute","value":1698826676},{"type":"absolute","value":1698825654},{"type":"absolute","value":1698827196},{"type":"absolute","value":1698825661},{"type":"absolute","value":1698825152},{"type":"absolute","value":1698826177},{"type":"absolute","value":1698827200},{"type":"absolute","value":1698825675},{"type":"absolute","value":1698825166},{"type":"absolute","value":1698827222},{"type":"absolute","value":1698825689},{"type":"absolute","value":1698826717},{"type":"absolute","value":1698827234},{"type":"absolute","value":1698825187},{"type":"absolute","value":1698826724},{"type":"absolute","value":1698825701},{"type":"absolute","value":1698826728},{"type":"absolute","value":1698827246},{"type":"absolute","value":1698825205},{"type":"absolute","value":1698826750}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698826975}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698826343}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698826212}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698827625}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698827297}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698827303}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698827509}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698827506}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698827680},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698815234},{"type":"absolute","value":1698812165},{"type":"absolute","value":1698812298},{"type":"absolute","value":1698812171},{"type":"absolute","value":1698811916},{"type":"absolute","value":1698815245},{"type":"absolute","value":1698811927},{"type":"absolute","value":1698812313},{"type":"absolute","value":1698814618},{"type":"absolute","value":1698815388},{"type":"absolute","value":1698812063},{"type":"absolute","value":1698812191},{"type":"absolute","value":1698814753},{"type":"absolute","value":1698812323},{"type":"absolute","value":1698811940},{"type":"absolute","value":1698814883},{"type":"absolute","value":1698812070},{"type":"absolute","value":1698815018},{"type":"absolute","value":1698815406},{"type":"absolute","value":1698814641},{"type":"absolute","value":1698811830},{"type":"absolute","value":1698815158},{"type":"absolute","value":1698814777},{"type":"absolute","value":1698814651},{"type":"absolute","value":1698814917},{"type":"absolute","value":1698815098},{"type":"absolute","value":1698814791},{"type":"absolute","value":1698814920},{"type":"absolute","value":1698815047},{"type":"absolute","value":1698814668},{"type":"absolute","value":1698815053},{"type":"absolute","value":1698814799},{"type":"absolute","value":1698814928},{"type":"absolute","value":1698811985},{"type":"absolute","value":1698812241},{"type":"absolute","value":1698812115},{"type":"absolute","value":1698815312},{"type":"absolute","value":1698815187},{"type":"absolute","value":1698811862},{"type":"absolute","value":1698814679},{"type":"absolute","value":1698815193},{"type":"absolute","value":1698815067},{"type":"absolute","value":1698811999},{"type":"absolute","value":1698812257},{"type":"absolute","value":1698814689},{"type":"absolute","value":1698815329},{"type":"absolute","value":1698814820},{"type":"absolute","value":1698815207},{"type":"absolute","value":1698812141},{"type":"absolute","value":1698814830},{"type":"absolute","value":1698812015},{"type":"absolute","value":1698812144},{"type":"absolute","value":1698814962},{"type":"absolute","value":1698815092},{"type":"absolute","value":1698815350},{"type":"absolute","value":1698814968},{"type":"absolute","value":1698811898},{"type":"absolute","value":1698812283},{"type":"absolute","value":1698812029},{"type":"absolute","value":1698815358}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698815504},{"type":"absolute","value":1698816371},{"type":"absolute","value":1698816423},{"type":"absolute","value":1698813161},{"type":"absolute","value":1698816250},{"type":"absolute","value":1698812811},{"type":"absolute","value":1698813198}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698816478},{"type":"absolute","value":1698813238},{"type":"absolute","value":1698813830},{"type":"absolute","value":1698816649},{"type":"absolute","value":1698813421},{"type":"absolute","value":1698811454}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698813329},{"type":"absolute","value":1698816642},{"type":"absolute","value":1698816754},{"type":"absolute","value":1698813396},{"type":"absolute","value":1698814039},{"type":"absolute","value":1698811645}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698812770},{"type":"absolute","value":1698812964},{"type":"absolute","value":1698812903},{"type":"absolute","value":1698813738},{"type":"absolute","value":1698817196},{"type":"absolute","value":1698813614},{"type":"absolute","value":1698815927},{"type":"absolute","value":1698813337},{"type":"absolute","value":1698816314},{"type":"absolute","value":1698816091},{"type":"absolute","value":1698816890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698814276},{"type":"absolute","value":1698816293},{"type":"absolute","value":1698813033},{"type":"absolute","value":1698816297},{"type":"absolute","value":1698816203},{"type":"absolute","value":1698812467},{"type":"absolute","value":1698813015},{"type":"absolute","value":1698813180}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698816288},{"type":"absolute","value":1698813094},{"type":"absolute","value":1698816614},{"type":"absolute","value":1698815943},{"type":"absolute","value":1698817287},{"type":"absolute","value":1698813038},{"type":"absolute","value":1698813041},{"type":"absolute","value":1698812375},{"type":"absolute","value":1698813944},{"type":"absolute","value":1698817308}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698815948},{"type":"absolute","value":1698813741},{"type":"absolute","value":1698817200},{"type":"absolute","value":1698813619},{"type":"absolute","value":1698816055},{"type":"absolute","value":1698812792},{"type":"absolute","value":1698812889},{"type":"absolute","value":1698812988},{"type":"absolute","value":1698816221}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698813506},{"type":"absolute","value":1698812871},{"type":"absolute","value":1698814343},{"type":"absolute","value":1698811677},{"type":"absolute","value":1698815918},{"type":"absolute","value":1698816245},{"type":"absolute","value":1698813752},{"type":"absolute","value":1698816411},{"type":"absolute","value":1698813021},{"type":"absolute","value":1698816254}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698960344},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698960344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698964280},{"type":"absolute","value":1698963138},{"type":"absolute","value":1698964267},{"type":"absolute","value":1698963151}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698963202},{"type":"absolute","value":1698963215}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698962312},{"type":"absolute","value":1698962287}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698964168},{"type":"absolute","value":1698964155},{"type":"absolute","value":1698962484},{"type":"absolute","value":1698962471}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698962801},{"type":"absolute","value":1698964164},{"type":"absolute","value":1698964177},{"type":"absolute","value":1698962814}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698964096},{"type":"absolute","value":1698964315},{"type":"absolute","value":1698964039},{"type":"absolute","value":1698963080},{"type":"absolute","value":1698964108},{"type":"absolute","value":1698964301},{"type":"absolute","value":1698962798},{"type":"absolute","value":1698960724},{"type":"absolute","value":1698960502},{"type":"absolute","value":1698960694},{"type":"absolute","value":1698960440},{"type":"absolute","value":1698960598},{"type":"absolute","value":1698962811},{"type":"absolute","value":1698963455}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698964224},{"type":"absolute","value":1698962474},{"type":"absolute","value":1698964237},{"type":"absolute","value":1698962487}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698964286},{"type":"absolute","value":1698964273},{"type":"absolute","value":1698962491},{"type":"absolute","value":1698962478}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"decrypt data using AES via x86 extensions":{"meta":{"name":"decrypt data using AES via x86 extensions","namespace":"data-manipulation/encryption/aes","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Deobfuscate/Decode Files or Information"],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","subtechnique":"","id":"T1140"}],"mbc":[{"parts":["Cryptography","Decrypt Data","AES"],"objective":"Cryptography","behavior":"Decrypt Data","method":"AES","id":"C0031.001"}],"references":[],"examples":["66602B5FAB602CB4E6F754748D249542:0x4097D0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: decrypt data using AES via x86 extensions\r\n    namespace: data-manipulation/encryption/aes\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    att&ck:\r\n      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]\r\n    mbc:\r\n      - Cryptography::Decrypt Data::AES [C0031.001]\r\n    examples:\r\n      - 66602B5FAB602CB4E6F754748D249542:0x4097D0\r\n  features:\r\n    - or:\r\n      - mnemonic: aesdec = Perform One Round of an AES Decryption Flow\r\n      - mnemonic: vaesdec\r\n      - mnemonic: aesdeclast = Perform Last Round of an AES Decryption Flow\r\n      - mnemonic: vaesdeclast\r\n","matches":[[{"type":"absolute","value":1698652656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdec","description":"Perform One Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652737},{"type":"absolute","value":1698652707},{"type":"absolute","value":1698652804},{"type":"absolute","value":1698652773},{"type":"absolute","value":1698652835},{"type":"absolute","value":1698652791},{"type":"absolute","value":1698652747},{"type":"absolute","value":1698652717},{"type":"absolute","value":1698652687},{"type":"absolute","value":1698652822},{"type":"absolute","value":1698652727},{"type":"absolute","value":1698652760},{"type":"absolute","value":1698652697}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdeclast","description":"Perform Last Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdeclast"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698653760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdec","description":"Perform One Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653958},{"type":"absolute","value":1698654472},{"type":"absolute","value":1698653963},{"type":"absolute","value":1698653968},{"type":"absolute","value":1698654097},{"type":"absolute","value":1698653973},{"type":"absolute","value":1698654102},{"type":"absolute","value":1698654486},{"type":"absolute","value":1698654107},{"type":"absolute","value":1698653983},{"type":"absolute","value":1698654112},{"type":"absolute","value":1698653858},{"type":"absolute","value":1698653988},{"type":"absolute","value":1698653863},{"type":"absolute","value":1698653993},{"type":"absolute","value":1698654458},{"type":"absolute","value":1698654505},{"type":"absolute","value":1698653868},{"type":"absolute","value":1698654125},{"type":"absolute","value":1698653998},{"type":"absolute","value":1698653873},{"type":"absolute","value":1698654130},{"type":"absolute","value":1698654135},{"type":"absolute","value":1698654008},{"type":"absolute","value":1698654392},{"type":"absolute","value":1698654519},{"type":"absolute","value":1698653883},{"type":"absolute","value":1698654140},{"type":"absolute","value":1698654013},{"type":"absolute","value":1698653888},{"type":"absolute","value":1698654018},{"type":"absolute","value":1698654403},{"type":"absolute","value":1698653893},{"type":"absolute","value":1698654023},{"type":"absolute","value":1698653898},{"type":"absolute","value":1698654538},{"type":"absolute","value":1698654158},{"type":"absolute","value":1698654414},{"type":"absolute","value":1698654163},{"type":"absolute","value":1698653908},{"type":"absolute","value":1698654036},{"type":"absolute","value":1698654168},{"type":"absolute","value":1698653913},{"type":"absolute","value":1698654041},{"type":"absolute","value":1698654425},{"type":"absolute","value":1698654552},{"type":"absolute","value":1698654173},{"type":"absolute","value":1698653918},{"type":"absolute","value":1698654046},{"type":"absolute","value":1698653923},{"type":"absolute","value":1698654051},{"type":"absolute","value":1698654436},{"type":"absolute","value":1698654186},{"type":"absolute","value":1698653933},{"type":"absolute","value":1698654191},{"type":"absolute","value":1698654064},{"type":"absolute","value":1698654447},{"type":"absolute","value":1698653938},{"type":"absolute","value":1698654196},{"type":"absolute","value":1698654069},{"type":"absolute","value":1698653943},{"type":"absolute","value":1698654201},{"type":"absolute","value":1698654074},{"type":"absolute","value":1698653948},{"type":"absolute","value":1698654079}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdeclast","description":"Perform Last Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698654224},{"type":"absolute","value":1698654229},{"type":"absolute","value":1698654214},{"type":"absolute","value":1698654566},{"type":"absolute","value":1698654219}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdeclast"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698654656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdec","description":"Perform One Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698655233},{"type":"absolute","value":1698655745},{"type":"absolute","value":1698655750},{"type":"absolute","value":1698656266},{"type":"absolute","value":1698655243},{"type":"absolute","value":1698655755},{"type":"absolute","value":1698655253},{"type":"absolute","value":1698655765},{"type":"absolute","value":1698656279},{"type":"absolute","value":1698655770},{"type":"absolute","value":1698655263},{"type":"absolute","value":1698655775},{"type":"absolute","value":1698655780},{"type":"absolute","value":1698655273},{"type":"absolute","value":1698656297},{"type":"absolute","value":1698655790},{"type":"absolute","value":1698655283},{"type":"absolute","value":1698655795},{"type":"absolute","value":1698656310},{"type":"absolute","value":1698655800},{"type":"absolute","value":1698655293},{"type":"absolute","value":1698655805},{"type":"absolute","value":1698656328},{"type":"absolute","value":1698655306},{"type":"absolute","value":1698655818},{"type":"absolute","value":1698655823},{"type":"absolute","value":1698655828},{"type":"absolute","value":1698656341},{"type":"absolute","value":1698655319},{"type":"absolute","value":1698655833},{"type":"absolute","value":1698655846},{"type":"absolute","value":1698655337},{"type":"absolute","value":1698655851},{"type":"absolute","value":1698655856},{"type":"absolute","value":1698655861},{"type":"absolute","value":1698655350},{"type":"absolute","value":1698655879},{"type":"absolute","value":1698655368},{"type":"absolute","value":1698655884},{"type":"absolute","value":1698655889},{"type":"absolute","value":1698655381},{"type":"absolute","value":1698655894},{"type":"absolute","value":1698655640},{"type":"absolute","value":1698655645},{"type":"absolute","value":1698655650},{"type":"absolute","value":1698655907},{"type":"absolute","value":1698655655},{"type":"absolute","value":1698655912},{"type":"absolute","value":1698655917},{"type":"absolute","value":1698655665},{"type":"absolute","value":1698655922},{"type":"absolute","value":1698655670},{"type":"absolute","value":1698655675},{"type":"absolute","value":1698655680},{"type":"absolute","value":1698656193},{"type":"absolute","value":1698655940},{"type":"absolute","value":1698655945},{"type":"absolute","value":1698655690},{"type":"absolute","value":1698656203},{"type":"absolute","value":1698655950},{"type":"absolute","value":1698655695},{"type":"absolute","value":1698655955},{"type":"absolute","value":1698655700},{"type":"absolute","value":1698656213},{"type":"absolute","value":1698655705},{"type":"absolute","value":1698656223},{"type":"absolute","value":1698655968},{"type":"absolute","value":1698655715},{"type":"absolute","value":1698655973},{"type":"absolute","value":1698655720},{"type":"absolute","value":1698656233},{"type":"absolute","value":1698655978},{"type":"absolute","value":1698655725},{"type":"absolute","value":1698655983},{"type":"absolute","value":1698655730},{"type":"absolute","value":1698656243},{"type":"absolute","value":1698655740},{"type":"absolute","value":1698656253}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdeclast","description":"Perform Last Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698656001},{"type":"absolute","value":1698655394},{"type":"absolute","value":1698656354},{"type":"absolute","value":1698656006},{"type":"absolute","value":1698656011},{"type":"absolute","value":1698655996}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdeclast"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using RC4 PRGA":{"meta":{"name":"encrypt data using RC4 PRGA","namespace":"data-manipulation/encryption/rc4","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Cryptography","Encrypt Data","RC4"],"objective":"Cryptography","behavior":"Encrypt Data","method":"RC4","id":"C0027.009"},{"parts":["Cryptography","Generate Pseudo-random Sequence","RC4 PRGA"],"objective":"Cryptography","behavior":"Generate Pseudo-random Sequence","method":"RC4 PRGA","id":"C0021.004"}],"references":[],"examples":["34404A3FB9804977C6AB86CB991FB130:0x403DB0","34404A3FB9804977C6AB86CB991FB130:0x403E50","9324D1A8AE37A36AE560C37448C9705A:0x4049F0","73CE04892E5F39EC82B00C02FC04C70F:0x4064C6"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using RC4 PRGA\r\n    namespace: data-manipulation/encryption/rc4\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic, mnemonic, basicblock features\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Cryptography::Encrypt Data::RC4 [C0027.009]\r\n      - Cryptography::Generate Pseudo-random Sequence::RC4 PRGA [C0021.004]\r\n    examples:\r\n      - 34404A3FB9804977C6AB86CB991FB130:0x403DB0\r\n      - 34404A3FB9804977C6AB86CB991FB130:0x403E50\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049F0\r\n      - 73CE04892E5F39EC82B00C02FC04C70F:0x4064C6\r\n  features:\r\n    - and:\r\n      # TODO: maybe add characteristic for nzxor reg size\r\n      - count(characteristic(nzxor)): 1\r\n      - or:\r\n        - match: calculate modulo 256 via x86 assembly\r\n        # compiler may do this via zero-extended mov from 8-bit register\r\n        - count(mnemonic(movzx)): 4 or more\r\n      # should not call (many) functions\r\n      - count(characteristic(calls from)): (0, 4)\r\n      # should not be too simple or too complex (50 is picked by intuition)\r\n      - count(basic blocks): (4, 50)\r\n      - match: contain loop\r\n      - optional:\r\n        - or:\r\n          - number: 0xFF\r\n          - number: 0x100\r\n","matches":[[{"type":"absolute","value":1698804848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698804848}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698805111}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":4,"child":{"type":"characteristic","characteristic":"calls from"}}},"children":[],"locations":[{"type":"absolute","value":1698804848},{"type":"absolute","value":1698444688},{"type":"absolute","value":1698804144},{"type":"absolute","value":1698804512}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":50,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698804992},{"type":"absolute","value":1698805632},{"type":"absolute","value":1698804995},{"type":"absolute","value":1698804932},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805133},{"type":"absolute","value":1698805200},{"type":"absolute","value":1698804952},{"type":"absolute","value":1698804889},{"type":"absolute","value":1698805307},{"type":"absolute","value":1698805088},{"type":"absolute","value":1698804961},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805283},{"type":"absolute","value":1698805611},{"type":"absolute","value":1698804908},{"type":"absolute","value":1698805039},{"type":"absolute","value":1698804848},{"type":"absolute","value":1698805104},{"type":"absolute","value":1698805487},{"type":"absolute","value":1698805107},{"type":"absolute","value":1698805363},{"type":"absolute","value":1698805427},{"type":"absolute","value":1698805551},{"type":"absolute","value":1698805177},{"type":"absolute","value":1698804922},{"type":"absolute","value":1698805179}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"calculate modulo 256 via x86 assembly"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"movzx"}}},"children":[],"locations":[{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805122},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805029},{"type":"absolute","value":1698804999},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805066},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805069},{"type":"absolute","value":1698805006},{"type":"absolute","value":1698805009},{"type":"absolute","value":1698805119}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":256}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698805664},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698805664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698805664}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698805111}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":4,"child":{"type":"characteristic","characteristic":"calls from"}}},"children":[],"locations":[{"type":"absolute","value":1698804848},{"type":"absolute","value":1698444688},{"type":"absolute","value":1698804144},{"type":"absolute","value":1698804512}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":50,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698804992},{"type":"absolute","value":1698805632},{"type":"absolute","value":1698804995},{"type":"absolute","value":1698804932},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805133},{"type":"absolute","value":1698805200},{"type":"absolute","value":1698804952},{"type":"absolute","value":1698804889},{"type":"absolute","value":1698805307},{"type":"absolute","value":1698805088},{"type":"absolute","value":1698804961},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805283},{"type":"absolute","value":1698805664},{"type":"absolute","value":1698805611},{"type":"absolute","value":1698804908},{"type":"absolute","value":1698805039},{"type":"absolute","value":1698804848},{"type":"absolute","value":1698805104},{"type":"absolute","value":1698805487},{"type":"absolute","value":1698805107},{"type":"absolute","value":1698805363},{"type":"absolute","value":1698805427},{"type":"absolute","value":1698805551},{"type":"absolute","value":1698805177},{"type":"absolute","value":1698804922},{"type":"absolute","value":1698805179}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"calculate modulo 256 via x86 assembly"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"movzx"}}},"children":[],"locations":[{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805122},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805029},{"type":"absolute","value":1698804999},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805066},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805069},{"type":"absolute","value":1698805006},{"type":"absolute","value":1698805009},{"type":"absolute","value":1698805119}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":256}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using Salsa20 or ChaCha":{"meta":{"name":"encrypt data using Salsa20 or ChaCha","namespace":"data-manipulation/encryption/salsa20","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[],"references":["http://cr.yp.to/snuffle/ecrypt.c"],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encrypt data using Salsa20 or ChaCha\r\n    namespace: data-manipulation/encryption/salsa20\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    references:\r\n      - http://cr.yp.to/snuffle/ecrypt.c\r\n  features:\r\n    # The constant words spell \"expand 32-byte k\" in ASCII (i.e. the 4 words are \"expa\", \"nd 3\", \"2-by\", and \"te k\")\r\n    - or:\r\n      - description: part of key setup\r\n      - string: \"expand 32-byte k = sigma\"\r\n      - string: \"expand 16-byte k = tau\"\r\n      # if sigma and tau are in contiguous memory, may result in concatenated string\r\n      - string: \"expand 32-byte kexpand 16-byte k\"\r\n      - and:\r\n        - string: \"expa\"\r\n        - string: \"nd 3\"\r\n        - string: \"2-by\"\r\n        - string: \"te k\"\r\n      - and:\r\n        - number: 0x61707865 = \"apxe\"\r\n        - number: 0x3320646E = \"3 dn\"\r\n        - number: 0x79622D32 = \"yb-2\"\r\n        - number: 0x6B206574 = \"k et\"\r\n","matches":[[{"type":"absolute","value":1698960128},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"part of key setup"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expand 32-byte k = sigma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expand 16-byte k = tau"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expand 32-byte kexpand 16-byte k"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expa"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"nd 3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"2-by"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"te k"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1634760805,"description":"\"apxe\""}},"children":[],"locations":[{"type":"absolute","value":1698960192},{"type":"absolute","value":1698960259}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":857760878,"description":"\"3 dn\""}},"children":[],"locations":[{"type":"absolute","value":1698960199}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2036477234,"description":"\"yb-2\""}},"children":[],"locations":[{"type":"absolute","value":1698960206}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1797285236,"description":"\"k et\""}},"children":[],"locations":[{"type":"absolute","value":1698960280},{"type":"absolute","value":1698960213}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data with CRC32":{"meta":{"name":"hash data with CRC32","namespace":"data-manipulation/checksum/crc32","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Data","Checksum","CRC32"],"objective":"Data","behavior":"Checksum","method":"CRC32","id":"C0032.001"}],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403CBD","7D28CB106CB54876B2A5C111724A07CD:0x402350","7EFF498DE13CC734262F87E6B3EF38AB:0x100084A6"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data with CRC32\r\n    namespace: data-manipulation/checksum/crc32\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires operand[1].number, characteristic, bytes, mnemonic features\r\n    mbc:\r\n      - Data::Checksum::CRC32 [C0032.001]\r\n    examples:\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD\r\n      - 7D28CB106CB54876B2A5C111724A07CD:0x402350  # RtlComputeCrc32\r\n      - 7EFF498DE13CC734262F87E6B3EF38AB:0x100084A6\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 1 = bits in a byte\r\n        - instruction:\r\n          - description: is bit set?\r\n          - or:\r\n            - mnemonic: and\r\n            - mnemonic: test\r\n          - operand[1].number: 1\r\n        - instruction:\r\n          - mnemonic: shr\r\n          - number: 1\r\n        - characteristic: nzxor\r\n        - operand[1].number: 0xEDB88320\r\n      - and:\r\n        - number: 0x8320\r\n        - number: 0xEDB8\r\n        - characteristic: nzxor\r\n      - api: RtlComputeCrc32\r\n      - bytes: 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E = crc32_tab\r\n","matches":[[{"type":"absolute","value":1699058032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlComputeCrc32"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00000000963007772c610eeeba51099919c46d078ff46a7035a563e9a395649e","description":"crc32_tab"}},"children":[],"locations":[{"type":"absolute","value":1699058483},{"type":"absolute","value":1699058467},{"type":"absolute","value":1699058087}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":33568}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":60856}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059200},{"type":"absolute","value":1699058433},{"type":"absolute","value":1699058178},{"type":"absolute","value":1699058186},{"type":"absolute","value":1699059856},{"type":"absolute","value":1699058194},{"type":"absolute","value":1699059219},{"type":"absolute","value":1699059092},{"type":"absolute","value":1699059351},{"type":"absolute","value":1699059096},{"type":"absolute","value":1699058337},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059882},{"type":"absolute","value":1699059243},{"type":"absolute","value":1699058223},{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058229},{"type":"absolute","value":1699059583},{"type":"absolute","value":1699058237},{"type":"absolute","value":1699059646},{"type":"absolute","value":1699059392},{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059650},{"type":"absolute","value":1699059907},{"type":"absolute","value":1699060035},{"type":"absolute","value":1699058245},{"type":"absolute","value":1699059269},{"type":"absolute","value":1699058375},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699058123},{"type":"absolute","value":1699058379},{"type":"absolute","value":1699058129},{"type":"absolute","value":1699059027},{"type":"absolute","value":1699059670},{"type":"absolute","value":1699058137},{"type":"absolute","value":1699059674},{"type":"absolute","value":1699058395},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059808},{"type":"absolute","value":1699058145},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059431},{"type":"absolute","value":1699058295},{"type":"absolute","value":1699058283},{"type":"absolute","value":1699059694},{"type":"absolute","value":1699058287},{"type":"absolute","value":1699059952},{"type":"absolute","value":1699059698},{"type":"absolute","value":1699058423},{"type":"absolute","value":1699059832},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059196},{"type":"absolute","value":1699058175}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"bits in a byte"}},"children":[],"locations":[{"type":"absolute","value":1699058034},{"type":"absolute","value":1699060003},{"type":"absolute","value":1699059396},{"type":"absolute","value":1699059317},{"type":"absolute","value":1699059973},{"type":"absolute","value":1699059596},{"type":"absolute","value":1699058414}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand number","index":1,"operand_number":1}},"children":[],"locations":[{"type":"absolute","value":1699058034}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"test"}},"children":[],"locations":[{"type":"absolute","value":1699058034}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699058034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with CRC32/b6bd5d540c944f8883f733096f36c3ee"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059200},{"type":"absolute","value":1699058433},{"type":"absolute","value":1699058178},{"type":"absolute","value":1699058186},{"type":"absolute","value":1699059856},{"type":"absolute","value":1699058194},{"type":"absolute","value":1699059219},{"type":"absolute","value":1699059092},{"type":"absolute","value":1699059351},{"type":"absolute","value":1699059096},{"type":"absolute","value":1699058337},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059882},{"type":"absolute","value":1699059243},{"type":"absolute","value":1699058223},{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058229},{"type":"absolute","value":1699059583},{"type":"absolute","value":1699058237},{"type":"absolute","value":1699059646},{"type":"absolute","value":1699059392},{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059650},{"type":"absolute","value":1699059907},{"type":"absolute","value":1699060035},{"type":"absolute","value":1699058245},{"type":"absolute","value":1699059269},{"type":"absolute","value":1699058375},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699058123},{"type":"absolute","value":1699058379},{"type":"absolute","value":1699058129},{"type":"absolute","value":1699059027},{"type":"absolute","value":1699059670},{"type":"absolute","value":1699058137},{"type":"absolute","value":1699059674},{"type":"absolute","value":1699058395},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059808},{"type":"absolute","value":1699058145},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059431},{"type":"absolute","value":1699058295},{"type":"absolute","value":1699058283},{"type":"absolute","value":1699059694},{"type":"absolute","value":1699058287},{"type":"absolute","value":1699059952},{"type":"absolute","value":1699059698},{"type":"absolute","value":1699058423},{"type":"absolute","value":1699059832},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059196},{"type":"absolute","value":1699058175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand number","index":1,"operand_number":3988292384}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using SHA512":{"meta":{"name":"hash data using SHA512","namespace":"data-manipulation/hashing/sha512","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":["https://www.rfc-editor.org/rfc/rfc6234"],"examples":["1195d0d18be9362fb8dd9e1738404c9d:0x404FC0","44d40faf3f1fe4ed969befab7afcd2f0:0x1003D2F0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data using SHA512\r\n    namespace: data-manipulation/hashing/sha512\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    references:\r\n      - https://www.rfc-editor.org/rfc/rfc6234\r\n    examples:\r\n      - 1195d0d18be9362fb8dd9e1738404c9d:0x404FC0\r\n      - 44d40faf3f1fe4ed969befab7afcd2f0:0x1003D2F0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 0x6a09e667f3bcc908 = H(0)0\r\n        - number: 0xbb67ae8584caa73b = H(0)1\r\n        - number: 0x3c6ef372fe94f82b = H(0)2\r\n        - number: 0xa54ff53a5f1d36f1 = H(0)3\r\n        - number: 0x510e527fade682d1 = H(0)4\r\n        - number: 0x9b05688c2b3e6c1f = H(0)5\r\n        - number: 0x1f83d9abfb41bd6b = H(0)6\r\n        - number: 0x5be0cd19137e2179 = H(0)7\r\n      - and:\r\n        - or:\r\n          - number: 0x428a2f98d728ae22\r\n          - and:\r\n            - number: 0x428a2f98\r\n            - number: 0xd728ae22\r\n        - or:\r\n          - number: 0x7137449123ef65cd\r\n          - and:\r\n            - number: 0x71374491\r\n            - number: 0x23ef65cd\r\n        - or:\r\n          - number: 0xb5c0fbcfec4d3b2f\r\n          - and:\r\n            - number: 0xb5c0fbcf\r\n            - number: 0xec4d3b2f\r\n        - or:\r\n          - number: 0xe9b5dba58189dbbc\r\n          - and:\r\n            - number: 0xe9b5dba5\r\n            - number: 0x8189dbbc\r\n        - or:\r\n          - number: 0x3956c25bf348b538\r\n          - and:\r\n            - number: 0x3956c25b\r\n            - number: 0xf348b538\r\n        - or:\r\n          - number: 0x59f111f1b605d019\r\n          - and:\r\n            - number: 0x59f111f1\r\n            - number: 0xb605d019\r\n        - or:\r\n          - number: 0x923f82a4af194f9b\r\n          - and:\r\n            - number: 0x923f82a4\r\n            - number: 0xaf194f9b\r\n        - or:\r\n          - number: 0xab1c5ed5da6d8118\r\n          - and:\r\n            - number: 0xab1c5ed5\r\n            - number: 0xda6d8118\r\n      - bytes: 08 C9 BC F3 67 E6 09 6A 3B A7 CA 84 85 AE 67 BB 2B F8 94 FE 72 F3 6E 3C F1 36 1D 5F 3A F5 4F A5 D1 82 E6 AD 7F 52 0E 51 1F 6C 3E 2B 8C 68 05 9B 6B BD 41 FB AB D9 83 1F 79 21 7E 13 19 CD E0 5B = H(0)\r\n","matches":[[{"type":"absolute","value":1699103440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699103453}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[{"type":"absolute","value":1699103494}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[{"type":"absolute","value":1699103463}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[{"type":"absolute","value":1699103515}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[{"type":"absolute","value":1699103532}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[{"type":"absolute","value":1699103549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[{"type":"absolute","value":1699103566}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[{"type":"absolute","value":1699103583}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699104512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[{"type":"absolute","value":1699105467}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[{"type":"absolute","value":1699104961}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[{"type":"absolute","value":1699104986}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[{"type":"absolute","value":1699105449}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[{"type":"absolute","value":1699105423}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[{"type":"absolute","value":1699105405}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[{"type":"absolute","value":1699105387}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[{"type":"absolute","value":1699105369}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699167664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699168178}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[{"type":"absolute","value":1699168188}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[{"type":"absolute","value":1699168417}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[{"type":"absolute","value":1699168509}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[{"type":"absolute","value":1699168050}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[{"type":"absolute","value":1699168235}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[{"type":"absolute","value":1699168382}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[{"type":"absolute","value":1699168493}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180679}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180686}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180919}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180926}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699181159}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699181166}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699181399}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699181406}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699183344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699183666},{"type":"absolute","value":1699183454}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699183946},{"type":"absolute","value":1699183365},{"type":"absolute","value":1699184223}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using SHA384":{"meta":{"name":"hash data using SHA384","namespace":"data-manipulation/hashing/sha384","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":["https://www.rfc-editor.org/rfc/rfc6234"],"examples":["44d40faf3f1fe4ed969befab7afcd2f0:0x1003D970"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data using SHA384\r\n    namespace: data-manipulation/hashing/sha384\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    references:\r\n      - https://www.rfc-editor.org/rfc/rfc6234\r\n    examples:\r\n      - 44d40faf3f1fe4ed969befab7afcd2f0:0x1003D970\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 0xcbbb9d5dc1059ed8 = H(0)0\r\n        - number: 0x629a292a367cd507 = H(0)1\r\n        - number: 0x9159015a3070dd17 = H(0)2\r\n        - number: 0x152fecd8f70e5939 = H(0)3\r\n        - number: 0x67332667ffc00b31 = H(0)4\r\n        - number: 0x8eb44a8768581511 = H(0)5\r\n        - number: 0xdb0c2e0d64f98fa7 = H(0)6\r\n        - number: 0x47b5481dbefa4fa4 = H(0)7\r\n      - bytes: D8 9E 05 C1 5D 9D BB CB 07 D5 7C 36 2A 29 9A 62 17 DD 70 30 5A 01 59 91 39 59 0E F7 D8 EC 2F 15 31 0B C0 FF 67 26 33 67 11 15 58 68 87 4A B4 8E A7 8F F9 64 0D 2E 0C DB A4 4F FA BE 1D 48 B5 47 = H(0)\r\n","matches":[[{"type":"absolute","value":1699103728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d89e05c15d9dbbcb07d57c362a299a6217dd70305a01599139590ef7d8ec2f15310bc0ff6726336711155868874ab48ea78ff9640d2e0cdba44ffabe1d48b547","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":14680500436340154072,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699103741}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7105036623409894663,"description":"H(0)1"}},"children":[],"locations":[{"type":"absolute","value":1699103782}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":10473403895298186519,"description":"H(0)2"}},"children":[],"locations":[{"type":"absolute","value":1699103751}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1526699215303891257,"description":"H(0)3"}},"children":[],"locations":[{"type":"absolute","value":1699103803}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7436329637833083697,"description":"H(0)4"}},"children":[],"locations":[{"type":"absolute","value":1699103820}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":10282925794625328401,"description":"H(0)5"}},"children":[],"locations":[{"type":"absolute","value":1699103837}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15784041429090275239,"description":"H(0)6"}},"children":[],"locations":[{"type":"absolute","value":1699103854}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5167115440072839076,"description":"H(0)7"}},"children":[],"locations":[{"type":"absolute","value":1699103871}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using Base64":{"meta":{"name":"encode data using Base64","namespace":"data-manipulation/encoding/base64","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Standard Algorithm","id":"E1027.m02"},{"parts":["Data","Encode Data","Base64"],"objective":"Data","behavior":"Encode Data","method":"Base64","id":"C0026.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C","074072B261FC27B65C72671F13510C05:0x100049B2","5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30","08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encode data using Base64\r\n    namespace: data-manipulation/encoding/base64\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]\r\n      - Data::Encode Data::Base64 [C0026.001]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C\r\n      - 074072B261FC27B65C72671F13510C05:0x100049B2\r\n      - 5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - and:\r\n        - mnemonic: shl\r\n        - mnemonic: shr\r\n        - number: 0x3F = modulo 64\r\n        - or:\r\n          - number: 0x3D = '='\r\n          - number: 0x3D3D = '=='\r\n        - match: contain loop\r\n        - optional:\r\n          - number: 2\r\n          - number: 3\r\n          - number: 4\r\n          - number: 6\r\n          - number: 0xF\r\n          - string: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"\r\n      - api: System.Convert::ToBase64String\r\n      - api: System.Convert::ToBase64CharArray\r\n      - api: System.Convert::TryToBase64Chars\r\n","matches":[[{"type":"absolute","value":1699164368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[{"type":"absolute","value":1699164409},{"type":"absolute","value":1699164451},{"type":"absolute","value":1699164417}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[{"type":"absolute","value":1699164413},{"type":"absolute","value":1699164455}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[{"type":"absolute","value":1699164778},{"type":"absolute","value":1699164495}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[{"type":"absolute","value":1699164455}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699164528},{"type":"absolute","value":1699164704},{"type":"absolute","value":1699164608},{"type":"absolute","value":1699164787},{"type":"absolute","value":1699164848},{"type":"absolute","value":1699164928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699164368}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"absolute","value":1699164451}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"absolute","value":1699164409},{"type":"absolute","value":1699164417}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using SHA256":{"meta":{"name":"hash data using SHA256","namespace":"data-manipulation/hashing/sha256","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","SHA256"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"SHA256","id":"C0029.003"}],"references":["https://www.rfc-editor.org/rfc/rfc6234"],"examples":["C0CFFCF211035A839E28D542DE300298:0x180011400","6CC148363200798A12091B97A17181A1:0x140120240","44d40faf3f1fe4ed969befab7afcd2f0:0x10033570"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data using SHA256\r\n    namespace: data-manipulation/hashing/sha256\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Cryptography::Cryptographic Hash::SHA256 [C0029.003]\r\n    references:\r\n      - https://www.rfc-editor.org/rfc/rfc6234\r\n    examples:\r\n      - C0CFFCF211035A839E28D542DE300298:0x180011400\r\n      - 6CC148363200798A12091B97A17181A1:0x140120240\r\n      - 44d40faf3f1fe4ed969befab7afcd2f0:0x10033570\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 0x6A09E667 = H(0)0\r\n        - number: 0xBB67AE85 = H(0)1\r\n        - number: 0x3C6EF372 = H(0)2\r\n        - number: 0xA54FF53A = H(0)3\r\n        - number: 0x510E527F = H(0)4\r\n        - number: 0x9B05688C = H(0)5\r\n        - number: 0x1F83D9AB = H(0)6\r\n        - number: 0x5BE0CD19 = H(0)7\r\n      - bytes: 67 E6 09 6A 85 AE 67 BB 72 F3 6E 3C 3A F5 4F A5 7F 52 0E 51 8C 68 05 9B AB D9 83 1F 19 CD E0 5B = H(0)\r\n      - and:\r\n        # there are 64 constants but we'll only include 8 here for simplicity\r\n        - number: 0x428a2f98\r\n        - number: 0x71374491\r\n        - number: 0xb5c0fbcf\r\n        - number: 0xe9b5dba5\r\n        - number: 0x3956c25b\r\n        - number: 0x59f111f1\r\n        - number: 0x923f82a4\r\n        - number: 0xab1c5ed5\r\n        - not:\r\n          - or:\r\n            - number: 0xd728ae22 = lower half of SHA512 constant, 0x428a2f98d728ae22\r\n            - number: 0x23ef65cd = lower half of SHA512 constant, 0x7137449123ef65cd\r\n      - and:\r\n        - format: dotnet\r\n        - or:\r\n          - api: System.Security.Cryptography.SHA256Managed::Initialize\r\n          - api: System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize\r\n          - api: System.Security.Cryptography.SHA256::Create\r\n          - api: System.Security.Cryptography.SHA256Managed::ctor\r\n        - api: System.Security.Cryptography.HashAlgorithm::ComputeHash\r\n","matches":[[{"type":"absolute","value":1699179840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699179853}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699179847}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180061}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180055}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180269}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180263}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180477}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180471}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699181896},{"type":"absolute","value":1699181655}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699182449},{"type":"absolute","value":1699182133},{"type":"absolute","value":1699181735}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data with MD5":{"meta":{"name":"hash data with MD5","namespace":"data-manipulation/hashing/md5","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","MD5"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"MD5","id":"C0029.001"}],"references":["https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x100108ED"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data with MD5\r\n    namespace: data-manipulation/hashing/md5\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Cryptography::Cryptographic Hash::MD5 [C0029.001]\r\n    references:\r\n      - https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x100108ED\r\n  features:\r\n    - or:\r\n      - and:\r\n        - description: magic initialization constants from MD4 and MD5\r\n        - number: 0x67452301 = A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - number: 0xefcdab89 = B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - number: 0x98badcfe = C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - number: 0x10325476 = D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - not:\r\n          - number: 0xc3d2e1f0 = likely SHA1 but also used in RIPEMD-160 and RIPEMD-320\r\n        - optional:\r\n          - description: specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\r\n          - and:\r\n            - offset: -0x28955B88\r\n            - offset: -0x173848AA\r\n      - basic block:\r\n        - and:\r\n          - number: 0x8003 = CALG_MD5\r\n          - api: advapi32.CryptCreateHash\r\n      - call:\r\n        - and:\r\n          - number: 0x8003 = CALG_MD5\r\n          - api: advapi32.CryptCreateHash\r\n      - and:\r\n        - format: dotnet\r\n        - or:\r\n          - api: System.Security.Cryptography.MD5::Create\r\n          - api: System.Security.Cryptography.MD5CryptoServiceProvider::ctor\r\n        - optional:\r\n          - api: System.Security.Cryptography.HashAlgorithm::ComputeHash\r\n","matches":[[{"type":"absolute","value":1699227920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/e95cc69a3c214f429bf6b65124ab15ce"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/df8e90902d8c4a0096a53bcf79b56221"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5CryptoServiceProvider::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"magic initialization constants from MD4 and MD5"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1732584193,"description":"A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227939}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4023233417,"description":"B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227946}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2562383102,"description":"C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227953}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":271733878,"description":"D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227960}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3285377520,"description":"likely SHA1 but also used in RIPEMD-160 and RIPEMD-320"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-680876936}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-389564586}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query environment variable":{"meta":{"name":"query environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com","@_re_fox"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x401880","0761142efbda6c4b1e801223de723578:0x65483490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query environment variable\r\n    namespace: host-interaction/environment-variable\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    examples:\r\n      - Practical Malware Analysis Lab 14-02.exe_:0x401880\r\n      - 0761142efbda6c4b1e801223de723578:0x65483490\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetEnvironmentVariable\r\n      - api: kernel32.GetEnvironmentStrings\r\n      - api: kernel32.ExpandEnvironmentStrings\r\n      - api: msvcr90.getenv\r\n      - api: msvcrt.getenv\r\n      - api: System.Environment::GetEnvironmentVariable\r\n      - api: System.Environment::GetEnvironmentVariables\r\n      - api: System.Environment::ExpandEnvironmentVariables\r\n","matches":[[{"type":"absolute","value":1699230864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699230893}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699230893}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699232613}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699232613}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699265705}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699265705}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query or enumerate registry value\r\n    namespace: host-interaction/registry\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Query Registry [T1012]\r\n    mbc:\r\n      - Operating System::Registry::Query Registry Value [C0036.006]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - match: create or open registry key\r\n      - or:\r\n        - api: advapi32.RegGetValue\r\n        - api: advapi32.RegEnumValue\r\n        - api: advapi32.RegQueryValue\r\n        - api: advapi32.RegQueryValueEx\r\n        - api: advapi32.RegQueryMultipleValues\r\n        - api: ZwQueryValueKey\r\n        - api: ZwEnumerateValueKey\r\n        - api: NtQueryValueKey\r\n        - api: NtEnumerateValueKey\r\n        - api: RtlQueryRegistryValues\r\n        - api: SHGetValue\r\n        - api: SHEnumValue\r\n        - api: SHRegGetInt\r\n        - api: SHRegGetPath\r\n        - api: SHRegGetValue\r\n        - api: SHQueryValueEx\r\n        - api: SHRegGetUSValue\r\n        - api: SHOpenRegStream\r\n        - api: SHRegEnumUSValue\r\n        - api: SHOpenRegStream2\r\n        - api: SHRegQueryUSValue\r\n        - api: SHRegGetBoolUSValue\r\n        - api: SHRegGetValueFromHKCUHKLM\r\n        - api: SHRegGetBoolValueFromHKCUHKLM\r\n        - api: Microsoft.Win32.RegistryKey::GetValue\r\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\r\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\r\n        - api: Microsoft.Win32.Registry::GetValue\r\n","matches":[[{"type":"absolute","value":1699230864},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":1699231046}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":1699232142}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232109}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":1699232217}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file via mapping":{"meta":{"name":"read file via mapping","namespace":"host-interaction/file-system/read","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.exe_:0x401440"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read file via mapping\r\n    namespace: host-interaction/file-system/read\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Read File [C0051]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.exe_:0x401440\r\n  features:\r\n    - or:\r\n      - and:\r\n        # static\r\n        - basic block:\r\n          - and:\r\n            - api: kernel32.MapViewOfFile\r\n            - or:\r\n              - number: 4 = FILE_MAP_READ\r\n              - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ\r\n        - optional:\r\n          - api: kernel32.UnmapViewOfFile\r\n          - and:\r\n            - match: get file size\r\n          - basic block:\r\n            - and:\r\n              - api: kernel32.CreateFileMapping\r\n              - or:\r\n                - number: 2 = PAGE_READONLY\r\n                - number: 4 = PAGE_READWRITE\r\n      - and:\r\n        # dynamic\r\n        - call:\r\n          - and:\r\n            - api: kernel32.MapViewOfFile\r\n            - or:\r\n              - number: 4 = FILE_MAP_READ\r\n              - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ\r\n        - optional:\r\n          - api: kernel32.UnmapViewOfFile\r\n          - and:\r\n            - match: get file size\r\n          - call:\r\n            - and:\r\n              - api: kernel32.CreateFileMapping\r\n              - or:\r\n                - number: 2 = PAGE_READONLY\r\n                - number: 4 = PAGE_READWRITE\r\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"MapViewOfFile"}},"children":[],"locations":[{"type":"absolute","value":1699231540}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"FILE_MAP_READ"}},"children":[],"locations":[{"type":"absolute","value":1699231523}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"FILE_MAP_WRITE | FILE_MAP_READ"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231517}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"UnmapViewOfFile"}},"children":[],"locations":[{"type":"absolute","value":1699231586}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get file size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read file via mapping/8c23c7ed414e46d4aa415ec94d848f9e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read file via mapping/f268e265b90e455a8fd4246226e3ead8"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"UnmapViewOfFile"}},"children":[],"locations":[{"type":"absolute","value":1699231586}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get file size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read file via mapping/67d4f352ed1a4ef8ab36115c909f7be0"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: link function at runtime on Windows\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - api: kernel32.GetProcAddress\r\n        - api: ntdll.LdrGetProcedureAddress\r\n      - optional:\r\n        - characteristic: indirect call\r\n        - api: kernel32.LoadLibrary\r\n        - api: kernel32.GetModuleHandle\r\n        - api: kernel32.GetModuleHandleEx\r\n        - api: ntdll.LdrLoadDll\r\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699233219},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232904},{"type":"absolute","value":1699233162},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699233107},{"type":"absolute","value":1699233429},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699231770},{"type":"absolute","value":1699231581},{"type":"absolute","value":1699232478},{"type":"absolute","value":1699231455},{"type":"absolute","value":1699233376},{"type":"absolute","value":1699233696},{"type":"absolute","value":1699231718},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":1699232249}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":1699232725},{"type":"absolute","value":1699232397}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get OS version":{"meta":{"name":"get OS version","authors":["@mr-tz"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000","5f66b82558ca92e54e77f216ef4c066c:0x44580A"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get OS version\r\n    authors:\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x401000\r\n      - 5f66b82558ca92e54e77f216ef4c066c:0x44580A\r\n  features:\r\n    - or:\r\n      - api: RtlGetVersion\r\n      - api: ntoskrnl.PsGetVersion\r\n      - api: GetVersion\r\n      - api: GetVersionEx\r\n      - api: VerifyVersionInfo\r\n      - api: VerSetConditionMask\r\n      - api: RtlGetNtVersionNumbers\r\n      - api: GetProductInfo\r\n      - and:\r\n        - match: PEB access\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - or:\r\n              - offset: 0xA4 = PEB->OSMajorVersion\r\n              - offset: 0xA8 = PEB->OSMinorVersion\r\n              - offset: 0xAC = PEB->OSBuildNumber\r\n          - and:\r\n            - arch: amd64\r\n            - or:\r\n              - offset: 0x118 = PEB->OSMajorVersion\r\n              - offset: 0x11C = PEB->OSMinorVersion\r\n              - offset: 0x120 = PEB->OSBuildNumber\r\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[{"type":"absolute","value":1699232656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699232676},{"type":"absolute","value":1699232538},{"type":"absolute","value":1699232546}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699233569}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[{"type":"absolute","value":1699232530}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check OS version":{"meta":{"name":"check OS version","namespace":"host-interaction/os/version","authors":["michael.hunhoff@mandiant.com","johnk3r"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check OS version\r\n    namespace: host-interaction/os/version\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - johnk3r\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x401000\r\n  features:\r\n    - and:\r\n      - match: get OS version\r\n      - or:\r\n        - and:\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 5 = Windows 2000\r\n          - optional:\r\n            - instruction:\r\n              - mnemonic: cmp\r\n              - or:\r\n                - number: 0\r\n                - number: 1 = Windows XP\r\n                - number: 2 = Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2\r\n        - and:\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 6 = Windows Vista / Windows Server 2008\r\n          - optional:\r\n            - instruction:\r\n              - mnemonic: cmp\r\n              - or:\r\n                - number: 0\r\n                - number: 1 = Windows Server 2008 R2 / Windows 7\r\n                - number: 2 = Windows Server 2012 / Windows 8\r\n                - number: 3 = Windows Server 2012 R2 / Windows 8.1\r\n        - and:\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 10 = Windows Server 2016 / Windows Server 2019 / Windows 10\r\n          - optional:\r\n            - instruction:\r\n              - mnemonic: cmp\r\n              - number: 0\r\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"get OS version"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[{"type":"absolute","value":1699232656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699232676},{"type":"absolute","value":1699232538},{"type":"absolute","value":1699232546}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699233569}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[{"type":"absolute","value":1699232530}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232676}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5,"description":"Windows 2000"}},"children":[],"locations":[{"type":"absolute","value":1699232676}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232676}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232480},{"type":"absolute","value":1699232864},{"type":"absolute","value":1699232995},{"type":"absolute","value":1699232367},{"type":"absolute","value":1699231601},{"type":"absolute","value":1699232501},{"type":"absolute","value":1699232662},{"type":"absolute","value":1699232854},{"type":"absolute","value":1699232346}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check OS version/dd167a0a2e894029aa5b6f1e37461998"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232480},{"type":"absolute","value":1699232864},{"type":"absolute","value":1699232995},{"type":"absolute","value":1699232367},{"type":"absolute","value":1699231601},{"type":"absolute","value":1699232501},{"type":"absolute","value":1699232662},{"type":"absolute","value":1699232854},{"type":"absolute","value":1699232346}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check OS version/1f62a3ecf3674df58e00f619ddedbcdb"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232480},{"type":"absolute","value":1699231601},{"type":"absolute","value":1699232864},{"type":"absolute","value":1699232995},{"type":"absolute","value":1699232501},{"type":"absolute","value":1699232854},{"type":"absolute","value":1699232346},{"type":"absolute","value":1699232367}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link many functions at runtime":{"meta":{"name":"link many functions at runtime","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["b7b5e1253710d8927cbe07d52d2d2e10:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: link many functions at runtime\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - joakim@intezer.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - b7b5e1253710d8927cbe07d52d2d2e10:0x401000\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - match: link function at runtime on Windows\r\n        - or:\r\n          - count(api(kernel32.GetProcAddress)): 5 or more\r\n          - count(api(ntdll.LdrGetProcedureAddress)): 5 or more\r\n      - and:\r\n        - os: linux\r\n        - match: link function at runtime on Linux\r\n        - or:\r\n          - count(api(dlsym)): 5 or more\r\n          - count(api(dlvsym)): 5 or more\r\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699233219},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232904},{"type":"absolute","value":1699233162},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699233107},{"type":"absolute","value":1699233429},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699231770},{"type":"absolute","value":1699231581},{"type":"absolute","value":1699232478},{"type":"absolute","value":1699231455},{"type":"absolute","value":1699233376},{"type":"absolute","value":1699233696},{"type":"absolute","value":1699231718},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":1699232249}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":1699232725},{"type":"absolute","value":1699232397}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"GetProcAddress"}}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"LdrGetProcedureAddress"}}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"dlsym"}}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"dlvsym"}}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"generate random numbers via RtlGenRandom":{"meta":{"name":"generate random numbers via RtlGenRandom","namespace":"data-manipulation/prng","authors":["william.ballenthin@mandiant.com","richard.weiss@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Generate Pseudo-random Sequence","Use API"],"objective":"Cryptography","behavior":"Generate Pseudo-random Sequence","method":"Use API","id":"C0021.003"}],"references":["https://doxygen.reactos.org/df/d13/sysfunc_8c_source.html","https://blog.gentilkiwi.com/tag/systemfunction036"],"examples":["b7841b9d5dc1f511a93cc7576672ec0c:0x10002B80","0a0882b8da225406cc838991b5f67d11:0x416F35"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: generate random numbers via RtlGenRandom\r\n    namespace: data-manipulation/prng\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - richard.weiss@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Cryptography::Generate Pseudo-random Sequence::Use API [C0021.003]\r\n    references:\r\n      - https://doxygen.reactos.org/df/d13/sysfunc_8c_source.html\r\n      - https://blog.gentilkiwi.com/tag/systemfunction036\r\n    examples:\r\n      - b7841b9d5dc1f511a93cc7576672ec0c:0x10002B80 # api\r\n      - 0a0882b8da225406cc838991b5f67d11:0x416F35 # string\r\n  features:\r\n    - or:\r\n      - api: SystemFunction036\r\n      - and:\r\n        - match: link function at runtime on Windows\r\n        - string: \"SystemFunction036\"\r\n        - optional:\r\n          - string: /advapi32/i\r\n          - string: /cryptsp/i\r\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SystemFunction036"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699233219},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232904},{"type":"absolute","value":1699233162},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699233107},{"type":"absolute","value":1699233429},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699231770},{"type":"absolute","value":1699231581},{"type":"absolute","value":1699232478},{"type":"absolute","value":1699231455},{"type":"absolute","value":1699233376},{"type":"absolute","value":1699233696},{"type":"absolute","value":1699231718},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":1699232249}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":1699232725},{"type":"absolute","value":1699232397}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"SystemFunction036"}},"children":[],"locations":[{"type":"absolute","value":1699232812}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/advapi32/i"}},"children":[],"locations":[{"type":"absolute","value":1699232697}],"captures":{"AdvAPI32.dll":[{"type":"absolute","value":1699232697}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/cryptsp/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get memory capacity":{"meta":{"name":"get memory capacity","namespace":"host-interaction/hardware/memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get memory capacity\r\n    namespace: host-interaction/hardware/memory\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\r\n  features:\r\n    - or:\r\n      - api: kernel32.GlobalMemoryStatus\r\n      - api: kernel32.GlobalMemoryStatusEx\r\n        # TODO kernel32.GetSystemInfo with offset\r\n","matches":[[{"type":"absolute","value":1699233856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatus"}},"children":[],"locations":[{"type":"absolute","value":1699234179}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatusEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"terminate process":{"meta":{"name":"terminate process","namespace":"host-interaction/process/terminate","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Terminate Process"],"objective":"Process","behavior":"Terminate Process","method":"","id":"C0018"}],"references":[],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x401A77","9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: terminate process\r\n    namespace: host-interaction/process/terminate\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Terminate Process [C0018]\r\n    examples:\r\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\r\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\r\n  features:\r\n    - or:\r\n      - api: System.Diagnostics.Process::Kill\r\n      - api: System.Diagnostics.Process::WaitForExit\r\n      - api: System.Diagnostics.Process::WaitForExitAsync\r\n      - api: System.Environment::Exit\r\n      - api: System.Windows.Forms.Application::Exit\r\n      - api: exit\r\n      - api: Exit\r\n      - and:\r\n        - optional:\r\n          - match: open process\r\n        - or:\r\n          - api: kernel32.TerminateProcess\r\n          - api: ntdll.NtTerminateProcess\r\n          - api: kernel32.ExitProcess\r\n","matches":[[{"type":"absolute","value":1699277792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[{"type":"absolute","value":1699278002}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get thread local storage value":{"meta":{"name":"get thread local storage value","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get thread local storage value\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n  features:\r\n    - and:\r\n      - api: kernel32.TlsGetValue\r\n","matches":[[{"type":"absolute","value":1699280640},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TlsGetValue"}},"children":[],"locations":[{"type":"absolute","value":1699280690}],"captures":{}}],"locations":[],"captures":{}}]]},"parse PE header":{"meta":{"name":"parse PE header","namespace":"load-code/pe","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403DD0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: parse PE header\r\n    namespace: load-code/pe\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic, operand[1].offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - and:\r\n        - mnemonic: cmp\r\n        - or:\r\n          - number: 0x4550 = IMAGE_NT_SIGNATURE (PE)\r\n          - and:\r\n            - number: 0x50\r\n            - number: 0x45\r\n        - or:\r\n          - number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ)\r\n          - and:\r\n            - number: 0x4D\r\n            - number: 0x5A\r\n        - optional:\r\n          - and:\r\n            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n            - or:\r\n              - and:\r\n                - arch: i386\r\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\r\n                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n              - and:\r\n                - arch: amd64\r\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\r\n                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase\r\n          - basic block:\r\n            - and:\r\n              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n              - 3 or more:\r\n                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine\r\n                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\r\n                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\r\n                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics\r\n                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit\r\n                - or:\r\n                  - and:\r\n                    - arch: i386\r\n                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\r\n                  - and:\r\n                    - arch: amd64\r\n                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\r\n","matches":[[{"type":"absolute","value":1699281296},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699281296},{"type":"absolute","value":1699281273},{"type":"absolute","value":1699281284}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":1699281273}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":1699281296}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281264}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/b9b4ad7a16e14936bcf46acdb475b08d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate PE sections":{"meta":{"name":"enumerate PE sections","namespace":"load-code/pe","authors":["@Ana06","@mr-tz"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Discovery","Code Discovery","Enumerate PE Sections"],"objective":"Discovery","behavior":"Code Discovery","method":"Enumerate PE Sections","id":"B0046.001"}],"references":["https://0x00sec.org/t/reflective-dll-injection/3080","https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection"],"examples":["E4C33AC3638EEF68311F8AC0D72483C7:0x401510"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate PE sections\r\n    namespace: load-code/pe\r\n    authors:\r\n      - \"@Ana06\"\r\n      - \"@mr-tz\"\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires offset, operand[1].offset, characteristic, mnemonic, basicblock features\r\n    mbc:\r\n      - Discovery::Code Discovery::Enumerate PE Sections [B0046.001]\r\n    references:\r\n      - https://0x00sec.org/t/reflective-dll-injection/3080\r\n      - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection\r\n    examples:\r\n      - E4C33AC3638EEF68311F8AC0D72483C7:0x401510\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      # there should be some complexity to functions like this\r\n      - count(basic blocks): 3 or more\r\n      - optional:\r\n        - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n      - instruction:\r\n        - or:\r\n          - mnemonic: mov\r\n          - mnemonic: movzx\r\n        - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\r\n      - basic block:\r\n        - or:\r\n          - and:\r\n            - description: IMAGE_FIRST_SECTION(nt_header)\r\n            - instruction:\r\n              - or:\r\n                - mnemonic: add\r\n                - mnemonic: mov\r\n                - mnemonic: movzx\r\n              - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\r\n            - operand[1].offset: 0x18 = FileHeader.SizeOfOptionalHeader\r\n          - and:\r\n            - description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i\r\n            - number: 0x28 = sizeof(IMAGE_SECTION_HEADER)\r\n            - or:\r\n              - and:\r\n                - arch: i386\r\n                - operand[1].offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)\r\n              - and:\r\n                - arch: amd64\r\n                - operand[1].offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)\r\n      - 2 or more:\r\n        - operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress\r\n        - operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData\r\n        - operand[1].offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData\r\n        # there's also offset 0x8 = IMAGE_SECTION_HEADER.Misc.PhysicalAddress, but it's likely too common\r\n      - not:\r\n        # non-zeroing XOR was observed in FPs\r\n        - characteristic: nzxor\r\n","matches":[[{"type":"absolute","value":1699281328},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699281344}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281344}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281344}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281335}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281335}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281335}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281339}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281328}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699281328},{"type":"absolute","value":1699281376},{"type":"absolute","value":1699281393},{"type":"absolute","value":1699281395},{"type":"absolute","value":1699281364},{"type":"absolute","value":1699281384},{"type":"absolute","value":1699281352}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281328}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699281364}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699281335}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281552},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699281599}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281599}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281599}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281604}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281604}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281604}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281611}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281586}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699281632},{"type":"absolute","value":1699281574},{"type":"absolute","value":1699281644},{"type":"absolute","value":1699281552},{"type":"absolute","value":1699281618},{"type":"absolute","value":1699281586},{"type":"absolute","value":1699281652},{"type":"absolute","value":1699281661},{"type":"absolute","value":1699281663}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281586}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699281632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699281604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281920},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699281977}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281977}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281977}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281982}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281982}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281982}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281989}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281964}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699281920},{"type":"absolute","value":1699281952},{"type":"absolute","value":1699282016},{"type":"absolute","value":1699282052},{"type":"absolute","value":1699282028},{"type":"absolute","value":1699281964},{"type":"absolute","value":1699281996},{"type":"absolute","value":1699282036},{"type":"absolute","value":1699281944},{"type":"absolute","value":1699282045}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281964}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699282016}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699281982}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699282140}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699282140}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699282140}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699282131}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699282131}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699282131}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699282135}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699282131}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699282080},{"type":"absolute","value":1699282208},{"type":"absolute","value":1699282114},{"type":"absolute","value":1699282148},{"type":"absolute","value":1699282181},{"type":"absolute","value":1699282216},{"type":"absolute","value":1699282190},{"type":"absolute","value":1699282223},{"type":"absolute","value":1699282160},{"type":"absolute","value":1699282131},{"type":"absolute","value":1699282197},{"type":"absolute","value":1699282102},{"type":"absolute","value":1699282230},{"type":"absolute","value":1699282202},{"type":"absolute","value":1699282235},{"type":"absolute","value":1699282172}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699282114}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699282160},{"type":"absolute","value":1699282235},{"type":"absolute","value":1699282223}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699282131},{"type":"absolute","value":1699282212}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain a thread local storage (.tls) section":{"meta":{"name":"contain a thread local storage (.tls) section","namespace":"executable/pe/section/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain a thread local storage (.tls) section\r\n    namespace: executable/pe/section/tls\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-02.exe_\r\n  features:\r\n    - section: .tls\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"section","section":".tls"}},"children":[],"locations":[{"type":"absolute","value":1699557376}],"captures":{}}]]},"debug build":{"meta":{"name":"debug build","namespace":"executable/pe/debug","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: debug build\r\n    namespace: executable/pe/debug\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n  features:\r\n    - or:\r\n      - string: \"Assertion failed!\"\r\n      - string: \"Assertion failed:\"\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"Assertion failed!"}},"children":[],"locations":[{"type":"file","value":1053784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Assertion failed:"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
+{"meta":{"timestamp":"2024-06-10T17:59:45.716059","version":"7.0.1","argv":["./tests/data/0761142efbda6c4b1e801223de723578.dll_","--json"],"sample":{"md5":"0761142efbda6c4b1e801223de723578","sha1":"47ae05c3da1efe957da80f03dfec9ecb9e1ebcfc","sha256":"94a9155bed7e9d2752f7d861a608ccfeade029379f734220c5a1bbc1b563ed0e","path":"/Users/fariss/Desktop/capa/tests/data/0761142efbda6c4b1e801223de723578.dll_"},"flavor":"static","analysis":{"format":"pe","arch":"amd64","os":"windows","extractor":"VivisectFeatureExtractor","rules":["/Users/fariss/Desktop/capa/rules"],"base_address":{"type":"absolute","value":1698430976},"layout":{"functions":[{"address":{"type":"absolute","value":1698435088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698435154}},{"address":{"type":"absolute","value":1698435178}},{"address":{"type":"absolute","value":1698435211}},{"address":{"type":"absolute","value":1698435289}},{"address":{"type":"absolute","value":1698435373}},{"address":{"type":"absolute","value":1698435386}},{"address":{"type":"absolute","value":1698435411}},{"address":{"type":"absolute","value":1698435429}},{"address":{"type":"absolute","value":1698435536}}]},{"address":{"type":"absolute","value":1698435584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698435679}}]},{"address":{"type":"absolute","value":1698435888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698435679}},{"address":{"type":"absolute","value":1698435888}},{"address":{"type":"absolute","value":1698435910}},{"address":{"type":"absolute","value":1698435920}}]},{"address":{"type":"absolute","value":1698435968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1698435984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1698436080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436112}}]},{"address":{"type":"absolute","value":1698436128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436128}}]},{"address":{"type":"absolute","value":1698436160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448186}},{"address":{"type":"absolute","value":1698448214}}]},{"address":{"type":"absolute","value":1698436176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436176}}]},{"address":{"type":"absolute","value":1698436240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436240}}]},{"address":{"type":"absolute","value":1698436272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436272}}]},{"address":{"type":"absolute","value":1698436320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436320}}]},{"address":{"type":"absolute","value":1698436352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436352}}]},{"address":{"type":"absolute","value":1698436400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436400}}]},{"address":{"type":"absolute","value":1698436432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698454547}},{"address":{"type":"absolute","value":1698454561}},{"address":{"type":"absolute","value":1698454564}},{"address":{"type":"absolute","value":1698454576}},{"address":{"type":"absolute","value":1698454608}},{"address":{"type":"absolute","value":1698454643}}]},{"address":{"type":"absolute","value":1698436448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436491}}]},{"address":{"type":"absolute","value":1698436512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698463210}},{"address":{"type":"absolute","value":1698463306}},{"address":{"type":"absolute","value":1698463319}},{"address":{"type":"absolute","value":1698463364}},{"address":{"type":"absolute","value":1698463479}},{"address":{"type":"absolute","value":1698463531}},{"address":{"type":"absolute","value":1698463586}},{"address":{"type":"absolute","value":1698463669}},{"address":{"type":"absolute","value":1698463772}},{"address":{"type":"absolute","value":1698463795}},{"address":{"type":"absolute","value":1698463858}},{"address":{"type":"absolute","value":1698463920}},{"address":{"type":"absolute","value":1698464016}},{"address":{"type":"absolute","value":1698464064}},{"address":{"type":"absolute","value":1698464080}},{"address":{"type":"absolute","value":1698464152}},{"address":{"type":"absolute","value":1698464170}},{"address":{"type":"absolute","value":1698464188}},{"address":{"type":"absolute","value":1698464230}},{"address":{"type":"absolute","value":1698464260}},{"address":{"type":"absolute","value":1698464293}},{"address":{"type":"absolute","value":1698464344}},{"address":{"type":"absolute","value":1698464370}},{"address":{"type":"absolute","value":1698464390}},{"address":{"type":"absolute","value":1698464471}},{"address":{"type":"absolute","value":1698464485}}]},{"address":{"type":"absolute","value":1698436528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698454046}},{"address":{"type":"absolute","value":1698454164}},{"address":{"type":"absolute","value":1698454217}},{"address":{"type":"absolute","value":1698454384}},{"address":{"type":"absolute","value":1698454468}}]},{"address":{"type":"absolute","value":1698436656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461700}},{"address":{"type":"absolute","value":1698461708}},{"address":{"type":"absolute","value":1698461760}},{"address":{"type":"absolute","value":1698461794}},{"address":{"type":"absolute","value":1698461827}},{"address":{"type":"absolute","value":1698461872}},{"address":{"type":"absolute","value":1698461881}},{"address":{"type":"absolute","value":1698461914}}]},{"address":{"type":"absolute","value":1698436672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462021}},{"address":{"type":"absolute","value":1698462048}},{"address":{"type":"absolute","value":1698462080}}]},{"address":{"type":"absolute","value":1698436688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698436704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698436720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461208}},{"address":{"type":"absolute","value":1698461232}},{"address":{"type":"absolute","value":1698461303}},{"address":{"type":"absolute","value":1698461320}},{"address":{"type":"absolute","value":1698461365}},{"address":{"type":"absolute","value":1698461408}},{"address":{"type":"absolute","value":1698461424}}]},{"address":{"type":"absolute","value":1698436736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462705}}]},{"address":{"type":"absolute","value":1698436752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453241}},{"address":{"type":"absolute","value":1698453270}},{"address":{"type":"absolute","value":1698453296}}]},{"address":{"type":"absolute","value":1698436768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462278}}]},{"address":{"type":"absolute","value":1698436784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462346}},{"address":{"type":"absolute","value":1698462389}}]},{"address":{"type":"absolute","value":1698436800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462416}},{"address":{"type":"absolute","value":1698462495}},{"address":{"type":"absolute","value":1698462530}}]},{"address":{"type":"absolute","value":1698436816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436816}}]},{"address":{"type":"absolute","value":1698436864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261739}},{"address":{"type":"absolute","value":1699264512}}]},{"address":{"type":"absolute","value":1698436880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261931}},{"address":{"type":"absolute","value":1699264528}}]},{"address":{"type":"absolute","value":1698436896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698436912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263030}},{"address":{"type":"absolute","value":1699263085}},{"address":{"type":"absolute","value":1699263133}},{"address":{"type":"absolute","value":1699263220}}]},{"address":{"type":"absolute","value":1698436928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263601}},{"address":{"type":"absolute","value":1699263617}}]},{"address":{"type":"absolute","value":1698436944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}}]},{"address":{"type":"absolute","value":1698436960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}}]},{"address":{"type":"absolute","value":1698436976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698436976}}]},{"address":{"type":"absolute","value":1698437024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263290}}]},{"address":{"type":"absolute","value":1698437040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699263824}},{"address":{"type":"absolute","value":1699263846}},{"address":{"type":"absolute","value":1699263878}}]},{"address":{"type":"absolute","value":1698437056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1698437072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1698437088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238956}},{"address":{"type":"absolute","value":1699238970}},{"address":{"type":"absolute","value":1699238977}}]},{"address":{"type":"absolute","value":1698437104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437104}}]},{"address":{"type":"absolute","value":1698437152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437152}}]},{"address":{"type":"absolute","value":1698437200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437200}}]},{"address":{"type":"absolute","value":1698437232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}}]},{"address":{"type":"absolute","value":1698437248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}}]},{"address":{"type":"absolute","value":1698437264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234544}},{"address":{"type":"absolute","value":1699234597}},{"address":{"type":"absolute","value":1699234627}},{"address":{"type":"absolute","value":1699234699}},{"address":{"type":"absolute","value":1699234725}},{"address":{"type":"absolute","value":1699234797}},{"address":{"type":"absolute","value":1699234868}},{"address":{"type":"absolute","value":1699234912}}]},{"address":{"type":"absolute","value":1698437280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699236352}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699235904}},{"address":{"type":"absolute","value":1699235962}},{"address":{"type":"absolute","value":1699235999}},{"address":{"type":"absolute","value":1699236072}},{"address":{"type":"absolute","value":1699236098}},{"address":{"type":"absolute","value":1699236173}},{"address":{"type":"absolute","value":1699236244}},{"address":{"type":"absolute","value":1699236276}}]},{"address":{"type":"absolute","value":1698437328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236480}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699243568}},{"address":{"type":"absolute","value":1699243765}},{"address":{"type":"absolute","value":1699244162}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1698437360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243189}},{"address":{"type":"absolute","value":1699243251}}]},{"address":{"type":"absolute","value":1698437376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699244400}}]},{"address":{"type":"absolute","value":1698437392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243410}},{"address":{"type":"absolute","value":1699243433}}]},{"address":{"type":"absolute","value":1698437408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699240240}},{"address":{"type":"absolute","value":1699240296}},{"address":{"type":"absolute","value":1699240358}},{"address":{"type":"absolute","value":1699240432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699241005}},{"address":{"type":"absolute","value":1699241036}},{"address":{"type":"absolute","value":1699241056}},{"address":{"type":"absolute","value":1699241106}},{"address":{"type":"absolute","value":1699241124}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698437440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}}]},{"address":{"type":"absolute","value":1698437456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241269}}]},{"address":{"type":"absolute","value":1698437472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241897}}]},{"address":{"type":"absolute","value":1698437488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267072}}]},{"address":{"type":"absolute","value":1698437504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}}]},{"address":{"type":"absolute","value":1698437520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267454}}]},{"address":{"type":"absolute","value":1698437536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699267523}},{"address":{"type":"absolute","value":1699267552}}]},{"address":{"type":"absolute","value":1698437552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267568}}]},{"address":{"type":"absolute","value":1698437568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267692}},{"address":{"type":"absolute","value":1699267740}}]},{"address":{"type":"absolute","value":1698437584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267868}},{"address":{"type":"absolute","value":1699267916}}]},{"address":{"type":"absolute","value":1698437600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437600}}]},{"address":{"type":"absolute","value":1698437632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043593}},{"address":{"type":"absolute","value":1699043647}},{"address":{"type":"absolute","value":1699043664}},{"address":{"type":"absolute","value":1699043694}},{"address":{"type":"absolute","value":1699043729}},{"address":{"type":"absolute","value":1699043768}},{"address":{"type":"absolute","value":1699043798}},{"address":{"type":"absolute","value":1699044016}},{"address":{"type":"absolute","value":1699044099}},{"address":{"type":"absolute","value":1699044127}},{"address":{"type":"absolute","value":1699044242}},{"address":{"type":"absolute","value":1699268384}}]},{"address":{"type":"absolute","value":1698437648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}},{"address":{"type":"absolute","value":1699044464}},{"address":{"type":"absolute","value":1699044512}},{"address":{"type":"absolute","value":1699044547}},{"address":{"type":"absolute","value":1699044586}},{"address":{"type":"absolute","value":1699268432}}]},{"address":{"type":"absolute","value":1698437664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437664}}]},{"address":{"type":"absolute","value":1698437696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437696}}]},{"address":{"type":"absolute","value":1698437728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437761}}]},{"address":{"type":"absolute","value":1698437808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437808}},{"address":{"type":"absolute","value":1699268730}},{"address":{"type":"absolute","value":1699268735}},{"address":{"type":"absolute","value":1699268850}},{"address":{"type":"absolute","value":1699269065}},{"address":{"type":"absolute","value":1699269125}}]},{"address":{"type":"absolute","value":1698437872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437872}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}}]},{"address":{"type":"absolute","value":1698437920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437920}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699266048}},{"address":{"type":"absolute","value":1699266638}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}},{"address":{"type":"absolute","value":1699271296}},{"address":{"type":"absolute","value":1699271336}},{"address":{"type":"absolute","value":1699271345}},{"address":{"type":"absolute","value":1699271472}},{"address":{"type":"absolute","value":1699271493}},{"address":{"type":"absolute","value":1699271894}},{"address":{"type":"absolute","value":1699271969}},{"address":{"type":"absolute","value":1699272000}},{"address":{"type":"absolute","value":1699272460}},{"address":{"type":"absolute","value":1699272473}},{"address":{"type":"absolute","value":1699272498}}]},{"address":{"type":"absolute","value":1698437984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698437984}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}},{"address":{"type":"absolute","value":1699272640}},{"address":{"type":"absolute","value":1699272678}},{"address":{"type":"absolute","value":1699272752}},{"address":{"type":"absolute","value":1699272770}}]},{"address":{"type":"absolute","value":1698438048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438048}},{"address":{"type":"absolute","value":1699272848}},{"address":{"type":"absolute","value":1699273304}},{"address":{"type":"absolute","value":1699273631}},{"address":{"type":"absolute","value":1699273958}},{"address":{"type":"absolute","value":1699274827}},{"address":{"type":"absolute","value":1699274880}},{"address":{"type":"absolute","value":1699275381}}]},{"address":{"type":"absolute","value":1698438112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438112}},{"address":{"type":"absolute","value":1699275522}},{"address":{"type":"absolute","value":1699275621}},{"address":{"type":"absolute","value":1699276104}}]},{"address":{"type":"absolute","value":1698438160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236712}},{"address":{"type":"absolute","value":1699236720}}]},{"address":{"type":"absolute","value":1698438192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236811}},{"address":{"type":"absolute","value":1699236836}},{"address":{"type":"absolute","value":1699236868}},{"address":{"type":"absolute","value":1699236896}}]},{"address":{"type":"absolute","value":1698438208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1698438224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236959}},{"address":{"type":"absolute","value":1699236992}},{"address":{"type":"absolute","value":1699237059}},{"address":{"type":"absolute","value":1699237082}},{"address":{"type":"absolute","value":1699237104}}]},{"address":{"type":"absolute","value":1698438240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237168}},{"address":{"type":"absolute","value":1699237188}}]},{"address":{"type":"absolute","value":1698438256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237616}},{"address":{"type":"absolute","value":1699237643}},{"address":{"type":"absolute","value":1699237808}},{"address":{"type":"absolute","value":1699237859}},{"address":{"type":"absolute","value":1699237877}}]},{"address":{"type":"absolute","value":1698438272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699238164}},{"address":{"type":"absolute","value":1699238288}},{"address":{"type":"absolute","value":1699238320}},{"address":{"type":"absolute","value":1699238337}},{"address":{"type":"absolute","value":1699238352}},{"address":{"type":"absolute","value":1699238368}}]},{"address":{"type":"absolute","value":1698438288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}}]},{"address":{"type":"absolute","value":1698438304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}},{"address":{"type":"absolute","value":1699262739}},{"address":{"type":"absolute","value":1699262797}}]},{"address":{"type":"absolute","value":1698438320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262836}}]},{"address":{"type":"absolute","value":1698438336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}},{"address":{"type":"absolute","value":1699264736}},{"address":{"type":"absolute","value":1699264813}},{"address":{"type":"absolute","value":1699264881}},{"address":{"type":"absolute","value":1699264896}},{"address":{"type":"absolute","value":1699264964}}]},{"address":{"type":"absolute","value":1698438352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264992}},{"address":{"type":"absolute","value":1699265024}},{"address":{"type":"absolute","value":1699265037}}]},{"address":{"type":"absolute","value":1698438368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265088}},{"address":{"type":"absolute","value":1699265099}},{"address":{"type":"absolute","value":1699265162}},{"address":{"type":"absolute","value":1699265200}},{"address":{"type":"absolute","value":1699265216}},{"address":{"type":"absolute","value":1699265232}},{"address":{"type":"absolute","value":1699265248}}]},{"address":{"type":"absolute","value":1698438384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438384}},{"address":{"type":"absolute","value":1698438393}}]},{"address":{"type":"absolute","value":1698438512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438540}},{"address":{"type":"absolute","value":1698438579}}]},{"address":{"type":"absolute","value":1698438608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698480912}},{"address":{"type":"absolute","value":1698480924}},{"address":{"type":"absolute","value":1698480960}},{"address":{"type":"absolute","value":1698480992}}]},{"address":{"type":"absolute","value":1698438624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438687}}]},{"address":{"type":"absolute","value":1698438704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438767}}]},{"address":{"type":"absolute","value":1698438784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438847}}]},{"address":{"type":"absolute","value":1698438864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698438927}}]},{"address":{"type":"absolute","value":1698438944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439007}}]},{"address":{"type":"absolute","value":1698439024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439087}}]},{"address":{"type":"absolute","value":1698439104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439172}}]},{"address":{"type":"absolute","value":1698439184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439184}}]},{"address":{"type":"absolute","value":1698439216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439282}}]},{"address":{"type":"absolute","value":1698439296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479492}}]},{"address":{"type":"absolute","value":1698439312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479276}},{"address":{"type":"absolute","value":1698479340}},{"address":{"type":"absolute","value":1698479353}},{"address":{"type":"absolute","value":1698479364}},{"address":{"type":"absolute","value":1698479388}}]},{"address":{"type":"absolute","value":1698439328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479432}},{"address":{"type":"absolute","value":1698479441}}]},{"address":{"type":"absolute","value":1698439344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439418}},{"address":{"type":"absolute","value":1698439439}}]},{"address":{"type":"absolute","value":1698439472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439555}}]},{"address":{"type":"absolute","value":1698439568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698485952}}]},{"address":{"type":"absolute","value":1698439584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486000}}]},{"address":{"type":"absolute","value":1698439600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439666}}]},{"address":{"type":"absolute","value":1698439680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533796}}]},{"address":{"type":"absolute","value":1698439696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533700}},{"address":{"type":"absolute","value":1698533729}},{"address":{"type":"absolute","value":1698533744}}]},{"address":{"type":"absolute","value":1698439728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534596}}]},{"address":{"type":"absolute","value":1698439744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534676}}]},{"address":{"type":"absolute","value":1698439760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439788}},{"address":{"type":"absolute","value":1698439827}}]},{"address":{"type":"absolute","value":1698439856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698534240}},{"address":{"type":"absolute","value":1698534292}}]},{"address":{"type":"absolute","value":1698439872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698439935}}]},{"address":{"type":"absolute","value":1698439952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440015}}]},{"address":{"type":"absolute","value":1698440032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440095}}]},{"address":{"type":"absolute","value":1698440112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440175}}]},{"address":{"type":"absolute","value":1698440192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440255}}]},{"address":{"type":"absolute","value":1698440272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440340}}]},{"address":{"type":"absolute","value":1698440352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440377}},{"address":{"type":"absolute","value":1698440416}}]},{"address":{"type":"absolute","value":1698440448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440473}},{"address":{"type":"absolute","value":1698440512}}]},{"address":{"type":"absolute","value":1698440544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440569}},{"address":{"type":"absolute","value":1698440608}}]},{"address":{"type":"absolute","value":1698440640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440703}}]},{"address":{"type":"absolute","value":1698440720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440765}}]},{"address":{"type":"absolute","value":1698440784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440805}},{"address":{"type":"absolute","value":1698440837}}]},{"address":{"type":"absolute","value":1698440864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440864}}]},{"address":{"type":"absolute","value":1698440896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698440962}}]},{"address":{"type":"absolute","value":1698440976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516560}}]},{"address":{"type":"absolute","value":1698440992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516473}},{"address":{"type":"absolute","value":1698516480}}]},{"address":{"type":"absolute","value":1698441008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441025}},{"address":{"type":"absolute","value":1698441040}},{"address":{"type":"absolute","value":1698517557}}]},{"address":{"type":"absolute","value":1698441056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441077}},{"address":{"type":"absolute","value":1698441104}},{"address":{"type":"absolute","value":1698517700}},{"address":{"type":"absolute","value":1698517761}},{"address":{"type":"absolute","value":1698517827}},{"address":{"type":"absolute","value":1698518024}},{"address":{"type":"absolute","value":1698518048}}]},{"address":{"type":"absolute","value":1698441120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441144}},{"address":{"type":"absolute","value":1698441168}},{"address":{"type":"absolute","value":1698518351}},{"address":{"type":"absolute","value":1698518398}}]},{"address":{"type":"absolute","value":1698441184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441204}},{"address":{"type":"absolute","value":1698441220}},{"address":{"type":"absolute","value":1698518416}},{"address":{"type":"absolute","value":1698518471}},{"address":{"type":"absolute","value":1698518490}}]},{"address":{"type":"absolute","value":1698441232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441256}},{"address":{"type":"absolute","value":1698441296}}]},{"address":{"type":"absolute","value":1698441328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441352}},{"address":{"type":"absolute","value":1698441392}}]},{"address":{"type":"absolute","value":1698441424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1698441440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441494}}]},{"address":{"type":"absolute","value":1698441504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441525}},{"address":{"type":"absolute","value":1698441557}}]},{"address":{"type":"absolute","value":1698441584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529709}},{"address":{"type":"absolute","value":1698529772}}]},{"address":{"type":"absolute","value":1698441600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441668}}]},{"address":{"type":"absolute","value":1698441680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441705}},{"address":{"type":"absolute","value":1698441713}},{"address":{"type":"absolute","value":1698526807}}]},{"address":{"type":"absolute","value":1698441744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}},{"address":{"type":"absolute","value":1698529936}}]},{"address":{"type":"absolute","value":1698441760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441760}}]},{"address":{"type":"absolute","value":1698441792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441820}},{"address":{"type":"absolute","value":1698530224}},{"address":{"type":"absolute","value":1698530261}},{"address":{"type":"absolute","value":1698530373}},{"address":{"type":"absolute","value":1698530427}},{"address":{"type":"absolute","value":1698530448}},{"address":{"type":"absolute","value":1698530512}},{"address":{"type":"absolute","value":1698530544}}]},{"address":{"type":"absolute","value":1698441888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698441915}}]},{"address":{"type":"absolute","value":1698442016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442033}},{"address":{"type":"absolute","value":1698442048}},{"address":{"type":"absolute","value":1698532578}}]},{"address":{"type":"absolute","value":1698442096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532628}}]},{"address":{"type":"absolute","value":1698442112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442132}},{"address":{"type":"absolute","value":1698442144}}]},{"address":{"type":"absolute","value":1698442176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442244}}]},{"address":{"type":"absolute","value":1698442256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442256}}]},{"address":{"type":"absolute","value":1698442288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529028}}]},{"address":{"type":"absolute","value":1698442304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528725}},{"address":{"type":"absolute","value":1698528755}},{"address":{"type":"absolute","value":1698528788}},{"address":{"type":"absolute","value":1698528860}},{"address":{"type":"absolute","value":1698528866}},{"address":{"type":"absolute","value":1698528928}},{"address":{"type":"absolute","value":1698528961}},{"address":{"type":"absolute","value":1698528976}}]},{"address":{"type":"absolute","value":1698442320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442383}}]},{"address":{"type":"absolute","value":1698442400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527003}},{"address":{"type":"absolute","value":1698528525}},{"address":{"type":"absolute","value":1698528533}}]},{"address":{"type":"absolute","value":1698442416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442416}}]},{"address":{"type":"absolute","value":1698442512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442537}},{"address":{"type":"absolute","value":1699208359}},{"address":{"type":"absolute","value":1699208384}},{"address":{"type":"absolute","value":1699208405}},{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}},{"address":{"type":"absolute","value":1699224292}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1698442624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442687}}]},{"address":{"type":"absolute","value":1698442704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442724}},{"address":{"type":"absolute","value":1699209536}}]},{"address":{"type":"absolute","value":1698442816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442836}},{"address":{"type":"absolute","value":1699209584}}]},{"address":{"type":"absolute","value":1698442928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699264647}},{"address":{"type":"absolute","value":1699264688}}]},{"address":{"type":"absolute","value":1698442944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698442965}},{"address":{"type":"absolute","value":1699210038}},{"address":{"type":"absolute","value":1699210052}},{"address":{"type":"absolute","value":1699210080}},{"address":{"type":"absolute","value":1699210176}},{"address":{"type":"absolute","value":1699210234}},{"address":{"type":"absolute","value":1699210257}},{"address":{"type":"absolute","value":1699224292}}]},{"address":{"type":"absolute","value":1698443056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443056}}]},{"address":{"type":"absolute","value":1698443136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443136}}]},{"address":{"type":"absolute","value":1698443168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698553472}},{"address":{"type":"absolute","value":1698553490}},{"address":{"type":"absolute","value":1698553504}}]},{"address":{"type":"absolute","value":1698443184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443184}}]},{"address":{"type":"absolute","value":1698443216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698477792}},{"address":{"type":"absolute","value":1698477808}}]},{"address":{"type":"absolute","value":1698443232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443232}}]},{"address":{"type":"absolute","value":1698443280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445007}},{"address":{"type":"absolute","value":1698445045}},{"address":{"type":"absolute","value":1698445066}},{"address":{"type":"absolute","value":1698445084}},{"address":{"type":"absolute","value":1698445152}}]},{"address":{"type":"absolute","value":1698443296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}}]},{"address":{"type":"absolute","value":1698443312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443345}},{"address":{"type":"absolute","value":1699269292}},{"address":{"type":"absolute","value":1699269315}},{"address":{"type":"absolute","value":1699269367}},{"address":{"type":"absolute","value":1699269390}},{"address":{"type":"absolute","value":1699269439}},{"address":{"type":"absolute","value":1699269486}},{"address":{"type":"absolute","value":1699269509}},{"address":{"type":"absolute","value":1699269562}},{"address":{"type":"absolute","value":1699269585}},{"address":{"type":"absolute","value":1699269653}},{"address":{"type":"absolute","value":1699269676}},{"address":{"type":"absolute","value":1699269728}},{"address":{"type":"absolute","value":1699269751}},{"address":{"type":"absolute","value":1699269808}}]},{"address":{"type":"absolute","value":1698443376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445941}},{"address":{"type":"absolute","value":1698445992}},{"address":{"type":"absolute","value":1698446144}},{"address":{"type":"absolute","value":1698446174}},{"address":{"type":"absolute","value":1698446208}},{"address":{"type":"absolute","value":1698446245}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698443392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448816}},{"address":{"type":"absolute","value":1698448910}},{"address":{"type":"absolute","value":1698448995}},{"address":{"type":"absolute","value":1698449162}},{"address":{"type":"absolute","value":1698449232}},{"address":{"type":"absolute","value":1698449280}}]},{"address":{"type":"absolute","value":1698443408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453072}}]},{"address":{"type":"absolute","value":1698443424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451356}}]},{"address":{"type":"absolute","value":1698443440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698451460}},{"address":{"type":"absolute","value":1698451488}}]},{"address":{"type":"absolute","value":1698443504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451520}}]},{"address":{"type":"absolute","value":1698443520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452003}},{"address":{"type":"absolute","value":1698452016}}]},{"address":{"type":"absolute","value":1698443536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451568}}]},{"address":{"type":"absolute","value":1698443552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452134}},{"address":{"type":"absolute","value":1698452144}}]},{"address":{"type":"absolute","value":1698443568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447929}}]},{"address":{"type":"absolute","value":1698443584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451773}},{"address":{"type":"absolute","value":1698451818}}]},{"address":{"type":"absolute","value":1698443600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452280}}]},{"address":{"type":"absolute","value":1698443616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452625}}]},{"address":{"type":"absolute","value":1698443632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452542}}]},{"address":{"type":"absolute","value":1698443648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452721}}]},{"address":{"type":"absolute","value":1698443664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452357}},{"address":{"type":"absolute","value":1698452415}}]},{"address":{"type":"absolute","value":1698443680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452892}}]},{"address":{"type":"absolute","value":1698443696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698443712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451649}},{"address":{"type":"absolute","value":1698451683}},{"address":{"type":"absolute","value":1698451696}},{"address":{"type":"absolute","value":1698470480}}]},{"address":{"type":"absolute","value":1698443728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443728}}]},{"address":{"type":"absolute","value":1698443776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698443776}}]},{"address":{"type":"absolute","value":1698444080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444143}},{"address":{"type":"absolute","value":1698444194}},{"address":{"type":"absolute","value":1698444254}},{"address":{"type":"absolute","value":1698444288}},{"address":{"type":"absolute","value":1698444336}},{"address":{"type":"absolute","value":1698444384}}]},{"address":{"type":"absolute","value":1698444496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444496}}]},{"address":{"type":"absolute","value":1698444640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1698444688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444688}}]},{"address":{"type":"absolute","value":1698444832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444832}}]},{"address":{"type":"absolute","value":1698444880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}}]},{"address":{"type":"absolute","value":1698444944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445007}},{"address":{"type":"absolute","value":1698445045}},{"address":{"type":"absolute","value":1698445066}},{"address":{"type":"absolute","value":1698445084}},{"address":{"type":"absolute","value":1698445152}}]},{"address":{"type":"absolute","value":1698445344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445007}},{"address":{"type":"absolute","value":1698445045}},{"address":{"type":"absolute","value":1698445066}},{"address":{"type":"absolute","value":1698445084}},{"address":{"type":"absolute","value":1698445152}}]},{"address":{"type":"absolute","value":1698445376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}}]},{"address":{"type":"absolute","value":1698445728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698445941}},{"address":{"type":"absolute","value":1698445992}},{"address":{"type":"absolute","value":1698446144}},{"address":{"type":"absolute","value":1698446174}},{"address":{"type":"absolute","value":1698446208}},{"address":{"type":"absolute","value":1698446245}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698446304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698446409}},{"address":{"type":"absolute","value":1698446443}},{"address":{"type":"absolute","value":1698446544}},{"address":{"type":"absolute","value":1698446579}},{"address":{"type":"absolute","value":1698446609}},{"address":{"type":"absolute","value":1698446637}},{"address":{"type":"absolute","value":1698446674}},{"address":{"type":"absolute","value":1698446722}}]},{"address":{"type":"absolute","value":1698446864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698446864}},{"address":{"type":"absolute","value":1698446928}},{"address":{"type":"absolute","value":1698446960}}]},{"address":{"type":"absolute","value":1698447040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447084}},{"address":{"type":"absolute","value":1698447184}},{"address":{"type":"absolute","value":1698447265}},{"address":{"type":"absolute","value":1698447312}},{"address":{"type":"absolute","value":1698447338}},{"address":{"type":"absolute","value":1698447360}}]},{"address":{"type":"absolute","value":1698447424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447424}},{"address":{"type":"absolute","value":1698447534}}]},{"address":{"type":"absolute","value":1698447600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447648}},{"address":{"type":"absolute","value":1698447743}}]},{"address":{"type":"absolute","value":1698447808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698447888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447929}}]},{"address":{"type":"absolute","value":1698448032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448046}},{"address":{"type":"absolute","value":1698448064}},{"address":{"type":"absolute","value":1698474036}},{"address":{"type":"absolute","value":1698474064}}]},{"address":{"type":"absolute","value":1698448080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448186}},{"address":{"type":"absolute","value":1698448214}}]},{"address":{"type":"absolute","value":1698448288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698448816}},{"address":{"type":"absolute","value":1698448910}},{"address":{"type":"absolute","value":1698448995}},{"address":{"type":"absolute","value":1698449162}},{"address":{"type":"absolute","value":1698449232}},{"address":{"type":"absolute","value":1698449280}}]},{"address":{"type":"absolute","value":1698449552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698449552}},{"address":{"type":"absolute","value":1698449573}},{"address":{"type":"absolute","value":1698449605}}]},{"address":{"type":"absolute","value":1698451312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451356}}]},{"address":{"type":"absolute","value":1698451424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698451460}},{"address":{"type":"absolute","value":1698451488}}]},{"address":{"type":"absolute","value":1698451520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451520}}]},{"address":{"type":"absolute","value":1698451568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451568}}]},{"address":{"type":"absolute","value":1698451616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451649}},{"address":{"type":"absolute","value":1698451683}},{"address":{"type":"absolute","value":1698451696}},{"address":{"type":"absolute","value":1698470480}}]},{"address":{"type":"absolute","value":1698451728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451773}},{"address":{"type":"absolute","value":1698451818}}]},{"address":{"type":"absolute","value":1698451872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447929}}]},{"address":{"type":"absolute","value":1698451888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698451920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452003}},{"address":{"type":"absolute","value":1698452016}}]},{"address":{"type":"absolute","value":1698452048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452134}},{"address":{"type":"absolute","value":1698452144}}]},{"address":{"type":"absolute","value":1698452176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698451773}},{"address":{"type":"absolute","value":1698451818}}]},{"address":{"type":"absolute","value":1698452192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452280}}]},{"address":{"type":"absolute","value":1698452320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452357}},{"address":{"type":"absolute","value":1698452415}}]},{"address":{"type":"absolute","value":1698452448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452542}}]},{"address":{"type":"absolute","value":1698452592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452625}}]},{"address":{"type":"absolute","value":1698452688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452721}}]},{"address":{"type":"absolute","value":1698452784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698452892}}]},{"address":{"type":"absolute","value":1698453024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453050}}]},{"address":{"type":"absolute","value":1698453072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453072}}]},{"address":{"type":"absolute","value":1698453136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453241}},{"address":{"type":"absolute","value":1698453270}},{"address":{"type":"absolute","value":1698453296}}]},{"address":{"type":"absolute","value":1698453312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453312}}]},{"address":{"type":"absolute","value":1698453344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453424}},{"address":{"type":"absolute","value":1698453456}},{"address":{"type":"absolute","value":1698453475}},{"address":{"type":"absolute","value":1698453650}},{"address":{"type":"absolute","value":1698453664}},{"address":{"type":"absolute","value":1698453706}},{"address":{"type":"absolute","value":1698453709}},{"address":{"type":"absolute","value":1698453740}},{"address":{"type":"absolute","value":1698453745}},{"address":{"type":"absolute","value":1698453760}}]},{"address":{"type":"absolute","value":1698453792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453792}},{"address":{"type":"absolute","value":1698453851}},{"address":{"type":"absolute","value":1698453875}},{"address":{"type":"absolute","value":1698453888}},{"address":{"type":"absolute","value":1698453904}}]},{"address":{"type":"absolute","value":1698453936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444925}},{"address":{"type":"absolute","value":1698454046}},{"address":{"type":"absolute","value":1698454164}},{"address":{"type":"absolute","value":1698454217}},{"address":{"type":"absolute","value":1698454384}},{"address":{"type":"absolute","value":1698454468}}]},{"address":{"type":"absolute","value":1698454496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698454547}},{"address":{"type":"absolute","value":1698454561}},{"address":{"type":"absolute","value":1698454564}},{"address":{"type":"absolute","value":1698454576}},{"address":{"type":"absolute","value":1698454608}},{"address":{"type":"absolute","value":1698454643}}]},{"address":{"type":"absolute","value":1698454672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}}]},{"address":{"type":"absolute","value":1698454736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454803}},{"address":{"type":"absolute","value":1698454976}},{"address":{"type":"absolute","value":1698455008}},{"address":{"type":"absolute","value":1698455044}},{"address":{"type":"absolute","value":1698455209}},{"address":{"type":"absolute","value":1698455251}},{"address":{"type":"absolute","value":1698455262}},{"address":{"type":"absolute","value":1698455297}},{"address":{"type":"absolute","value":1698455457}},{"address":{"type":"absolute","value":1698455561}},{"address":{"type":"absolute","value":1698455744}},{"address":{"type":"absolute","value":1698456017}},{"address":{"type":"absolute","value":1698456080}},{"address":{"type":"absolute","value":1698456179}},{"address":{"type":"absolute","value":1698456263}},{"address":{"type":"absolute","value":1698456320}},{"address":{"type":"absolute","value":1698456334}},{"address":{"type":"absolute","value":1698456594}},{"address":{"type":"absolute","value":1698456652}},{"address":{"type":"absolute","value":1698456792}},{"address":{"type":"absolute","value":1698456859}},{"address":{"type":"absolute","value":1698457084}},{"address":{"type":"absolute","value":1698457148}},{"address":{"type":"absolute","value":1698457184}},{"address":{"type":"absolute","value":1698457279}},{"address":{"type":"absolute","value":1698457410}},{"address":{"type":"absolute","value":1698457542}},{"address":{"type":"absolute","value":1698457636}},{"address":{"type":"absolute","value":1698457783}},{"address":{"type":"absolute","value":1698457805}},{"address":{"type":"absolute","value":1698457998}},{"address":{"type":"absolute","value":1698458116}},{"address":{"type":"absolute","value":1698458147}},{"address":{"type":"absolute","value":1698458197}},{"address":{"type":"absolute","value":1698458301}},{"address":{"type":"absolute","value":1698458438}},{"address":{"type":"absolute","value":1698458531}},{"address":{"type":"absolute","value":1698458552}},{"address":{"type":"absolute","value":1698458649}},{"address":{"type":"absolute","value":1698458709}},{"address":{"type":"absolute","value":1698458800}},{"address":{"type":"absolute","value":1698458863}},{"address":{"type":"absolute","value":1698458891}},{"address":{"type":"absolute","value":1698458943}},{"address":{"type":"absolute","value":1698459057}},{"address":{"type":"absolute","value":1698459340}},{"address":{"type":"absolute","value":1698459530}},{"address":{"type":"absolute","value":1698459577}},{"address":{"type":"absolute","value":1698459627}},{"address":{"type":"absolute","value":1698459712}},{"address":{"type":"absolute","value":1698459740}},{"address":{"type":"absolute","value":1698459771}},{"address":{"type":"absolute","value":1698459827}},{"address":{"type":"absolute","value":1698459866}},{"address":{"type":"absolute","value":1698459898}},{"address":{"type":"absolute","value":1698459982}},{"address":{"type":"absolute","value":1698460082}},{"address":{"type":"absolute","value":1698460340}},{"address":{"type":"absolute","value":1698460390}},{"address":{"type":"absolute","value":1698460648}}]},{"address":{"type":"absolute","value":1698460704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698460704}}]},{"address":{"type":"absolute","value":1698460768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698461184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461208}},{"address":{"type":"absolute","value":1698461232}},{"address":{"type":"absolute","value":1698461303}},{"address":{"type":"absolute","value":1698461320}},{"address":{"type":"absolute","value":1698461365}},{"address":{"type":"absolute","value":1698461408}},{"address":{"type":"absolute","value":1698461424}}]},{"address":{"type":"absolute","value":1698461648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461700}},{"address":{"type":"absolute","value":1698461708}},{"address":{"type":"absolute","value":1698461760}},{"address":{"type":"absolute","value":1698461794}},{"address":{"type":"absolute","value":1698461827}},{"address":{"type":"absolute","value":1698461872}},{"address":{"type":"absolute","value":1698461881}},{"address":{"type":"absolute","value":1698461914}}]},{"address":{"type":"absolute","value":1698461984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462021}},{"address":{"type":"absolute","value":1698462048}},{"address":{"type":"absolute","value":1698462080}}]},{"address":{"type":"absolute","value":1698462112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698462144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698460871}},{"address":{"type":"absolute","value":1698460896}},{"address":{"type":"absolute","value":1698460992}},{"address":{"type":"absolute","value":1698461014}},{"address":{"type":"absolute","value":1698461041}},{"address":{"type":"absolute","value":1698461074}},{"address":{"type":"absolute","value":1698461109}}]},{"address":{"type":"absolute","value":1698462176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698453241}},{"address":{"type":"absolute","value":1698453270}},{"address":{"type":"absolute","value":1698453296}}]},{"address":{"type":"absolute","value":1698462192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462278}}]},{"address":{"type":"absolute","value":1698462304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462346}},{"address":{"type":"absolute","value":1698462389}}]},{"address":{"type":"absolute","value":1698462416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462416}},{"address":{"type":"absolute","value":1698462495}},{"address":{"type":"absolute","value":1698462530}}]},{"address":{"type":"absolute","value":1698462624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698454692}},{"address":{"type":"absolute","value":1698454710}},{"address":{"type":"absolute","value":1698461208}},{"address":{"type":"absolute","value":1698461232}},{"address":{"type":"absolute","value":1698461303}},{"address":{"type":"absolute","value":1698461320}},{"address":{"type":"absolute","value":1698461365}},{"address":{"type":"absolute","value":1698461408}},{"address":{"type":"absolute","value":1698461424}}]},{"address":{"type":"absolute","value":1698462656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462705}}]},{"address":{"type":"absolute","value":1698462736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462736}}]},{"address":{"type":"absolute","value":1698462832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462832}}]},{"address":{"type":"absolute","value":1698462912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462912}}]},{"address":{"type":"absolute","value":1698462992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698462992}}]},{"address":{"type":"absolute","value":1698463024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698463210}},{"address":{"type":"absolute","value":1698463306}},{"address":{"type":"absolute","value":1698463319}},{"address":{"type":"absolute","value":1698463364}},{"address":{"type":"absolute","value":1698463479}},{"address":{"type":"absolute","value":1698463531}},{"address":{"type":"absolute","value":1698463586}},{"address":{"type":"absolute","value":1698463669}},{"address":{"type":"absolute","value":1698463772}},{"address":{"type":"absolute","value":1698463795}},{"address":{"type":"absolute","value":1698463858}},{"address":{"type":"absolute","value":1698463920}},{"address":{"type":"absolute","value":1698464016}},{"address":{"type":"absolute","value":1698464064}},{"address":{"type":"absolute","value":1698464080}},{"address":{"type":"absolute","value":1698464152}},{"address":{"type":"absolute","value":1698464170}},{"address":{"type":"absolute","value":1698464188}},{"address":{"type":"absolute","value":1698464230}},{"address":{"type":"absolute","value":1698464260}},{"address":{"type":"absolute","value":1698464293}},{"address":{"type":"absolute","value":1698464344}},{"address":{"type":"absolute","value":1698464370}},{"address":{"type":"absolute","value":1698464390}},{"address":{"type":"absolute","value":1698464471}},{"address":{"type":"absolute","value":1698464485}}]},{"address":{"type":"absolute","value":1698464512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698464583}},{"address":{"type":"absolute","value":1698464636}},{"address":{"type":"absolute","value":1698464737}},{"address":{"type":"absolute","value":1698464761}},{"address":{"type":"absolute","value":1698464832}},{"address":{"type":"absolute","value":1698464848}}]},{"address":{"type":"absolute","value":1698465008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698465205}},{"address":{"type":"absolute","value":1698465216}}]},{"address":{"type":"absolute","value":1698465264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698465402}},{"address":{"type":"absolute","value":1698465411}},{"address":{"type":"absolute","value":1698465474}},{"address":{"type":"absolute","value":1698465840}},{"address":{"type":"absolute","value":1698465913}},{"address":{"type":"absolute","value":1698466220}},{"address":{"type":"absolute","value":1698466374}},{"address":{"type":"absolute","value":1698466464}}]},{"address":{"type":"absolute","value":1698466688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698466688}}]},{"address":{"type":"absolute","value":1698466720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698466771}},{"address":{"type":"absolute","value":1698466844}},{"address":{"type":"absolute","value":1698466854}},{"address":{"type":"absolute","value":1698466899}},{"address":{"type":"absolute","value":1698466907}}]},{"address":{"type":"absolute","value":1698467072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467108}},{"address":{"type":"absolute","value":1698467136}},{"address":{"type":"absolute","value":1698467232}},{"address":{"type":"absolute","value":1698467315}}]},{"address":{"type":"absolute","value":1698467408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467408}},{"address":{"type":"absolute","value":1698467461}}]},{"address":{"type":"absolute","value":1698467520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467557}},{"address":{"type":"absolute","value":1698467582}},{"address":{"type":"absolute","value":1698467588}}]},{"address":{"type":"absolute","value":1698467616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467653}},{"address":{"type":"absolute","value":1698467678}},{"address":{"type":"absolute","value":1698467684}},{"address":{"type":"absolute","value":1698470176}}]},{"address":{"type":"absolute","value":1698467712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467408}},{"address":{"type":"absolute","value":1698467461}}]},{"address":{"type":"absolute","value":1698467744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467788}},{"address":{"type":"absolute","value":1698467803}}]},{"address":{"type":"absolute","value":1698467824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698467557}},{"address":{"type":"absolute","value":1698467582}},{"address":{"type":"absolute","value":1698467588}},{"address":{"type":"absolute","value":1698467971}},{"address":{"type":"absolute","value":1698467994}},{"address":{"type":"absolute","value":1698468018}},{"address":{"type":"absolute","value":1698468067}},{"address":{"type":"absolute","value":1698470304}},{"address":{"type":"absolute","value":1698470341}}]},{"address":{"type":"absolute","value":1698468096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698468128}},{"address":{"type":"absolute","value":1698468199}},{"address":{"type":"absolute","value":1698468220}},{"address":{"type":"absolute","value":1698468240}},{"address":{"type":"absolute","value":1698468282}}]},{"address":{"type":"absolute","value":1698468304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698468321}},{"address":{"type":"absolute","value":1698468345}},{"address":{"type":"absolute","value":1698468394}},{"address":{"type":"absolute","value":1698468414}},{"address":{"type":"absolute","value":1698468469}},{"address":{"type":"absolute","value":1698468482}}]},{"address":{"type":"absolute","value":1698468496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698468537}},{"address":{"type":"absolute","value":1698468597}},{"address":{"type":"absolute","value":1698468621}},{"address":{"type":"absolute","value":1698468624}},{"address":{"type":"absolute","value":1698468675}},{"address":{"type":"absolute","value":1698468699}},{"address":{"type":"absolute","value":1698468704}},{"address":{"type":"absolute","value":1698468755}},{"address":{"type":"absolute","value":1698468779}},{"address":{"type":"absolute","value":1698468784}},{"address":{"type":"absolute","value":1698468832}},{"address":{"type":"absolute","value":1698468860}},{"address":{"type":"absolute","value":1698468864}},{"address":{"type":"absolute","value":1698468890}},{"address":{"type":"absolute","value":1698468927}}]},{"address":{"type":"absolute","value":1698469008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698469008}}]},{"address":{"type":"absolute","value":1698469040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444688}},{"address":{"type":"absolute","value":1698469095}},{"address":{"type":"absolute","value":1698469120}}]},{"address":{"type":"absolute","value":1698469184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698469280}},{"address":{"type":"absolute","value":1698469328}},{"address":{"type":"absolute","value":1698469332}},{"address":{"type":"absolute","value":1698469344}},{"address":{"type":"absolute","value":1698469538}},{"address":{"type":"absolute","value":1698469545}}]},{"address":{"type":"absolute","value":1698469776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698469776}}]},{"address":{"type":"absolute","value":1698469856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698469856}},{"address":{"type":"absolute","value":1698469933}}]},{"address":{"type":"absolute","value":1698469984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470028}},{"address":{"type":"absolute","value":1698470070}}]},{"address":{"type":"absolute","value":1698470096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470129}}]},{"address":{"type":"absolute","value":1698470176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470176}}]},{"address":{"type":"absolute","value":1698470240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470293}}]},{"address":{"type":"absolute","value":1698470304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470304}},{"address":{"type":"absolute","value":1698470341}}]},{"address":{"type":"absolute","value":1698470448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470480}}]},{"address":{"type":"absolute","value":1698470512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698470619}},{"address":{"type":"absolute","value":1698470624}},{"address":{"type":"absolute","value":1698470664}},{"address":{"type":"absolute","value":1698470672}},{"address":{"type":"absolute","value":1698470715}},{"address":{"type":"absolute","value":1698470720}},{"address":{"type":"absolute","value":1698470768}},{"address":{"type":"absolute","value":1698470833}},{"address":{"type":"absolute","value":1698470896}},{"address":{"type":"absolute","value":1698470944}},{"address":{"type":"absolute","value":1698470992}},{"address":{"type":"absolute","value":1698471040}}]},{"address":{"type":"absolute","value":1698471072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471192}},{"address":{"type":"absolute","value":1698471207}},{"address":{"type":"absolute","value":1698471225}},{"address":{"type":"absolute","value":1698471285}},{"address":{"type":"absolute","value":1698471314}}]},{"address":{"type":"absolute","value":1698471344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471360}}]},{"address":{"type":"absolute","value":1698471392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471412}}]},{"address":{"type":"absolute","value":1698471456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471476}}]},{"address":{"type":"absolute","value":1698471520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471762}},{"address":{"type":"absolute","value":1698471808}}]},{"address":{"type":"absolute","value":1698472064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472097}}]},{"address":{"type":"absolute","value":1698472112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472132}},{"address":{"type":"absolute","value":1698472144}}]},{"address":{"type":"absolute","value":1698472176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472196}},{"address":{"type":"absolute","value":1698472208}}]},{"address":{"type":"absolute","value":1698472288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698472288}},{"address":{"type":"absolute","value":1698472317}},{"address":{"type":"absolute","value":1698472531}},{"address":{"type":"absolute","value":1698472764}},{"address":{"type":"absolute","value":1698472820}}]},{"address":{"type":"absolute","value":1698473280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698473312}},{"address":{"type":"absolute","value":1698473361}},{"address":{"type":"absolute","value":1698473408}},{"address":{"type":"absolute","value":1698473452}},{"address":{"type":"absolute","value":1698473488}},{"address":{"type":"absolute","value":1698473535}},{"address":{"type":"absolute","value":1698473579}},{"address":{"type":"absolute","value":1698473636}},{"address":{"type":"absolute","value":1698473796}},{"address":{"type":"absolute","value":1698473892}},{"address":{"type":"absolute","value":1698473920}},{"address":{"type":"absolute","value":1698473952}}]},{"address":{"type":"absolute","value":1698474016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698474036}},{"address":{"type":"absolute","value":1698474064}}]},{"address":{"type":"absolute","value":1698474112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698471476}},{"address":{"type":"absolute","value":1698474159}},{"address":{"type":"absolute","value":1698474179}},{"address":{"type":"absolute","value":1698474192}}]},{"address":{"type":"absolute","value":1698474336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698474376}},{"address":{"type":"absolute","value":1698474472}}]},{"address":{"type":"absolute","value":1698474496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698474628}},{"address":{"type":"absolute","value":1698474722}},{"address":{"type":"absolute","value":1698474800}},{"address":{"type":"absolute","value":1698474909}}]},{"address":{"type":"absolute","value":1698475088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698475088}},{"address":{"type":"absolute","value":1698475173}},{"address":{"type":"absolute","value":1698475232}},{"address":{"type":"absolute","value":1698475264}},{"address":{"type":"absolute","value":1698475337}},{"address":{"type":"absolute","value":1698475393}},{"address":{"type":"absolute","value":1698475422}},{"address":{"type":"absolute","value":1698475535}}]},{"address":{"type":"absolute","value":1698475616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698475621}},{"address":{"type":"absolute","value":1698475648}}]},{"address":{"type":"absolute","value":1698475680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698475760}},{"address":{"type":"absolute","value":1698475769}},{"address":{"type":"absolute","value":1698475802}},{"address":{"type":"absolute","value":1698475872}},{"address":{"type":"absolute","value":1698475910}},{"address":{"type":"absolute","value":1698475940}},{"address":{"type":"absolute","value":1698475970}},{"address":{"type":"absolute","value":1698475984}}]},{"address":{"type":"absolute","value":1698476064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698476064}},{"address":{"type":"absolute","value":1698476159}},{"address":{"type":"absolute","value":1698476180}},{"address":{"type":"absolute","value":1698476199}},{"address":{"type":"absolute","value":1698476320}}]},{"address":{"type":"absolute","value":1698476416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698476722}},{"address":{"type":"absolute","value":1698476741}},{"address":{"type":"absolute","value":1698476768}},{"address":{"type":"absolute","value":1698476785}}]},{"address":{"type":"absolute","value":1698476928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698476959}},{"address":{"type":"absolute","value":1698476979}}]},{"address":{"type":"absolute","value":1698477120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477120}},{"address":{"type":"absolute","value":1698477341}}]},{"address":{"type":"absolute","value":1698477472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477472}},{"address":{"type":"absolute","value":1698477485}},{"address":{"type":"absolute","value":1698477537}}]},{"address":{"type":"absolute","value":1698477568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477616}}]},{"address":{"type":"absolute","value":1698477648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477686}},{"address":{"type":"absolute","value":1698477705}}]},{"address":{"type":"absolute","value":1698477728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698477792}},{"address":{"type":"absolute","value":1698477808}}]},{"address":{"type":"absolute","value":1698477840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698477979}},{"address":{"type":"absolute","value":1698478073}},{"address":{"type":"absolute","value":1698478173}},{"address":{"type":"absolute","value":1698478192}},{"address":{"type":"absolute","value":1698478368}},{"address":{"type":"absolute","value":1698478475}}]},{"address":{"type":"absolute","value":1698478560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698478611}},{"address":{"type":"absolute","value":1698478643}},{"address":{"type":"absolute","value":1698478658}},{"address":{"type":"absolute","value":1698478680}},{"address":{"type":"absolute","value":1698478688}},{"address":{"type":"absolute","value":1698478736}},{"address":{"type":"absolute","value":1698478770}}]},{"address":{"type":"absolute","value":1698478848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698478848}},{"address":{"type":"absolute","value":1698478944}},{"address":{"type":"absolute","value":1698478982}}]},{"address":{"type":"absolute","value":1698479024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479064}},{"address":{"type":"absolute","value":1698479076}}]},{"address":{"type":"absolute","value":1698479136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479176}},{"address":{"type":"absolute","value":1698479188}}]},{"address":{"type":"absolute","value":1698479248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479276}},{"address":{"type":"absolute","value":1698479340}},{"address":{"type":"absolute","value":1698479353}},{"address":{"type":"absolute","value":1698479364}},{"address":{"type":"absolute","value":1698479388}}]},{"address":{"type":"absolute","value":1698479408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479432}},{"address":{"type":"absolute","value":1698479441}}]},{"address":{"type":"absolute","value":1698479456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479492}}]},{"address":{"type":"absolute","value":1698479536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698479604}},{"address":{"type":"absolute","value":1698479645}},{"address":{"type":"absolute","value":1698480059}},{"address":{"type":"absolute","value":1698480078}},{"address":{"type":"absolute","value":1698480150}},{"address":{"type":"absolute","value":1698480213}},{"address":{"type":"absolute","value":1698480480}}]},{"address":{"type":"absolute","value":1698480768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698480768}},{"address":{"type":"absolute","value":1698480801}},{"address":{"type":"absolute","value":1698480832}}]},{"address":{"type":"absolute","value":1698480848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698480912}},{"address":{"type":"absolute","value":1698480924}},{"address":{"type":"absolute","value":1698480960}},{"address":{"type":"absolute","value":1698480992}}]},{"address":{"type":"absolute","value":1698481024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698481230}},{"address":{"type":"absolute","value":1698481456}}]},{"address":{"type":"absolute","value":1698482016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482103}},{"address":{"type":"absolute","value":1698482165}},{"address":{"type":"absolute","value":1698482315}},{"address":{"type":"absolute","value":1698482352}},{"address":{"type":"absolute","value":1698482361}},{"address":{"type":"absolute","value":1698482400}},{"address":{"type":"absolute","value":1698482432}},{"address":{"type":"absolute","value":1698482464}},{"address":{"type":"absolute","value":1698482528}},{"address":{"type":"absolute","value":1698482560}},{"address":{"type":"absolute","value":1698482592}},{"address":{"type":"absolute","value":1698482624}},{"address":{"type":"absolute","value":1698482656}},{"address":{"type":"absolute","value":1698487168}},{"address":{"type":"absolute","value":1698487436}},{"address":{"type":"absolute","value":1698487466}},{"address":{"type":"absolute","value":1698487535}},{"address":{"type":"absolute","value":1698487632}},{"address":{"type":"absolute","value":1698487671}},{"address":{"type":"absolute","value":1698487680}},{"address":{"type":"absolute","value":1698487729}},{"address":{"type":"absolute","value":1698487749}},{"address":{"type":"absolute","value":1698487797}},{"address":{"type":"absolute","value":1698487837}},{"address":{"type":"absolute","value":1698487884}},{"address":{"type":"absolute","value":1698488032}},{"address":{"type":"absolute","value":1698488081}},{"address":{"type":"absolute","value":1698488098}},{"address":{"type":"absolute","value":1698488240}},{"address":{"type":"absolute","value":1698488297}},{"address":{"type":"absolute","value":1698488320}},{"address":{"type":"absolute","value":1698488392}},{"address":{"type":"absolute","value":1698489552}},{"address":{"type":"absolute","value":1698489706}},{"address":{"type":"absolute","value":1698489760}},{"address":{"type":"absolute","value":1698489872}},{"address":{"type":"absolute","value":1698489915}},{"address":{"type":"absolute","value":1698489933}},{"address":{"type":"absolute","value":1698490018}},{"address":{"type":"absolute","value":1698490054}},{"address":{"type":"absolute","value":1698490080}},{"address":{"type":"absolute","value":1698490114}},{"address":{"type":"absolute","value":1698490161}},{"address":{"type":"absolute","value":1698490225}},{"address":{"type":"absolute","value":1698490273}},{"address":{"type":"absolute","value":1698490301}},{"address":{"type":"absolute","value":1698490336}},{"address":{"type":"absolute","value":1698490366}},{"address":{"type":"absolute","value":1698490400}},{"address":{"type":"absolute","value":1698490435}},{"address":{"type":"absolute","value":1698490463}},{"address":{"type":"absolute","value":1698490484}},{"address":{"type":"absolute","value":1698490800}},{"address":{"type":"absolute","value":1698490856}},{"address":{"type":"absolute","value":1698490977}},{"address":{"type":"absolute","value":1698490993}},{"address":{"type":"absolute","value":1698491020}},{"address":{"type":"absolute","value":1698491056}},{"address":{"type":"absolute","value":1698491264}},{"address":{"type":"absolute","value":1698491293}},{"address":{"type":"absolute","value":1698491321}},{"address":{"type":"absolute","value":1698491379}},{"address":{"type":"absolute","value":1698491477}},{"address":{"type":"absolute","value":1698491525}},{"address":{"type":"absolute","value":1698491586}},{"address":{"type":"absolute","value":1698491608}},{"address":{"type":"absolute","value":1698491632}},{"address":{"type":"absolute","value":1698491654}},{"address":{"type":"absolute","value":1698491717}},{"address":{"type":"absolute","value":1698491764}},{"address":{"type":"absolute","value":1698491786}},{"address":{"type":"absolute","value":1698491808}},{"address":{"type":"absolute","value":1698491888}},{"address":{"type":"absolute","value":1698492007}},{"address":{"type":"absolute","value":1698492064}},{"address":{"type":"absolute","value":1698492085}},{"address":{"type":"absolute","value":1698492112}},{"address":{"type":"absolute","value":1698492134}},{"address":{"type":"absolute","value":1698492169}},{"address":{"type":"absolute","value":1698492336}},{"address":{"type":"absolute","value":1698492384}},{"address":{"type":"absolute","value":1698492448}},{"address":{"type":"absolute","value":1698492469}},{"address":{"type":"absolute","value":1698492496}},{"address":{"type":"absolute","value":1698492518}},{"address":{"type":"absolute","value":1698492574}},{"address":{"type":"absolute","value":1698492651}},{"address":{"type":"absolute","value":1698493136}},{"address":{"type":"absolute","value":1698493189}},{"address":{"type":"absolute","value":1698493238}},{"address":{"type":"absolute","value":1698493312}},{"address":{"type":"absolute","value":1698493415}},{"address":{"type":"absolute","value":1698493430}},{"address":{"type":"absolute","value":1698493439}},{"address":{"type":"absolute","value":1698493485}},{"address":{"type":"absolute","value":1698493524}},{"address":{"type":"absolute","value":1698493545}},{"address":{"type":"absolute","value":1698493564}},{"address":{"type":"absolute","value":1698495744}},{"address":{"type":"absolute","value":1698495798}},{"address":{"type":"absolute","value":1698495870}},{"address":{"type":"absolute","value":1698497984}},{"address":{"type":"absolute","value":1698498023}},{"address":{"type":"absolute","value":1698498091}},{"address":{"type":"absolute","value":1698498183}},{"address":{"type":"absolute","value":1698501104}},{"address":{"type":"absolute","value":1698501212}},{"address":{"type":"absolute","value":1698501221}},{"address":{"type":"absolute","value":1698501225}},{"address":{"type":"absolute","value":1698501265}},{"address":{"type":"absolute","value":1698501294}},{"address":{"type":"absolute","value":1698501317}},{"address":{"type":"absolute","value":1698501333}},{"address":{"type":"absolute","value":1698501349}},{"address":{"type":"absolute","value":1698501425}},{"address":{"type":"absolute","value":1698501441}},{"address":{"type":"absolute","value":1698501457}},{"address":{"type":"absolute","value":1698505216}},{"address":{"type":"absolute","value":1698505273}},{"address":{"type":"absolute","value":1698505294}},{"address":{"type":"absolute","value":1698505312}},{"address":{"type":"absolute","value":1698505364}},{"address":{"type":"absolute","value":1698505425}},{"address":{"type":"absolute","value":1698505454}},{"address":{"type":"absolute","value":1698510560}}]},{"address":{"type":"absolute","value":1698482784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}}]},{"address":{"type":"absolute","value":1698483136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483136}},{"address":{"type":"absolute","value":1698483175}},{"address":{"type":"absolute","value":1698483205}},{"address":{"type":"absolute","value":1698483220}},{"address":{"type":"absolute","value":1698483263}},{"address":{"type":"absolute","value":1698483280}},{"address":{"type":"absolute","value":1698483392}},{"address":{"type":"absolute","value":1698494236}},{"address":{"type":"absolute","value":1698494511}},{"address":{"type":"absolute","value":1698494528}},{"address":{"type":"absolute","value":1698500538}},{"address":{"type":"absolute","value":1698500606}},{"address":{"type":"absolute","value":1698500672}},{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}},{"address":{"type":"absolute","value":1698508461}},{"address":{"type":"absolute","value":1698508672}},{"address":{"type":"absolute","value":1698508745}},{"address":{"type":"absolute","value":1698508773}},{"address":{"type":"absolute","value":1698508783}},{"address":{"type":"absolute","value":1698508788}},{"address":{"type":"absolute","value":1698508806}},{"address":{"type":"absolute","value":1698508950}},{"address":{"type":"absolute","value":1698508994}},{"address":{"type":"absolute","value":1698509200}},{"address":{"type":"absolute","value":1698509218}},{"address":{"type":"absolute","value":1698509257}},{"address":{"type":"absolute","value":1698509272}}]},{"address":{"type":"absolute","value":1698483440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483476}},{"address":{"type":"absolute","value":1698483488}},{"address":{"type":"absolute","value":1698483523}}]},{"address":{"type":"absolute","value":1698483568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483598}},{"address":{"type":"absolute","value":1698483603}},{"address":{"type":"absolute","value":1698483632}}]},{"address":{"type":"absolute","value":1698483648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483648}},{"address":{"type":"absolute","value":1698483674}},{"address":{"type":"absolute","value":1698483693}},{"address":{"type":"absolute","value":1698483712}},{"address":{"type":"absolute","value":1698483728}},{"address":{"type":"absolute","value":1698483744}},{"address":{"type":"absolute","value":1698483776}},{"address":{"type":"absolute","value":1698495116}},{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}},{"address":{"type":"absolute","value":1698501536}},{"address":{"type":"absolute","value":1698501623}},{"address":{"type":"absolute","value":1698501628}},{"address":{"type":"absolute","value":1698501666}},{"address":{"type":"absolute","value":1698501713}},{"address":{"type":"absolute","value":1698504656}},{"address":{"type":"absolute","value":1698504708}},{"address":{"type":"absolute","value":1698504717}},{"address":{"type":"absolute","value":1698504769}},{"address":{"type":"absolute","value":1698504780}},{"address":{"type":"absolute","value":1698504792}},{"address":{"type":"absolute","value":1698504800}},{"address":{"type":"absolute","value":1698504839}},{"address":{"type":"absolute","value":1698509296}},{"address":{"type":"absolute","value":1698509336}},{"address":{"type":"absolute","value":1698509414}},{"address":{"type":"absolute","value":1698509478}},{"address":{"type":"absolute","value":1698509518}},{"address":{"type":"absolute","value":1698509555}},{"address":{"type":"absolute","value":1698509699}},{"address":{"type":"absolute","value":1698509765}},{"address":{"type":"absolute","value":1698509824}},{"address":{"type":"absolute","value":1698509856}},{"address":{"type":"absolute","value":1698509869}},{"address":{"type":"absolute","value":1698509942}},{"address":{"type":"absolute","value":1698510121}},{"address":{"type":"absolute","value":1698510387}},{"address":{"type":"absolute","value":1698510426}},{"address":{"type":"absolute","value":1698510448}},{"address":{"type":"absolute","value":1698510457}}]},{"address":{"type":"absolute","value":1698483792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483792}},{"address":{"type":"absolute","value":1698483818}},{"address":{"type":"absolute","value":1698483837}},{"address":{"type":"absolute","value":1698483856}},{"address":{"type":"absolute","value":1698483872}},{"address":{"type":"absolute","value":1698483888}},{"address":{"type":"absolute","value":1698483920}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510608}},{"address":{"type":"absolute","value":1698510688}},{"address":{"type":"absolute","value":1698510800}}]},{"address":{"type":"absolute","value":1698483936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483936}},{"address":{"type":"absolute","value":1698483962}},{"address":{"type":"absolute","value":1698483981}},{"address":{"type":"absolute","value":1698484000}},{"address":{"type":"absolute","value":1698484016}},{"address":{"type":"absolute","value":1698484032}},{"address":{"type":"absolute","value":1698484064}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510928}},{"address":{"type":"absolute","value":1698510984}},{"address":{"type":"absolute","value":1698510993}}]},{"address":{"type":"absolute","value":1698484080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698484080}},{"address":{"type":"absolute","value":1698484102}},{"address":{"type":"absolute","value":1698484536}}]},{"address":{"type":"absolute","value":1698485696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698485696}},{"address":{"type":"absolute","value":1698485720}},{"address":{"type":"absolute","value":1698485785}},{"address":{"type":"absolute","value":1698485844}},{"address":{"type":"absolute","value":1698485920}}]},{"address":{"type":"absolute","value":1698485952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698485952}}]},{"address":{"type":"absolute","value":1698486000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486000}}]},{"address":{"type":"absolute","value":1698486048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486096}},{"address":{"type":"absolute","value":1698486109}},{"address":{"type":"absolute","value":1698486128}}]},{"address":{"type":"absolute","value":1698486144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486196}},{"address":{"type":"absolute","value":1698486220}},{"address":{"type":"absolute","value":1698486271}},{"address":{"type":"absolute","value":1698486316}}]},{"address":{"type":"absolute","value":1698486368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698486368}},{"address":{"type":"absolute","value":1698486528}},{"address":{"type":"absolute","value":1698486674}},{"address":{"type":"absolute","value":1698486680}},{"address":{"type":"absolute","value":1698486705}},{"address":{"type":"absolute","value":1698486743}},{"address":{"type":"absolute","value":1698486832}},{"address":{"type":"absolute","value":1698486854}},{"address":{"type":"absolute","value":1698486930}},{"address":{"type":"absolute","value":1698486958}},{"address":{"type":"absolute","value":1698487013}}]},{"address":{"type":"absolute","value":1698487168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698487168}},{"address":{"type":"absolute","value":1698487436}},{"address":{"type":"absolute","value":1698487466}},{"address":{"type":"absolute","value":1698487535}},{"address":{"type":"absolute","value":1698487632}},{"address":{"type":"absolute","value":1698487671}},{"address":{"type":"absolute","value":1698487680}},{"address":{"type":"absolute","value":1698487729}},{"address":{"type":"absolute","value":1698487749}},{"address":{"type":"absolute","value":1698487797}},{"address":{"type":"absolute","value":1698487837}},{"address":{"type":"absolute","value":1698487884}},{"address":{"type":"absolute","value":1698488032}},{"address":{"type":"absolute","value":1698488081}},{"address":{"type":"absolute","value":1698488098}},{"address":{"type":"absolute","value":1698488240}},{"address":{"type":"absolute","value":1698488297}},{"address":{"type":"absolute","value":1698488320}},{"address":{"type":"absolute","value":1698488392}}]},{"address":{"type":"absolute","value":1698488592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698488592}},{"address":{"type":"absolute","value":1698488747}},{"address":{"type":"absolute","value":1698488800}},{"address":{"type":"absolute","value":1698488912}},{"address":{"type":"absolute","value":1698488952}},{"address":{"type":"absolute","value":1698488970}},{"address":{"type":"absolute","value":1698489056}},{"address":{"type":"absolute","value":1698489089}},{"address":{"type":"absolute","value":1698489108}},{"address":{"type":"absolute","value":1698489139}},{"address":{"type":"absolute","value":1698489186}},{"address":{"type":"absolute","value":1698489249}},{"address":{"type":"absolute","value":1698489297}},{"address":{"type":"absolute","value":1698489322}},{"address":{"type":"absolute","value":1698489346}},{"address":{"type":"absolute","value":1698489371}},{"address":{"type":"absolute","value":1698489408}},{"address":{"type":"absolute","value":1698489443}},{"address":{"type":"absolute","value":1698489468}},{"address":{"type":"absolute","value":1698489488}}]},{"address":{"type":"absolute","value":1698489552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698489552}},{"address":{"type":"absolute","value":1698489706}},{"address":{"type":"absolute","value":1698489760}},{"address":{"type":"absolute","value":1698489872}},{"address":{"type":"absolute","value":1698489915}},{"address":{"type":"absolute","value":1698489933}},{"address":{"type":"absolute","value":1698490018}},{"address":{"type":"absolute","value":1698490054}},{"address":{"type":"absolute","value":1698490080}},{"address":{"type":"absolute","value":1698490114}},{"address":{"type":"absolute","value":1698490161}},{"address":{"type":"absolute","value":1698490225}},{"address":{"type":"absolute","value":1698490273}},{"address":{"type":"absolute","value":1698490301}},{"address":{"type":"absolute","value":1698490336}},{"address":{"type":"absolute","value":1698490366}},{"address":{"type":"absolute","value":1698490400}},{"address":{"type":"absolute","value":1698490435}},{"address":{"type":"absolute","value":1698490463}},{"address":{"type":"absolute","value":1698490484}}]},{"address":{"type":"absolute","value":1698490544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698490544}},{"address":{"type":"absolute","value":1698490600}},{"address":{"type":"absolute","value":1698490720}},{"address":{"type":"absolute","value":1698490739}},{"address":{"type":"absolute","value":1698490766}}]},{"address":{"type":"absolute","value":1698490800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698490800}},{"address":{"type":"absolute","value":1698490856}},{"address":{"type":"absolute","value":1698490977}},{"address":{"type":"absolute","value":1698490993}},{"address":{"type":"absolute","value":1698491020}}]},{"address":{"type":"absolute","value":1698491056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698491056}},{"address":{"type":"absolute","value":1698491264}},{"address":{"type":"absolute","value":1698491293}},{"address":{"type":"absolute","value":1698491321}},{"address":{"type":"absolute","value":1698491379}},{"address":{"type":"absolute","value":1698491477}},{"address":{"type":"absolute","value":1698491525}},{"address":{"type":"absolute","value":1698491586}},{"address":{"type":"absolute","value":1698491608}},{"address":{"type":"absolute","value":1698491632}},{"address":{"type":"absolute","value":1698491654}},{"address":{"type":"absolute","value":1698491717}},{"address":{"type":"absolute","value":1698491764}},{"address":{"type":"absolute","value":1698491786}},{"address":{"type":"absolute","value":1698491808}}]},{"address":{"type":"absolute","value":1698491888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698491888}},{"address":{"type":"absolute","value":1698492007}},{"address":{"type":"absolute","value":1698492064}},{"address":{"type":"absolute","value":1698492085}},{"address":{"type":"absolute","value":1698492112}},{"address":{"type":"absolute","value":1698492134}},{"address":{"type":"absolute","value":1698492169}},{"address":{"type":"absolute","value":1698492336}},{"address":{"type":"absolute","value":1698492384}},{"address":{"type":"absolute","value":1698492448}},{"address":{"type":"absolute","value":1698492469}},{"address":{"type":"absolute","value":1698492496}},{"address":{"type":"absolute","value":1698492518}},{"address":{"type":"absolute","value":1698492574}},{"address":{"type":"absolute","value":1698492651}}]},{"address":{"type":"absolute","value":1698492736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698492736}},{"address":{"type":"absolute","value":1698492831}},{"address":{"type":"absolute","value":1698493022}},{"address":{"type":"absolute","value":1698493031}},{"address":{"type":"absolute","value":1698493088}}]},{"address":{"type":"absolute","value":1698493136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698493136}},{"address":{"type":"absolute","value":1698493189}},{"address":{"type":"absolute","value":1698493238}},{"address":{"type":"absolute","value":1698493312}},{"address":{"type":"absolute","value":1698493415}},{"address":{"type":"absolute","value":1698493430}},{"address":{"type":"absolute","value":1698493439}},{"address":{"type":"absolute","value":1698493485}},{"address":{"type":"absolute","value":1698493524}},{"address":{"type":"absolute","value":1698493545}},{"address":{"type":"absolute","value":1698493564}}]},{"address":{"type":"absolute","value":1698493632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698493730}},{"address":{"type":"absolute","value":1698493872}},{"address":{"type":"absolute","value":1698493962}},{"address":{"type":"absolute","value":1698494005}},{"address":{"type":"absolute","value":1698494064}}]},{"address":{"type":"absolute","value":1698494208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698494236}},{"address":{"type":"absolute","value":1698494511}},{"address":{"type":"absolute","value":1698494528}}]},{"address":{"type":"absolute","value":1698494544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698494544}},{"address":{"type":"absolute","value":1698494621}},{"address":{"type":"absolute","value":1698494643}},{"address":{"type":"absolute","value":1698494721}},{"address":{"type":"absolute","value":1698494884}},{"address":{"type":"absolute","value":1698494928}},{"address":{"type":"absolute","value":1698494937}},{"address":{"type":"absolute","value":1698494992}}]},{"address":{"type":"absolute","value":1698495024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495116}}]},{"address":{"type":"absolute","value":1698495136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}}]},{"address":{"type":"absolute","value":1698495504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}}]},{"address":{"type":"absolute","value":1698495520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}}]},{"address":{"type":"absolute","value":1698495536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698491888}},{"address":{"type":"absolute","value":1698492007}},{"address":{"type":"absolute","value":1698492064}},{"address":{"type":"absolute","value":1698492085}},{"address":{"type":"absolute","value":1698492112}},{"address":{"type":"absolute","value":1698492134}},{"address":{"type":"absolute","value":1698492169}},{"address":{"type":"absolute","value":1698492336}},{"address":{"type":"absolute","value":1698492384}},{"address":{"type":"absolute","value":1698492448}},{"address":{"type":"absolute","value":1698492469}},{"address":{"type":"absolute","value":1698492496}},{"address":{"type":"absolute","value":1698492518}},{"address":{"type":"absolute","value":1698492574}},{"address":{"type":"absolute","value":1698492651}},{"address":{"type":"absolute","value":1698495536}},{"address":{"type":"absolute","value":1698495589}},{"address":{"type":"absolute","value":1698495643}},{"address":{"type":"absolute","value":1698495680}},{"address":{"type":"absolute","value":1698495696}},{"address":{"type":"absolute","value":1698495712}}]},{"address":{"type":"absolute","value":1698495744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495744}},{"address":{"type":"absolute","value":1698495798}},{"address":{"type":"absolute","value":1698495870}}]},{"address":{"type":"absolute","value":1698495904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698495904}},{"address":{"type":"absolute","value":1698495989}},{"address":{"type":"absolute","value":1698496016}},{"address":{"type":"absolute","value":1698496080}},{"address":{"type":"absolute","value":1698496101}},{"address":{"type":"absolute","value":1698496117}},{"address":{"type":"absolute","value":1698496128}},{"address":{"type":"absolute","value":1698496192}},{"address":{"type":"absolute","value":1698496213}},{"address":{"type":"absolute","value":1698496243}},{"address":{"type":"absolute","value":1698496296}}]},{"address":{"type":"absolute","value":1698496368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}}]},{"address":{"type":"absolute","value":1698497376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}}]},{"address":{"type":"absolute","value":1698497504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}}]},{"address":{"type":"absolute","value":1698497680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497680}},{"address":{"type":"absolute","value":1698497715}},{"address":{"type":"absolute","value":1698497849}},{"address":{"type":"absolute","value":1698497915}}]},{"address":{"type":"absolute","value":1698497936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497984}},{"address":{"type":"absolute","value":1698498023}},{"address":{"type":"absolute","value":1698498091}},{"address":{"type":"absolute","value":1698498183}}]},{"address":{"type":"absolute","value":1698498240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698498358}},{"address":{"type":"absolute","value":1698498388}},{"address":{"type":"absolute","value":1698498441}},{"address":{"type":"absolute","value":1698498488}},{"address":{"type":"absolute","value":1698498544}},{"address":{"type":"absolute","value":1698498608}}]},{"address":{"type":"absolute","value":1698498752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}}]},{"address":{"type":"absolute","value":1698499424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499751}}]},{"address":{"type":"absolute","value":1698499824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499824}},{"address":{"type":"absolute","value":1698499891}},{"address":{"type":"absolute","value":1698500020}},{"address":{"type":"absolute","value":1698500101}},{"address":{"type":"absolute","value":1698500160}},{"address":{"type":"absolute","value":1698500197}},{"address":{"type":"absolute","value":1698500205}},{"address":{"type":"absolute","value":1698501856}}]},{"address":{"type":"absolute","value":1698500224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698500538}},{"address":{"type":"absolute","value":1698500606}},{"address":{"type":"absolute","value":1698500672}}]},{"address":{"type":"absolute","value":1698500704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698500704}},{"address":{"type":"absolute","value":1698500828}},{"address":{"type":"absolute","value":1698500841}},{"address":{"type":"absolute","value":1698500850}},{"address":{"type":"absolute","value":1698500890}},{"address":{"type":"absolute","value":1698500926}},{"address":{"type":"absolute","value":1698500977}},{"address":{"type":"absolute","value":1698501061}}]},{"address":{"type":"absolute","value":1698501104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497984}},{"address":{"type":"absolute","value":1698498023}},{"address":{"type":"absolute","value":1698498091}},{"address":{"type":"absolute","value":1698498183}},{"address":{"type":"absolute","value":1698501104}},{"address":{"type":"absolute","value":1698501212}},{"address":{"type":"absolute","value":1698501221}},{"address":{"type":"absolute","value":1698501225}},{"address":{"type":"absolute","value":1698501265}},{"address":{"type":"absolute","value":1698501294}},{"address":{"type":"absolute","value":1698501317}},{"address":{"type":"absolute","value":1698501333}},{"address":{"type":"absolute","value":1698501349}},{"address":{"type":"absolute","value":1698501425}},{"address":{"type":"absolute","value":1698501441}},{"address":{"type":"absolute","value":1698501457}}]},{"address":{"type":"absolute","value":1698501536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698501536}},{"address":{"type":"absolute","value":1698501623}},{"address":{"type":"absolute","value":1698501628}},{"address":{"type":"absolute","value":1698501666}},{"address":{"type":"absolute","value":1698501713}}]},{"address":{"type":"absolute","value":1698501776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}}]},{"address":{"type":"absolute","value":1698501808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}}]},{"address":{"type":"absolute","value":1698501856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698501856}}]},{"address":{"type":"absolute","value":1698502768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698502883}},{"address":{"type":"absolute","value":1698502896}},{"address":{"type":"absolute","value":1698503407}},{"address":{"type":"absolute","value":1698503558}},{"address":{"type":"absolute","value":1698503584}}]},{"address":{"type":"absolute","value":1698503872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698503891}}]},{"address":{"type":"absolute","value":1698503952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}}]},{"address":{"type":"absolute","value":1698504240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}}]},{"address":{"type":"absolute","value":1698504656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504656}},{"address":{"type":"absolute","value":1698504708}},{"address":{"type":"absolute","value":1698504717}},{"address":{"type":"absolute","value":1698504769}},{"address":{"type":"absolute","value":1698504780}},{"address":{"type":"absolute","value":1698504792}},{"address":{"type":"absolute","value":1698504800}},{"address":{"type":"absolute","value":1698504839}}]},{"address":{"type":"absolute","value":1698504896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504896}},{"address":{"type":"absolute","value":1698504953}},{"address":{"type":"absolute","value":1698504974}},{"address":{"type":"absolute","value":1698504992}},{"address":{"type":"absolute","value":1698505044}},{"address":{"type":"absolute","value":1698505105}},{"address":{"type":"absolute","value":1698505134}}]},{"address":{"type":"absolute","value":1698505216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505216}},{"address":{"type":"absolute","value":1698505273}},{"address":{"type":"absolute","value":1698505294}},{"address":{"type":"absolute","value":1698505312}},{"address":{"type":"absolute","value":1698505364}},{"address":{"type":"absolute","value":1698505425}},{"address":{"type":"absolute","value":1698505454}}]},{"address":{"type":"absolute","value":1698505536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}}]},{"address":{"type":"absolute","value":1698505552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}}]},{"address":{"type":"absolute","value":1698505616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}}]},{"address":{"type":"absolute","value":1698505648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505664}}]},{"address":{"type":"absolute","value":1698505696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505755}},{"address":{"type":"absolute","value":1698505824}},{"address":{"type":"absolute","value":1698505884}},{"address":{"type":"absolute","value":1698505889}}]},{"address":{"type":"absolute","value":1698505984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698505984}},{"address":{"type":"absolute","value":1698506006}},{"address":{"type":"absolute","value":1698506046}},{"address":{"type":"absolute","value":1698506092}},{"address":{"type":"absolute","value":1698506211}},{"address":{"type":"absolute","value":1698506217}},{"address":{"type":"absolute","value":1698506242}},{"address":{"type":"absolute","value":1698506283}},{"address":{"type":"absolute","value":1698506295}},{"address":{"type":"absolute","value":1698506416}},{"address":{"type":"absolute","value":1698506467}}]},{"address":{"type":"absolute","value":1698506528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698506528}},{"address":{"type":"absolute","value":1698506731}},{"address":{"type":"absolute","value":1698506918}},{"address":{"type":"absolute","value":1698506924}},{"address":{"type":"absolute","value":1698506953}},{"address":{"type":"absolute","value":1698507057}},{"address":{"type":"absolute","value":1698507069}},{"address":{"type":"absolute","value":1698507110}},{"address":{"type":"absolute","value":1698507184}},{"address":{"type":"absolute","value":1698507211}},{"address":{"type":"absolute","value":1698507500}},{"address":{"type":"absolute","value":1698507506}},{"address":{"type":"absolute","value":1698507584}},{"address":{"type":"absolute","value":1698507898}},{"address":{"type":"absolute","value":1698507958}},{"address":{"type":"absolute","value":1698508015}},{"address":{"type":"absolute","value":1698508038}},{"address":{"type":"absolute","value":1698508087}},{"address":{"type":"absolute","value":1698508115}},{"address":{"type":"absolute","value":1698508134}},{"address":{"type":"absolute","value":1698508155}},{"address":{"type":"absolute","value":1698508174}},{"address":{"type":"absolute","value":1698508186}}]},{"address":{"type":"absolute","value":1698508336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698508461}},{"address":{"type":"absolute","value":1698508672}},{"address":{"type":"absolute","value":1698508745}},{"address":{"type":"absolute","value":1698508773}},{"address":{"type":"absolute","value":1698508783}},{"address":{"type":"absolute","value":1698508788}},{"address":{"type":"absolute","value":1698508806}},{"address":{"type":"absolute","value":1698508950}},{"address":{"type":"absolute","value":1698508994}},{"address":{"type":"absolute","value":1698509200}},{"address":{"type":"absolute","value":1698509218}},{"address":{"type":"absolute","value":1698509257}},{"address":{"type":"absolute","value":1698509272}}]},{"address":{"type":"absolute","value":1698509296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698509296}},{"address":{"type":"absolute","value":1698509336}},{"address":{"type":"absolute","value":1698509414}},{"address":{"type":"absolute","value":1698509478}},{"address":{"type":"absolute","value":1698509518}},{"address":{"type":"absolute","value":1698509555}},{"address":{"type":"absolute","value":1698509699}},{"address":{"type":"absolute","value":1698509765}},{"address":{"type":"absolute","value":1698509824}},{"address":{"type":"absolute","value":1698509856}},{"address":{"type":"absolute","value":1698509869}},{"address":{"type":"absolute","value":1698509942}},{"address":{"type":"absolute","value":1698510121}},{"address":{"type":"absolute","value":1698510387}},{"address":{"type":"absolute","value":1698510426}},{"address":{"type":"absolute","value":1698510448}},{"address":{"type":"absolute","value":1698510457}}]},{"address":{"type":"absolute","value":1698510512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510512}}]},{"address":{"type":"absolute","value":1698510560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510560}}]},{"address":{"type":"absolute","value":1698510608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510608}},{"address":{"type":"absolute","value":1698510688}},{"address":{"type":"absolute","value":1698510800}}]},{"address":{"type":"absolute","value":1698510864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698510928}},{"address":{"type":"absolute","value":1698510984}},{"address":{"type":"absolute","value":1698510993}}]},{"address":{"type":"absolute","value":1698511040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698511253}},{"address":{"type":"absolute","value":1698511424}},{"address":{"type":"absolute","value":1698511429}},{"address":{"type":"absolute","value":1698511480}},{"address":{"type":"absolute","value":1698511578}},{"address":{"type":"absolute","value":1698511637}},{"address":{"type":"absolute","value":1698511697}},{"address":{"type":"absolute","value":1698511792}},{"address":{"type":"absolute","value":1698511849}},{"address":{"type":"absolute","value":1698511881}},{"address":{"type":"absolute","value":1698511900}},{"address":{"type":"absolute","value":1698512080}},{"address":{"type":"absolute","value":1698512220}}]},{"address":{"type":"absolute","value":1698512416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698512416}},{"address":{"type":"absolute","value":1698512451}},{"address":{"type":"absolute","value":1698512461}}]},{"address":{"type":"absolute","value":1698512480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698512601}},{"address":{"type":"absolute","value":1698512642}},{"address":{"type":"absolute","value":1698512741}},{"address":{"type":"absolute","value":1698512800}},{"address":{"type":"absolute","value":1698512821}},{"address":{"type":"absolute","value":1698512848}},{"address":{"type":"absolute","value":1698513152}},{"address":{"type":"absolute","value":1698513200}},{"address":{"type":"absolute","value":1698513222}},{"address":{"type":"absolute","value":1698513381}}]},{"address":{"type":"absolute","value":1698513520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698513640}},{"address":{"type":"absolute","value":1698513681}},{"address":{"type":"absolute","value":1698513780}},{"address":{"type":"absolute","value":1698513856}},{"address":{"type":"absolute","value":1698513881}},{"address":{"type":"absolute","value":1698513906}},{"address":{"type":"absolute","value":1698514212}},{"address":{"type":"absolute","value":1698514272}},{"address":{"type":"absolute","value":1698514296}},{"address":{"type":"absolute","value":1698514436}}]},{"address":{"type":"absolute","value":1698514576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698514576}},{"address":{"type":"absolute","value":1698514694}},{"address":{"type":"absolute","value":1698514735}},{"address":{"type":"absolute","value":1698514905}},{"address":{"type":"absolute","value":1698514928}},{"address":{"type":"absolute","value":1698515054}},{"address":{"type":"absolute","value":1698515237}},{"address":{"type":"absolute","value":1698515312}},{"address":{"type":"absolute","value":1698515328}},{"address":{"type":"absolute","value":1698515366}},{"address":{"type":"absolute","value":1698515647}},{"address":{"type":"absolute","value":1698515731}},{"address":{"type":"absolute","value":1698515747}},{"address":{"type":"absolute","value":1698515782}},{"address":{"type":"absolute","value":1698515932}},{"address":{"type":"absolute","value":1698515966}}]},{"address":{"type":"absolute","value":1698516064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516128}},{"address":{"type":"absolute","value":1698516152}},{"address":{"type":"absolute","value":1698516164}}]},{"address":{"type":"absolute","value":1698516192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516352}}]},{"address":{"type":"absolute","value":1698516400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516400}}]},{"address":{"type":"absolute","value":1698516448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516473}},{"address":{"type":"absolute","value":1698516480}}]},{"address":{"type":"absolute","value":1698516496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516560}}]},{"address":{"type":"absolute","value":1698516624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516702}},{"address":{"type":"absolute","value":1698516722}}]},{"address":{"type":"absolute","value":1698516752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516833}},{"address":{"type":"absolute","value":1698516853}}]},{"address":{"type":"absolute","value":1698516880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698516961}},{"address":{"type":"absolute","value":1698516981}}]},{"address":{"type":"absolute","value":1698517008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517079}},{"address":{"type":"absolute","value":1698517104}}]},{"address":{"type":"absolute","value":1698517136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517190}},{"address":{"type":"absolute","value":1698517216}}]},{"address":{"type":"absolute","value":1698517248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517389}}]},{"address":{"type":"absolute","value":1698517504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517557}}]},{"address":{"type":"absolute","value":1698517568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698517700}},{"address":{"type":"absolute","value":1698517761}},{"address":{"type":"absolute","value":1698517827}},{"address":{"type":"absolute","value":1698518024}},{"address":{"type":"absolute","value":1698518048}}]},{"address":{"type":"absolute","value":1698518256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518351}},{"address":{"type":"absolute","value":1698518398}}]},{"address":{"type":"absolute","value":1698518416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518416}},{"address":{"type":"absolute","value":1698518471}},{"address":{"type":"absolute","value":1698518490}}]},{"address":{"type":"absolute","value":1698518512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518597}}]},{"address":{"type":"absolute","value":1698518688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698518688}},{"address":{"type":"absolute","value":1698518708}},{"address":{"type":"absolute","value":1698518857}}]},{"address":{"type":"absolute","value":1698519808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698519824}},{"address":{"type":"absolute","value":1698519859}},{"address":{"type":"absolute","value":1698519888}},{"address":{"type":"absolute","value":1698519904}},{"address":{"type":"absolute","value":1698519920}},{"address":{"type":"absolute","value":1699037472}},{"address":{"type":"absolute","value":1699037560}},{"address":{"type":"absolute","value":1699037745}},{"address":{"type":"absolute","value":1699037781}}]},{"address":{"type":"absolute","value":1698519936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698519961}},{"address":{"type":"absolute","value":1698519989}},{"address":{"type":"absolute","value":1698519998}},{"address":{"type":"absolute","value":1698520013}},{"address":{"type":"absolute","value":1698520022}}]},{"address":{"type":"absolute","value":1698520032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520032}},{"address":{"type":"absolute","value":1698520112}},{"address":{"type":"absolute","value":1698520142}},{"address":{"type":"absolute","value":1698520219}},{"address":{"type":"absolute","value":1698520255}}]},{"address":{"type":"absolute","value":1698520384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520384}}]},{"address":{"type":"absolute","value":1698520432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520480}},{"address":{"type":"absolute","value":1698520545}}]},{"address":{"type":"absolute","value":1698520624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698520754}},{"address":{"type":"absolute","value":1698520877}}]},{"address":{"type":"absolute","value":1698521824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698521947}},{"address":{"type":"absolute","value":1698521968}}]},{"address":{"type":"absolute","value":1698522000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698522073}},{"address":{"type":"absolute","value":1698522130}},{"address":{"type":"absolute","value":1698522160}}]},{"address":{"type":"absolute","value":1698522176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698522352}},{"address":{"type":"absolute","value":1698522458}},{"address":{"type":"absolute","value":1698522501}}]},{"address":{"type":"absolute","value":1698522624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698522784}},{"address":{"type":"absolute","value":1698522829}},{"address":{"type":"absolute","value":1698522937}},{"address":{"type":"absolute","value":1698523093}}]},{"address":{"type":"absolute","value":1698523424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698523424}}]},{"address":{"type":"absolute","value":1698523520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}}]},{"address":{"type":"absolute","value":1698523536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698523834}},{"address":{"type":"absolute","value":1698523868}},{"address":{"type":"absolute","value":1698523970}},{"address":{"type":"absolute","value":1698524149}},{"address":{"type":"absolute","value":1698524278}},{"address":{"type":"absolute","value":1698524761}},{"address":{"type":"absolute","value":1698524876}},{"address":{"type":"absolute","value":1698524948}},{"address":{"type":"absolute","value":1698525232}},{"address":{"type":"absolute","value":1698525573}},{"address":{"type":"absolute","value":1698525582}},{"address":{"type":"absolute","value":1698525596}}]},{"address":{"type":"absolute","value":1698526688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698526807}}]},{"address":{"type":"absolute","value":1698526960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527003}}]},{"address":{"type":"absolute","value":1698527072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1698527328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527412}},{"address":{"type":"absolute","value":1698527436}},{"address":{"type":"absolute","value":1698527456}},{"address":{"type":"absolute","value":1698527498}},{"address":{"type":"absolute","value":1698527519}},{"address":{"type":"absolute","value":1698527623}}]},{"address":{"type":"absolute","value":1698527648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527726}},{"address":{"type":"absolute","value":1698527850}}]},{"address":{"type":"absolute","value":1698527968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527968}},{"address":{"type":"absolute","value":1698528039}},{"address":{"type":"absolute","value":1698528227}}]},{"address":{"type":"absolute","value":1698528288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}}]},{"address":{"type":"absolute","value":1698528432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528432}}]},{"address":{"type":"absolute","value":1698528480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528525}},{"address":{"type":"absolute","value":1698528533}}]},{"address":{"type":"absolute","value":1698528640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528725}},{"address":{"type":"absolute","value":1698528755}},{"address":{"type":"absolute","value":1698528788}},{"address":{"type":"absolute","value":1698528860}},{"address":{"type":"absolute","value":1698528866}},{"address":{"type":"absolute","value":1698528928}},{"address":{"type":"absolute","value":1698528961}},{"address":{"type":"absolute","value":1698528976}}]},{"address":{"type":"absolute","value":1698528992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529028}}]},{"address":{"type":"absolute","value":1698529072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529096}},{"address":{"type":"absolute","value":1698529121}}]},{"address":{"type":"absolute","value":1698529136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527412}},{"address":{"type":"absolute","value":1698527436}},{"address":{"type":"absolute","value":1698527456}},{"address":{"type":"absolute","value":1698527498}},{"address":{"type":"absolute","value":1698527519}},{"address":{"type":"absolute","value":1698527623}}]},{"address":{"type":"absolute","value":1698529152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529221}},{"address":{"type":"absolute","value":1698529410}},{"address":{"type":"absolute","value":1698529484}}]},{"address":{"type":"absolute","value":1698529632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529709}},{"address":{"type":"absolute","value":1698529772}}]},{"address":{"type":"absolute","value":1698529792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1698529808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698526807}}]},{"address":{"type":"absolute","value":1698529824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698529824}},{"address":{"type":"absolute","value":1698529848}},{"address":{"type":"absolute","value":1698529856}},{"address":{"type":"absolute","value":1698529872}},{"address":{"type":"absolute","value":1698529888}}]},{"address":{"type":"absolute","value":1698529904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698527003}},{"address":{"type":"absolute","value":1698528525}},{"address":{"type":"absolute","value":1698528533}}]},{"address":{"type":"absolute","value":1698529936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}},{"address":{"type":"absolute","value":1698529936}}]},{"address":{"type":"absolute","value":1698529968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530066}},{"address":{"type":"absolute","value":1698530112}},{"address":{"type":"absolute","value":1698530128}}]},{"address":{"type":"absolute","value":1698530160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530160}}]},{"address":{"type":"absolute","value":1698530224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530224}},{"address":{"type":"absolute","value":1698530261}},{"address":{"type":"absolute","value":1698530373}},{"address":{"type":"absolute","value":1698530427}},{"address":{"type":"absolute","value":1698530448}},{"address":{"type":"absolute","value":1698530512}},{"address":{"type":"absolute","value":1698530544}}]},{"address":{"type":"absolute","value":1698530672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530928}},{"address":{"type":"absolute","value":1698531088}},{"address":{"type":"absolute","value":1698531158}},{"address":{"type":"absolute","value":1698531216}},{"address":{"type":"absolute","value":1698531362}},{"address":{"type":"absolute","value":1698531441}},{"address":{"type":"absolute","value":1698531651}},{"address":{"type":"absolute","value":1698531772}}]},{"address":{"type":"absolute","value":1698531920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698531963}},{"address":{"type":"absolute","value":1698531995}},{"address":{"type":"absolute","value":1698532025}},{"address":{"type":"absolute","value":1698532048}},{"address":{"type":"absolute","value":1698532080}},{"address":{"type":"absolute","value":1698532164}},{"address":{"type":"absolute","value":1698532176}},{"address":{"type":"absolute","value":1698532240}},{"address":{"type":"absolute","value":1698532256}},{"address":{"type":"absolute","value":1698532341}},{"address":{"type":"absolute","value":1698532370}}]},{"address":{"type":"absolute","value":1698532496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532578}}]},{"address":{"type":"absolute","value":1698532592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532628}}]},{"address":{"type":"absolute","value":1698532768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532816}},{"address":{"type":"absolute","value":1698532829}},{"address":{"type":"absolute","value":1698532848}}]},{"address":{"type":"absolute","value":1698532944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532996}},{"address":{"type":"absolute","value":1698533044}}]},{"address":{"type":"absolute","value":1698533152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533152}},{"address":{"type":"absolute","value":1698533187}},{"address":{"type":"absolute","value":1698533257}},{"address":{"type":"absolute","value":1698533269}},{"address":{"type":"absolute","value":1698533333}},{"address":{"type":"absolute","value":1698533357}},{"address":{"type":"absolute","value":1698533377}},{"address":{"type":"absolute","value":1698533429}}]},{"address":{"type":"absolute","value":1698533568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533616}},{"address":{"type":"absolute","value":1698533629}},{"address":{"type":"absolute","value":1698533648}}]},{"address":{"type":"absolute","value":1698533664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533700}},{"address":{"type":"absolute","value":1698533729}},{"address":{"type":"absolute","value":1698533744}}]},{"address":{"type":"absolute","value":1698533760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533796}}]},{"address":{"type":"absolute","value":1698533840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698533869}},{"address":{"type":"absolute","value":1698533928}},{"address":{"type":"absolute","value":1698533940}},{"address":{"type":"absolute","value":1698534129}}]},{"address":{"type":"absolute","value":1698534208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698534240}},{"address":{"type":"absolute","value":1698534292}}]},{"address":{"type":"absolute","value":1698534560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534596}}]},{"address":{"type":"absolute","value":1698534640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534676}}]},{"address":{"type":"absolute","value":1698534768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698534768}},{"address":{"type":"absolute","value":1698534836}},{"address":{"type":"absolute","value":1698534853}},{"address":{"type":"absolute","value":1698534888}},{"address":{"type":"absolute","value":1698534912}}]},{"address":{"type":"absolute","value":1698535056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698532628}}]},{"address":{"type":"absolute","value":1698535088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535088}},{"address":{"type":"absolute","value":1698535152}},{"address":{"type":"absolute","value":1698535195}}]},{"address":{"type":"absolute","value":1698535232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535232}},{"address":{"type":"absolute","value":1698535279}},{"address":{"type":"absolute","value":1698535301}}]},{"address":{"type":"absolute","value":1698535344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535344}}]},{"address":{"type":"absolute","value":1698535376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535376}}]},{"address":{"type":"absolute","value":1698535408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698530928}},{"address":{"type":"absolute","value":1698531088}},{"address":{"type":"absolute","value":1698531158}},{"address":{"type":"absolute","value":1698531216}},{"address":{"type":"absolute","value":1698531362}},{"address":{"type":"absolute","value":1698531441}},{"address":{"type":"absolute","value":1698531651}},{"address":{"type":"absolute","value":1698531772}}]},{"address":{"type":"absolute","value":1698535424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535424}}]},{"address":{"type":"absolute","value":1698535456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535456}},{"address":{"type":"absolute","value":1698535493}},{"address":{"type":"absolute","value":1698535538}}]},{"address":{"type":"absolute","value":1698535552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535552}},{"address":{"type":"absolute","value":1698535579}}]},{"address":{"type":"absolute","value":1698535600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535600}},{"address":{"type":"absolute","value":1698535627}}]},{"address":{"type":"absolute","value":1698535648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}}]},{"address":{"type":"absolute","value":1698535664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}}]},{"address":{"type":"absolute","value":1698535696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}}]},{"address":{"type":"absolute","value":1698535712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698484080}},{"address":{"type":"absolute","value":1698484102}},{"address":{"type":"absolute","value":1698484536}}]},{"address":{"type":"absolute","value":1698535744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}}]},{"address":{"type":"absolute","value":1698535760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535760}}]},{"address":{"type":"absolute","value":1698535792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535792}},{"address":{"type":"absolute","value":1698535890}}]},{"address":{"type":"absolute","value":1698535920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698535920}},{"address":{"type":"absolute","value":1698535947}}]},{"address":{"type":"absolute","value":1698535968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483936}},{"address":{"type":"absolute","value":1698483962}},{"address":{"type":"absolute","value":1698483981}},{"address":{"type":"absolute","value":1698484000}},{"address":{"type":"absolute","value":1698484016}},{"address":{"type":"absolute","value":1698484032}},{"address":{"type":"absolute","value":1698484064}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497568}},{"address":{"type":"absolute","value":1698497614}},{"address":{"type":"absolute","value":1698497664}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510928}},{"address":{"type":"absolute","value":1698510984}},{"address":{"type":"absolute","value":1698510993}}]},{"address":{"type":"absolute","value":1698535984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483792}},{"address":{"type":"absolute","value":1698483818}},{"address":{"type":"absolute","value":1698483837}},{"address":{"type":"absolute","value":1698483856}},{"address":{"type":"absolute","value":1698483872}},{"address":{"type":"absolute","value":1698483888}},{"address":{"type":"absolute","value":1698483920}},{"address":{"type":"absolute","value":1698495266}},{"address":{"type":"absolute","value":1698495311}},{"address":{"type":"absolute","value":1698495456}},{"address":{"type":"absolute","value":1698497439}},{"address":{"type":"absolute","value":1698497488}},{"address":{"type":"absolute","value":1698499154}},{"address":{"type":"absolute","value":1698499209}},{"address":{"type":"absolute","value":1698499228}},{"address":{"type":"absolute","value":1698499280}},{"address":{"type":"absolute","value":1698499318}},{"address":{"type":"absolute","value":1698499354}},{"address":{"type":"absolute","value":1698504240}},{"address":{"type":"absolute","value":1698504277}},{"address":{"type":"absolute","value":1698504298}},{"address":{"type":"absolute","value":1698504446}},{"address":{"type":"absolute","value":1698504482}},{"address":{"type":"absolute","value":1698504520}},{"address":{"type":"absolute","value":1698510608}},{"address":{"type":"absolute","value":1698510688}},{"address":{"type":"absolute","value":1698510800}}]},{"address":{"type":"absolute","value":1698536032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483648}},{"address":{"type":"absolute","value":1698483674}},{"address":{"type":"absolute","value":1698483693}},{"address":{"type":"absolute","value":1698483712}},{"address":{"type":"absolute","value":1698483728}},{"address":{"type":"absolute","value":1698483744}},{"address":{"type":"absolute","value":1698483776}},{"address":{"type":"absolute","value":1698495116}},{"address":{"type":"absolute","value":1698496563}},{"address":{"type":"absolute","value":1698496669}},{"address":{"type":"absolute","value":1698496693}},{"address":{"type":"absolute","value":1698496745}},{"address":{"type":"absolute","value":1698496793}},{"address":{"type":"absolute","value":1698496880}},{"address":{"type":"absolute","value":1698496897}},{"address":{"type":"absolute","value":1698496928}},{"address":{"type":"absolute","value":1698497017}},{"address":{"type":"absolute","value":1698497136}},{"address":{"type":"absolute","value":1698497184}},{"address":{"type":"absolute","value":1698497204}},{"address":{"type":"absolute","value":1698497292}},{"address":{"type":"absolute","value":1698501536}},{"address":{"type":"absolute","value":1698501623}},{"address":{"type":"absolute","value":1698501628}},{"address":{"type":"absolute","value":1698501666}},{"address":{"type":"absolute","value":1698501713}},{"address":{"type":"absolute","value":1698504656}},{"address":{"type":"absolute","value":1698504708}},{"address":{"type":"absolute","value":1698504717}},{"address":{"type":"absolute","value":1698504769}},{"address":{"type":"absolute","value":1698504780}},{"address":{"type":"absolute","value":1698504792}},{"address":{"type":"absolute","value":1698504800}},{"address":{"type":"absolute","value":1698504839}},{"address":{"type":"absolute","value":1698509296}},{"address":{"type":"absolute","value":1698509336}},{"address":{"type":"absolute","value":1698509414}},{"address":{"type":"absolute","value":1698509478}},{"address":{"type":"absolute","value":1698509518}},{"address":{"type":"absolute","value":1698509555}},{"address":{"type":"absolute","value":1698509699}},{"address":{"type":"absolute","value":1698509765}},{"address":{"type":"absolute","value":1698509824}},{"address":{"type":"absolute","value":1698509856}},{"address":{"type":"absolute","value":1698509869}},{"address":{"type":"absolute","value":1698509942}},{"address":{"type":"absolute","value":1698510121}},{"address":{"type":"absolute","value":1698510387}},{"address":{"type":"absolute","value":1698510426}},{"address":{"type":"absolute","value":1698510448}},{"address":{"type":"absolute","value":1698510457}}]},{"address":{"type":"absolute","value":1698536048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698484080}},{"address":{"type":"absolute","value":1698484102}},{"address":{"type":"absolute","value":1698484536}}]},{"address":{"type":"absolute","value":1698536080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483136}},{"address":{"type":"absolute","value":1698483175}},{"address":{"type":"absolute","value":1698483205}},{"address":{"type":"absolute","value":1698483220}},{"address":{"type":"absolute","value":1698483263}},{"address":{"type":"absolute","value":1698483280}},{"address":{"type":"absolute","value":1698483392}},{"address":{"type":"absolute","value":1698494236}},{"address":{"type":"absolute","value":1698494511}},{"address":{"type":"absolute","value":1698494528}},{"address":{"type":"absolute","value":1698500538}},{"address":{"type":"absolute","value":1698500606}},{"address":{"type":"absolute","value":1698500672}},{"address":{"type":"absolute","value":1698503952}},{"address":{"type":"absolute","value":1698504194}},{"address":{"type":"absolute","value":1698504219}},{"address":{"type":"absolute","value":1698504223}},{"address":{"type":"absolute","value":1698508461}},{"address":{"type":"absolute","value":1698508672}},{"address":{"type":"absolute","value":1698508745}},{"address":{"type":"absolute","value":1698508773}},{"address":{"type":"absolute","value":1698508783}},{"address":{"type":"absolute","value":1698508788}},{"address":{"type":"absolute","value":1698508806}},{"address":{"type":"absolute","value":1698508950}},{"address":{"type":"absolute","value":1698508994}},{"address":{"type":"absolute","value":1698509200}},{"address":{"type":"absolute","value":1698509218}},{"address":{"type":"absolute","value":1698509257}},{"address":{"type":"absolute","value":1698509272}}]},{"address":{"type":"absolute","value":1698536096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}}]},{"address":{"type":"absolute","value":1698536112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536112}}]},{"address":{"type":"absolute","value":1698536144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536144}},{"address":{"type":"absolute","value":1698536229}}]},{"address":{"type":"absolute","value":1698536272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536272}},{"address":{"type":"absolute","value":1698536352}},{"address":{"type":"absolute","value":1698536368}},{"address":{"type":"absolute","value":1698536464}}]},{"address":{"type":"absolute","value":1698536496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536560}},{"address":{"type":"absolute","value":1698536608}},{"address":{"type":"absolute","value":1698536624}}]},{"address":{"type":"absolute","value":1698536640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536640}},{"address":{"type":"absolute","value":1698536678}}]},{"address":{"type":"absolute","value":1698536688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536720}},{"address":{"type":"absolute","value":1698538507}}]},{"address":{"type":"absolute","value":1698536832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698536832}},{"address":{"type":"absolute","value":1698536879}},{"address":{"type":"absolute","value":1698536896}},{"address":{"type":"absolute","value":1698537042}},{"address":{"type":"absolute","value":1698537056}}]},{"address":{"type":"absolute","value":1698537072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698537072}},{"address":{"type":"absolute","value":1698537285}},{"address":{"type":"absolute","value":1698537337}}]},{"address":{"type":"absolute","value":1698537408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698537408}},{"address":{"type":"absolute","value":1698537441}}]},{"address":{"type":"absolute","value":1698537456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698537456}},{"address":{"type":"absolute","value":1698537498}},{"address":{"type":"absolute","value":1698537521}},{"address":{"type":"absolute","value":1698537552}},{"address":{"type":"absolute","value":1698537616}}]},{"address":{"type":"absolute","value":1698537632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698537756}},{"address":{"type":"absolute","value":1698537808}},{"address":{"type":"absolute","value":1698537864}},{"address":{"type":"absolute","value":1698537952}},{"address":{"type":"absolute","value":1698537994}}]},{"address":{"type":"absolute","value":1698538048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538048}}]},{"address":{"type":"absolute","value":1698538256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538507}}]},{"address":{"type":"absolute","value":1698538704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538800}},{"address":{"type":"absolute","value":1698538816}}]},{"address":{"type":"absolute","value":1698538832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698538986}},{"address":{"type":"absolute","value":1698539289}},{"address":{"type":"absolute","value":1698539456}},{"address":{"type":"absolute","value":1698539488}},{"address":{"type":"absolute","value":1698539539}}]},{"address":{"type":"absolute","value":1698539648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698540032}},{"address":{"type":"absolute","value":1698540215}},{"address":{"type":"absolute","value":1698540243}},{"address":{"type":"absolute","value":1698540270}},{"address":{"type":"absolute","value":1698540303}},{"address":{"type":"absolute","value":1698540387}}]},{"address":{"type":"absolute","value":1698540464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698540539}},{"address":{"type":"absolute","value":1698540629}}]},{"address":{"type":"absolute","value":1698541552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698541607}},{"address":{"type":"absolute","value":1698541638}},{"address":{"type":"absolute","value":1698541781}}]},{"address":{"type":"absolute","value":1698541872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698541955}},{"address":{"type":"absolute","value":1698542014}},{"address":{"type":"absolute","value":1698542032}},{"address":{"type":"absolute","value":1698542045}},{"address":{"type":"absolute","value":1698542139}},{"address":{"type":"absolute","value":1698542423}},{"address":{"type":"absolute","value":1698542488}},{"address":{"type":"absolute","value":1698542664}},{"address":{"type":"absolute","value":1698542840}},{"address":{"type":"absolute","value":1698543288}},{"address":{"type":"absolute","value":1698543344}},{"address":{"type":"absolute","value":1698543359}},{"address":{"type":"absolute","value":1698543456}},{"address":{"type":"absolute","value":1698543471}},{"address":{"type":"absolute","value":1698543568}},{"address":{"type":"absolute","value":1698543583}}]},{"address":{"type":"absolute","value":1698543744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698543744}},{"address":{"type":"absolute","value":1698543952}},{"address":{"type":"absolute","value":1698544050}},{"address":{"type":"absolute","value":1698544068}},{"address":{"type":"absolute","value":1698544322}},{"address":{"type":"absolute","value":1698544386}}]},{"address":{"type":"absolute","value":1698544480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698544480}},{"address":{"type":"absolute","value":1698544555}},{"address":{"type":"absolute","value":1698544608}},{"address":{"type":"absolute","value":1698544809}},{"address":{"type":"absolute","value":1698544817}},{"address":{"type":"absolute","value":1698544896}},{"address":{"type":"absolute","value":1698544917}},{"address":{"type":"absolute","value":1698544930}},{"address":{"type":"absolute","value":1698545134}},{"address":{"type":"absolute","value":1698545146}},{"address":{"type":"absolute","value":1698545218}},{"address":{"type":"absolute","value":1698545353}}]},{"address":{"type":"absolute","value":1698545520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698545568}},{"address":{"type":"absolute","value":1698545613}},{"address":{"type":"absolute","value":1698545734}}]},{"address":{"type":"absolute","value":1698545968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698545968}},{"address":{"type":"absolute","value":1698546016}},{"address":{"type":"absolute","value":1698546066}}]},{"address":{"type":"absolute","value":1698546096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698546180}}]},{"address":{"type":"absolute","value":1698546224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698546224}},{"address":{"type":"absolute","value":1698546288}},{"address":{"type":"absolute","value":1698546335}},{"address":{"type":"absolute","value":1698546533}},{"address":{"type":"absolute","value":1698546738}},{"address":{"type":"absolute","value":1698546753}},{"address":{"type":"absolute","value":1698546821}},{"address":{"type":"absolute","value":1698546960}},{"address":{"type":"absolute","value":1698547091}},{"address":{"type":"absolute","value":1698547185}},{"address":{"type":"absolute","value":1698547198}},{"address":{"type":"absolute","value":1698547305}},{"address":{"type":"absolute","value":1698547486}},{"address":{"type":"absolute","value":1698547501}},{"address":{"type":"absolute","value":1698547661}},{"address":{"type":"absolute","value":1698547712}},{"address":{"type":"absolute","value":1698547773}},{"address":{"type":"absolute","value":1698548117}},{"address":{"type":"absolute","value":1698548406}},{"address":{"type":"absolute","value":1698548569}},{"address":{"type":"absolute","value":1698548833}},{"address":{"type":"absolute","value":1698548880}},{"address":{"type":"absolute","value":1698548895}},{"address":{"type":"absolute","value":1698548956}},{"address":{"type":"absolute","value":1698549039}},{"address":{"type":"absolute","value":1698549328}},{"address":{"type":"absolute","value":1698549461}},{"address":{"type":"absolute","value":1698549486}},{"address":{"type":"absolute","value":1698549502}},{"address":{"type":"absolute","value":1698549505}},{"address":{"type":"absolute","value":1698549770}},{"address":{"type":"absolute","value":1698549871}},{"address":{"type":"absolute","value":1698550431}},{"address":{"type":"absolute","value":1698550526}},{"address":{"type":"absolute","value":1698550717}},{"address":{"type":"absolute","value":1698551463}},{"address":{"type":"absolute","value":1698551502}},{"address":{"type":"absolute","value":1698551548}},{"address":{"type":"absolute","value":1698551582}}]},{"address":{"type":"absolute","value":1698551984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552059}}]},{"address":{"type":"absolute","value":1698552080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552152}}]},{"address":{"type":"absolute","value":1698552176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552218}}]},{"address":{"type":"absolute","value":1698552304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552519}},{"address":{"type":"absolute","value":1698552532}},{"address":{"type":"absolute","value":1698552604}},{"address":{"type":"absolute","value":1698552626}}]},{"address":{"type":"absolute","value":1698552640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552640}},{"address":{"type":"absolute","value":1698552674}},{"address":{"type":"absolute","value":1698552721}}]},{"address":{"type":"absolute","value":1698552736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552736}},{"address":{"type":"absolute","value":1698552773}},{"address":{"type":"absolute","value":1698552834}}]},{"address":{"type":"absolute","value":1698552848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698552947}},{"address":{"type":"absolute","value":1698553384}}]},{"address":{"type":"absolute","value":1698553440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698553472}},{"address":{"type":"absolute","value":1698553490}},{"address":{"type":"absolute","value":1698553504}}]},{"address":{"type":"absolute","value":1698553520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698553816}},{"address":{"type":"absolute","value":1698554146}}]},{"address":{"type":"absolute","value":1698554240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698554240}},{"address":{"type":"absolute","value":1698554375}},{"address":{"type":"absolute","value":1698554524}},{"address":{"type":"absolute","value":1698554568}},{"address":{"type":"absolute","value":1698554624}},{"address":{"type":"absolute","value":1698554941}},{"address":{"type":"absolute","value":1698554964}},{"address":{"type":"absolute","value":1698555045}},{"address":{"type":"absolute","value":1698555072}},{"address":{"type":"absolute","value":1698555094}},{"address":{"type":"absolute","value":1698555193}},{"address":{"type":"absolute","value":1698555438}}]},{"address":{"type":"absolute","value":1698555792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698555792}},{"address":{"type":"absolute","value":1698556059}},{"address":{"type":"absolute","value":1698556508}},{"address":{"type":"absolute","value":1698556560}},{"address":{"type":"absolute","value":1698556577}},{"address":{"type":"absolute","value":1698556639}},{"address":{"type":"absolute","value":1698556757}},{"address":{"type":"absolute","value":1698556770}},{"address":{"type":"absolute","value":1698556787}},{"address":{"type":"absolute","value":1698556900}},{"address":{"type":"absolute","value":1698557446}}]},{"address":{"type":"absolute","value":1698557600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698557879}}]},{"address":{"type":"absolute","value":1698558112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698558211}},{"address":{"type":"absolute","value":1698558224}},{"address":{"type":"absolute","value":1698558236}},{"address":{"type":"absolute","value":1698558315}},{"address":{"type":"absolute","value":1698558341}},{"address":{"type":"absolute","value":1698558370}},{"address":{"type":"absolute","value":1698558384}},{"address":{"type":"absolute","value":1698558464}},{"address":{"type":"absolute","value":1698558509}}]},{"address":{"type":"absolute","value":1698558576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698558726}}]},{"address":{"type":"absolute","value":1698558800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698558800}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1698558944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698559011}},{"address":{"type":"absolute","value":1698559143}}]},{"address":{"type":"absolute","value":1698559344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698559480}},{"address":{"type":"absolute","value":1698559536}},{"address":{"type":"absolute","value":1698560244}}]},{"address":{"type":"absolute","value":1698561040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698561068}}]},{"address":{"type":"absolute","value":1698561168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698561226}},{"address":{"type":"absolute","value":1698561290}}]},{"address":{"type":"absolute","value":1698561408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698561408}},{"address":{"type":"absolute","value":1698561571}},{"address":{"type":"absolute","value":1698561592}},{"address":{"type":"absolute","value":1698561621}},{"address":{"type":"absolute","value":1698561719}},{"address":{"type":"absolute","value":1698561797}},{"address":{"type":"absolute","value":1698561874}},{"address":{"type":"absolute","value":1698561885}},{"address":{"type":"absolute","value":1698561904}}]},{"address":{"type":"absolute","value":1698562080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698562080}},{"address":{"type":"absolute","value":1698562200}},{"address":{"type":"absolute","value":1698562217}},{"address":{"type":"absolute","value":1698562269}},{"address":{"type":"absolute","value":1698562319}},{"address":{"type":"absolute","value":1698562336}},{"address":{"type":"absolute","value":1698562351}},{"address":{"type":"absolute","value":1698562368}},{"address":{"type":"absolute","value":1698562400}},{"address":{"type":"absolute","value":1698562432}},{"address":{"type":"absolute","value":1698562464}}]},{"address":{"type":"absolute","value":1698562512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698562512}},{"address":{"type":"absolute","value":1698562668}},{"address":{"type":"absolute","value":1698562700}},{"address":{"type":"absolute","value":1698562837}}]},{"address":{"type":"absolute","value":1698563024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698563099}},{"address":{"type":"absolute","value":1698563231}},{"address":{"type":"absolute","value":1698563248}}]},{"address":{"type":"absolute","value":1698563392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698563392}},{"address":{"type":"absolute","value":1698563502}},{"address":{"type":"absolute","value":1698563566}},{"address":{"type":"absolute","value":1698563761}},{"address":{"type":"absolute","value":1698563958}},{"address":{"type":"absolute","value":1698563984}}]},{"address":{"type":"absolute","value":1698564176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698564176}},{"address":{"type":"absolute","value":1698564464}},{"address":{"type":"absolute","value":1698564544}},{"address":{"type":"absolute","value":1698564615}},{"address":{"type":"absolute","value":1698564672}},{"address":{"type":"absolute","value":1698564741}}]},{"address":{"type":"absolute","value":1698564960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698565127}},{"address":{"type":"absolute","value":1698565136}},{"address":{"type":"absolute","value":1698565148}},{"address":{"type":"absolute","value":1698565184}},{"address":{"type":"absolute","value":1698565330}},{"address":{"type":"absolute","value":1698565358}},{"address":{"type":"absolute","value":1698565361}},{"address":{"type":"absolute","value":1698565410}},{"address":{"type":"absolute","value":1698565472}},{"address":{"type":"absolute","value":1698565632}},{"address":{"type":"absolute","value":1698565796}}]},{"address":{"type":"absolute","value":1698565856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698565856}},{"address":{"type":"absolute","value":1698565946}},{"address":{"type":"absolute","value":1698566085}},{"address":{"type":"absolute","value":1698566117}},{"address":{"type":"absolute","value":1698566176}},{"address":{"type":"absolute","value":1698566208}},{"address":{"type":"absolute","value":1698566228}},{"address":{"type":"absolute","value":1698566295}},{"address":{"type":"absolute","value":1698566402}},{"address":{"type":"absolute","value":1698566427}},{"address":{"type":"absolute","value":1698566499}}]},{"address":{"type":"absolute","value":1698566768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698566864}},{"address":{"type":"absolute","value":1698566912}},{"address":{"type":"absolute","value":1698566923}},{"address":{"type":"absolute","value":1698566960}},{"address":{"type":"absolute","value":1698567011}},{"address":{"type":"absolute","value":1698567029}},{"address":{"type":"absolute","value":1698567056}}]},{"address":{"type":"absolute","value":1698567296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698567349}},{"address":{"type":"absolute","value":1698567364}},{"address":{"type":"absolute","value":1698567416}},{"address":{"type":"absolute","value":1698567425}}]},{"address":{"type":"absolute","value":1698567552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698567552}},{"address":{"type":"absolute","value":1698567632}},{"address":{"type":"absolute","value":1698567671}},{"address":{"type":"absolute","value":1698567776}},{"address":{"type":"absolute","value":1698567835}}]},{"address":{"type":"absolute","value":1698567872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698567872}},{"address":{"type":"absolute","value":1698567952}},{"address":{"type":"absolute","value":1698567987}},{"address":{"type":"absolute","value":1698568165}},{"address":{"type":"absolute","value":1698568179}}]},{"address":{"type":"absolute","value":1698568224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698568224}},{"address":{"type":"absolute","value":1698568304}},{"address":{"type":"absolute","value":1698568339}},{"address":{"type":"absolute","value":1698568416}},{"address":{"type":"absolute","value":1698568482}}]},{"address":{"type":"absolute","value":1698568512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698568575}},{"address":{"type":"absolute","value":1698568595}},{"address":{"type":"absolute","value":1698568626}},{"address":{"type":"absolute","value":1698568659}},{"address":{"type":"absolute","value":1698568677}},{"address":{"type":"absolute","value":1698568750}},{"address":{"type":"absolute","value":1698568819}},{"address":{"type":"absolute","value":1698568960}},{"address":{"type":"absolute","value":1698569175}},{"address":{"type":"absolute","value":1698569286}},{"address":{"type":"absolute","value":1698569318}},{"address":{"type":"absolute","value":1698569495}},{"address":{"type":"absolute","value":1698569607}},{"address":{"type":"absolute","value":1698569637}},{"address":{"type":"absolute","value":1698569815}},{"address":{"type":"absolute","value":1698569926}},{"address":{"type":"absolute","value":1698569958}},{"address":{"type":"absolute","value":1698570124}},{"address":{"type":"absolute","value":1698570246}},{"address":{"type":"absolute","value":1698570276}},{"address":{"type":"absolute","value":1698570304}},{"address":{"type":"absolute","value":1698570352}},{"address":{"type":"absolute","value":1698570960}},{"address":{"type":"absolute","value":1698570976}}]},{"address":{"type":"absolute","value":1698571360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698568575}},{"address":{"type":"absolute","value":1698568595}},{"address":{"type":"absolute","value":1698568659}},{"address":{"type":"absolute","value":1698568677}},{"address":{"type":"absolute","value":1698568750}},{"address":{"type":"absolute","value":1698568819}},{"address":{"type":"absolute","value":1698568960}},{"address":{"type":"absolute","value":1698569175}},{"address":{"type":"absolute","value":1698569286}},{"address":{"type":"absolute","value":1698569318}},{"address":{"type":"absolute","value":1698569495}},{"address":{"type":"absolute","value":1698569607}},{"address":{"type":"absolute","value":1698569637}},{"address":{"type":"absolute","value":1698569815}},{"address":{"type":"absolute","value":1698569926}},{"address":{"type":"absolute","value":1698569958}},{"address":{"type":"absolute","value":1698570124}},{"address":{"type":"absolute","value":1698570246}},{"address":{"type":"absolute","value":1698570276}},{"address":{"type":"absolute","value":1698570304}},{"address":{"type":"absolute","value":1698570352}},{"address":{"type":"absolute","value":1698570960}},{"address":{"type":"absolute","value":1698570976}}]},{"address":{"type":"absolute","value":1698571376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698571376}}]},{"address":{"type":"absolute","value":1698572368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698572368}}]},{"address":{"type":"absolute","value":1698573344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698573344}}]},{"address":{"type":"absolute","value":1698576792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698576792}}]},{"address":{"type":"absolute","value":1698582416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698582483}},{"address":{"type":"absolute","value":1698582592}},{"address":{"type":"absolute","value":1698582610}},{"address":{"type":"absolute","value":1698582628}},{"address":{"type":"absolute","value":1698582704}}]},{"address":{"type":"absolute","value":1698583136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698582483}},{"address":{"type":"absolute","value":1698582592}},{"address":{"type":"absolute","value":1698582610}},{"address":{"type":"absolute","value":1698582628}},{"address":{"type":"absolute","value":1698582704}}]},{"address":{"type":"absolute","value":1698583152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698583152}},{"address":{"type":"absolute","value":1698583232}},{"address":{"type":"absolute","value":1698583271}},{"address":{"type":"absolute","value":1698583376}},{"address":{"type":"absolute","value":1698583435}}]},{"address":{"type":"absolute","value":1698583472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698583472}},{"address":{"type":"absolute","value":1698583552}},{"address":{"type":"absolute","value":1698583587}},{"address":{"type":"absolute","value":1698583765}},{"address":{"type":"absolute","value":1698583779}}]},{"address":{"type":"absolute","value":1698583824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698583824}},{"address":{"type":"absolute","value":1698583904}},{"address":{"type":"absolute","value":1698583939}},{"address":{"type":"absolute","value":1698584016}},{"address":{"type":"absolute","value":1698584082}}]},{"address":{"type":"absolute","value":1698584112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698584112}}]},{"address":{"type":"absolute","value":1698585168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698585168}}]},{"address":{"type":"absolute","value":1698586232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698586232}}]},{"address":{"type":"absolute","value":1698590136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698590136}}]},{"address":{"type":"absolute","value":1698594056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698594056}}]},{"address":{"type":"absolute","value":1698594336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698594352}},{"address":{"type":"absolute","value":1698594416}},{"address":{"type":"absolute","value":1698594428}},{"address":{"type":"absolute","value":1698594441}},{"address":{"type":"absolute","value":1698594482}}]},{"address":{"type":"absolute","value":1698594624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698594624}},{"address":{"type":"absolute","value":1698595040}},{"address":{"type":"absolute","value":1698595048}}]},{"address":{"type":"absolute","value":1698595696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698595729}}]},{"address":{"type":"absolute","value":1698598064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598064}}]},{"address":{"type":"absolute","value":1698598112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598112}}]},{"address":{"type":"absolute","value":1698598144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598196}},{"address":{"type":"absolute","value":1698598275}},{"address":{"type":"absolute","value":1698598347}}]},{"address":{"type":"absolute","value":1698598432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698598816}},{"address":{"type":"absolute","value":1698599143}},{"address":{"type":"absolute","value":1698599152}},{"address":{"type":"absolute","value":1698599202}},{"address":{"type":"absolute","value":1698599233}},{"address":{"type":"absolute","value":1698599328}},{"address":{"type":"absolute","value":1698599365}}]},{"address":{"type":"absolute","value":1698599616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599656}},{"address":{"type":"absolute","value":1698599701}},{"address":{"type":"absolute","value":1698599725}}]},{"address":{"type":"absolute","value":1698599792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599792}},{"address":{"type":"absolute","value":1698599817}},{"address":{"type":"absolute","value":1698599891}},{"address":{"type":"absolute","value":1698599920}}]},{"address":{"type":"absolute","value":1698599952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599792}},{"address":{"type":"absolute","value":1698599817}},{"address":{"type":"absolute","value":1698599891}},{"address":{"type":"absolute","value":1698599920}}]},{"address":{"type":"absolute","value":1698599984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698599984}},{"address":{"type":"absolute","value":1698600002}},{"address":{"type":"absolute","value":1698600041}}]},{"address":{"type":"absolute","value":1698600080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600080}},{"address":{"type":"absolute","value":1698600149}},{"address":{"type":"absolute","value":1698600197}},{"address":{"type":"absolute","value":1698600240}},{"address":{"type":"absolute","value":1698600304}}]},{"address":{"type":"absolute","value":1698600352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600352}},{"address":{"type":"absolute","value":1698600416}},{"address":{"type":"absolute","value":1698600552}},{"address":{"type":"absolute","value":1698600581}}]},{"address":{"type":"absolute","value":1698600624},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600624}},{"address":{"type":"absolute","value":1698600643}},{"address":{"type":"absolute","value":1698600678}},{"address":{"type":"absolute","value":1698600691}}]},{"address":{"type":"absolute","value":1698600720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600720}},{"address":{"type":"absolute","value":1698600784}},{"address":{"type":"absolute","value":1698600834}},{"address":{"type":"absolute","value":1698600896}}]},{"address":{"type":"absolute","value":1698600928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698600928}}]},{"address":{"type":"absolute","value":1698606696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698606696}}]},{"address":{"type":"absolute","value":1698622672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698622672}}]},{"address":{"type":"absolute","value":1698627072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627088}}]},{"address":{"type":"absolute","value":1698627168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627088}}]},{"address":{"type":"absolute","value":1698627184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627088}}]},{"address":{"type":"absolute","value":1698627248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627278}}]},{"address":{"type":"absolute","value":1698627360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698627384}},{"address":{"type":"absolute","value":1698627388}},{"address":{"type":"absolute","value":1698627395}},{"address":{"type":"absolute","value":1698627408}},{"address":{"type":"absolute","value":1698627520}},{"address":{"type":"absolute","value":1698628004}},{"address":{"type":"absolute","value":1698642496}}]},{"address":{"type":"absolute","value":1698628080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698628119}}]},{"address":{"type":"absolute","value":1698628160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698628160}},{"address":{"type":"absolute","value":1698628225}},{"address":{"type":"absolute","value":1698628292}},{"address":{"type":"absolute","value":1698628353}},{"address":{"type":"absolute","value":1698628388}},{"address":{"type":"absolute","value":1698628483}},{"address":{"type":"absolute","value":1698628551}},{"address":{"type":"absolute","value":1698628693}},{"address":{"type":"absolute","value":1698628736}}]},{"address":{"type":"absolute","value":1698628896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698629120}},{"address":{"type":"absolute","value":1698629303}},{"address":{"type":"absolute","value":1698629344}},{"address":{"type":"absolute","value":1698629392}},{"address":{"type":"absolute","value":1698629424}},{"address":{"type":"absolute","value":1698629446}},{"address":{"type":"absolute","value":1698629491}},{"address":{"type":"absolute","value":1698629568}},{"address":{"type":"absolute","value":1698629696}},{"address":{"type":"absolute","value":1698629727}},{"address":{"type":"absolute","value":1698629749}},{"address":{"type":"absolute","value":1698629794}},{"address":{"type":"absolute","value":1698629813}},{"address":{"type":"absolute","value":1698629920}},{"address":{"type":"absolute","value":1698629951}},{"address":{"type":"absolute","value":1698630184}},{"address":{"type":"absolute","value":1698630188}}]},{"address":{"type":"absolute","value":1698630528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698629120}},{"address":{"type":"absolute","value":1698629303}},{"address":{"type":"absolute","value":1698629344}},{"address":{"type":"absolute","value":1698629392}},{"address":{"type":"absolute","value":1698629424}},{"address":{"type":"absolute","value":1698629446}},{"address":{"type":"absolute","value":1698629491}},{"address":{"type":"absolute","value":1698629568}},{"address":{"type":"absolute","value":1698629696}},{"address":{"type":"absolute","value":1698629727}},{"address":{"type":"absolute","value":1698629749}},{"address":{"type":"absolute","value":1698629794}},{"address":{"type":"absolute","value":1698629813}},{"address":{"type":"absolute","value":1698629920}},{"address":{"type":"absolute","value":1698629951}},{"address":{"type":"absolute","value":1698630184}},{"address":{"type":"absolute","value":1698630188}}]},{"address":{"type":"absolute","value":1698630544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698630686}},{"address":{"type":"absolute","value":1698630704}}]},{"address":{"type":"absolute","value":1698630784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698630926}},{"address":{"type":"absolute","value":1698630944}}]},{"address":{"type":"absolute","value":1698631024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631166}},{"address":{"type":"absolute","value":1698631184}}]},{"address":{"type":"absolute","value":1698631264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631264}},{"address":{"type":"absolute","value":1698631292}},{"address":{"type":"absolute","value":1698631373}},{"address":{"type":"absolute","value":1698631420}},{"address":{"type":"absolute","value":1698631440}},{"address":{"type":"absolute","value":1698631493}}]},{"address":{"type":"absolute","value":1698631536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631648}},{"address":{"type":"absolute","value":1698631736}},{"address":{"type":"absolute","value":1698631783}},{"address":{"type":"absolute","value":1698631808}}]},{"address":{"type":"absolute","value":1698631904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698631984}},{"address":{"type":"absolute","value":1698632057}},{"address":{"type":"absolute","value":1698632080}},{"address":{"type":"absolute","value":1698632117}},{"address":{"type":"absolute","value":1698644352}},{"address":{"type":"absolute","value":1698644391}},{"address":{"type":"absolute","value":1698652880}},{"address":{"type":"absolute","value":1698653338}},{"address":{"type":"absolute","value":1698653438}},{"address":{"type":"absolute","value":1698653463}},{"address":{"type":"absolute","value":1698653669}},{"address":{"type":"absolute","value":1698653708}}]},{"address":{"type":"absolute","value":1698632160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698632256}},{"address":{"type":"absolute","value":1698632303}},{"address":{"type":"absolute","value":1698632378}}]},{"address":{"type":"absolute","value":1698632464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698632544}},{"address":{"type":"absolute","value":1698632613}},{"address":{"type":"absolute","value":1698632626}},{"address":{"type":"absolute","value":1698632672}},{"address":{"type":"absolute","value":1698643152}},{"address":{"type":"absolute","value":1698643187}},{"address":{"type":"absolute","value":1698651191}}]},{"address":{"type":"absolute","value":1698632720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698632816}},{"address":{"type":"absolute","value":1698632880}},{"address":{"type":"absolute","value":1698632953}},{"address":{"type":"absolute","value":1698632976}},{"address":{"type":"absolute","value":1698643456}},{"address":{"type":"absolute","value":1698643502}},{"address":{"type":"absolute","value":1698651488}},{"address":{"type":"absolute","value":1698651526}}]},{"address":{"type":"absolute","value":1698633024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698633138}},{"address":{"type":"absolute","value":1698633429}},{"address":{"type":"absolute","value":1698633473}}]},{"address":{"type":"absolute","value":1698633696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698633792}},{"address":{"type":"absolute","value":1698633959}},{"address":{"type":"absolute","value":1698633996}},{"address":{"type":"absolute","value":1698634011}}]},{"address":{"type":"absolute","value":1698634064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698634064}},{"address":{"type":"absolute","value":1698636216}}]},{"address":{"type":"absolute","value":1698638088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698638088}},{"address":{"type":"absolute","value":1698638376}}]},{"address":{"type":"absolute","value":1698642096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642096}}]},{"address":{"type":"absolute","value":1698642128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642128}},{"address":{"type":"absolute","value":1698642313}}]},{"address":{"type":"absolute","value":1698642496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642496}}]},{"address":{"type":"absolute","value":1698642784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698642784}}]},{"address":{"type":"absolute","value":1698643008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643152}},{"address":{"type":"absolute","value":1698643187}}]},{"address":{"type":"absolute","value":1698643312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643456}},{"address":{"type":"absolute","value":1698643502}}]},{"address":{"type":"absolute","value":1698643616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643812}},{"address":{"type":"absolute","value":1698643852}}]},{"address":{"type":"absolute","value":1698643968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698643968}}]},{"address":{"type":"absolute","value":1698644208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698644352}},{"address":{"type":"absolute","value":1698644391}}]},{"address":{"type":"absolute","value":1698644512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698644656}},{"address":{"type":"absolute","value":1698644699}}]},{"address":{"type":"absolute","value":1698644832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698644997}},{"address":{"type":"absolute","value":1698645024}},{"address":{"type":"absolute","value":1698645089}},{"address":{"type":"absolute","value":1698645337}},{"address":{"type":"absolute","value":1698645360}}]},{"address":{"type":"absolute","value":1698645456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698645595}},{"address":{"type":"absolute","value":1698645616}},{"address":{"type":"absolute","value":1698645669}}]},{"address":{"type":"absolute","value":1698645968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698645968}}]},{"address":{"type":"absolute","value":1698646688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698647466}},{"address":{"type":"absolute","value":1698647488}}]},{"address":{"type":"absolute","value":1698647287},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698647305}},{"address":{"type":"absolute","value":1698647347}},{"address":{"type":"absolute","value":1698647430}}]},{"address":{"type":"absolute","value":1698648336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698648336}}]},{"address":{"type":"absolute","value":1698648368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698648368}},{"address":{"type":"absolute","value":1698648392}},{"address":{"type":"absolute","value":1698648919}},{"address":{"type":"absolute","value":1698648969}},{"address":{"type":"absolute","value":1698649680}}]},{"address":{"type":"absolute","value":1698650976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698651191}}]},{"address":{"type":"absolute","value":1698651248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698651488}},{"address":{"type":"absolute","value":1698651526}}]},{"address":{"type":"absolute","value":1698651568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698651568}},{"address":{"type":"absolute","value":1698652194}},{"address":{"type":"absolute","value":1698652294}},{"address":{"type":"absolute","value":1698652319}},{"address":{"type":"absolute","value":1698652571}},{"address":{"type":"absolute","value":1698652606}}]},{"address":{"type":"absolute","value":1698652880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698652880}},{"address":{"type":"absolute","value":1698653338}},{"address":{"type":"absolute","value":1698653438}},{"address":{"type":"absolute","value":1698653463}},{"address":{"type":"absolute","value":1698653669}},{"address":{"type":"absolute","value":1698653708}}]},{"address":{"type":"absolute","value":1698653760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698653760}},{"address":{"type":"absolute","value":1698654214}},{"address":{"type":"absolute","value":1698654314}},{"address":{"type":"absolute","value":1698654348}},{"address":{"type":"absolute","value":1698654566}},{"address":{"type":"absolute","value":1698654600}}]},{"address":{"type":"absolute","value":1698654656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698654778}},{"address":{"type":"absolute","value":1698654998}},{"address":{"type":"absolute","value":1698655029}},{"address":{"type":"absolute","value":1698655178}},{"address":{"type":"absolute","value":1698655394}},{"address":{"type":"absolute","value":1698655453}},{"address":{"type":"absolute","value":1698655488}},{"address":{"type":"absolute","value":1698655996}},{"address":{"type":"absolute","value":1698656105}},{"address":{"type":"absolute","value":1698656140}},{"address":{"type":"absolute","value":1698656354}},{"address":{"type":"absolute","value":1698656413}},{"address":{"type":"absolute","value":1698656448}},{"address":{"type":"absolute","value":1698656972}},{"address":{"type":"absolute","value":1698657065}},{"address":{"type":"absolute","value":1698657100}},{"address":{"type":"absolute","value":1698657318}}]},{"address":{"type":"absolute","value":1698657376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698657466}},{"address":{"type":"absolute","value":1698657680}},{"address":{"type":"absolute","value":1698657703}},{"address":{"type":"absolute","value":1698657789}},{"address":{"type":"absolute","value":1698657824}},{"address":{"type":"absolute","value":1698658313}},{"address":{"type":"absolute","value":1698658362}},{"address":{"type":"absolute","value":1698658394}},{"address":{"type":"absolute","value":1698658606}}]},{"address":{"type":"absolute","value":1698658768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698658768}}]},{"address":{"type":"absolute","value":1698658944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698659118}}]},{"address":{"type":"absolute","value":1698659472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698659556}},{"address":{"type":"absolute","value":1698660380}},{"address":{"type":"absolute","value":1698660448}},{"address":{"type":"absolute","value":1698660461}},{"address":{"type":"absolute","value":1698660611}},{"address":{"type":"absolute","value":1698660662}},{"address":{"type":"absolute","value":1698660931}},{"address":{"type":"absolute","value":1698661008}},{"address":{"type":"absolute","value":1698661034}},{"address":{"type":"absolute","value":1698661309}},{"address":{"type":"absolute","value":1698661440}},{"address":{"type":"absolute","value":1698662257}},{"address":{"type":"absolute","value":1698662270}},{"address":{"type":"absolute","value":1698662526}},{"address":{"type":"absolute","value":1698662585}},{"address":{"type":"absolute","value":1698663060}},{"address":{"type":"absolute","value":1698663136}},{"address":{"type":"absolute","value":1698663162}}]},{"address":{"type":"absolute","value":1698663648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698663891}},{"address":{"type":"absolute","value":1698663908}},{"address":{"type":"absolute","value":1698663968}},{"address":{"type":"absolute","value":1698664068}}]},{"address":{"type":"absolute","value":1698664208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698664451}},{"address":{"type":"absolute","value":1698664468}},{"address":{"type":"absolute","value":1698664553}},{"address":{"type":"absolute","value":1698664688}}]},{"address":{"type":"absolute","value":1698664832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698665059}},{"address":{"type":"absolute","value":1698665076}},{"address":{"type":"absolute","value":1698665122}},{"address":{"type":"absolute","value":1698665217}}]},{"address":{"type":"absolute","value":1698665328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698665533}},{"address":{"type":"absolute","value":1698665617}},{"address":{"type":"absolute","value":1698665802}},{"address":{"type":"absolute","value":1698665935}},{"address":{"type":"absolute","value":1698665991}},{"address":{"type":"absolute","value":1698666035}},{"address":{"type":"absolute","value":1698666161}}]},{"address":{"type":"absolute","value":1698666288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698666489}},{"address":{"type":"absolute","value":1698666573}},{"address":{"type":"absolute","value":1698666826}},{"address":{"type":"absolute","value":1698666880}},{"address":{"type":"absolute","value":1698667013}}]},{"address":{"type":"absolute","value":1698667136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698667136}}]},{"address":{"type":"absolute","value":1698669272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698669272}}]},{"address":{"type":"absolute","value":1698671408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698671408}}]},{"address":{"type":"absolute","value":1698678216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698678216}}]},{"address":{"type":"absolute","value":1698685088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685088}}]},{"address":{"type":"absolute","value":1698685312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685312}}]},{"address":{"type":"absolute","value":1698685504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685504}}]},{"address":{"type":"absolute","value":1698685688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685688}}]},{"address":{"type":"absolute","value":1698685952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698685952}}]},{"address":{"type":"absolute","value":1698686232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698686232}}]},{"address":{"type":"absolute","value":1698704576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698704576}}]},{"address":{"type":"absolute","value":1698709200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698709200}}]},{"address":{"type":"absolute","value":1698713936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698713936}}]},{"address":{"type":"absolute","value":1698713968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698713968}}]},{"address":{"type":"absolute","value":1698714000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698714000}},{"address":{"type":"absolute","value":1698719643}},{"address":{"type":"absolute","value":1698719728}}]},{"address":{"type":"absolute","value":1698719792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698719980}},{"address":{"type":"absolute","value":1698720199}},{"address":{"type":"absolute","value":1698720211}},{"address":{"type":"absolute","value":1698720240}},{"address":{"type":"absolute","value":1698720259}},{"address":{"type":"absolute","value":1698720288}}]},{"address":{"type":"absolute","value":1698720320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698720356}},{"address":{"type":"absolute","value":1698720421}}]},{"address":{"type":"absolute","value":1698720448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698720594}},{"address":{"type":"absolute","value":1698720645}},{"address":{"type":"absolute","value":1698720736}},{"address":{"type":"absolute","value":1698720781}},{"address":{"type":"absolute","value":1698720827}},{"address":{"type":"absolute","value":1698720848}},{"address":{"type":"absolute","value":1698720924}}]},{"address":{"type":"absolute","value":1698721072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698721218}},{"address":{"type":"absolute","value":1698721269}},{"address":{"type":"absolute","value":1698721360}},{"address":{"type":"absolute","value":1698721405}},{"address":{"type":"absolute","value":1698721451}},{"address":{"type":"absolute","value":1698721472}},{"address":{"type":"absolute","value":1698721557}}]},{"address":{"type":"absolute","value":1698721712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698721856}},{"address":{"type":"absolute","value":1698721907}},{"address":{"type":"absolute","value":1698722000}},{"address":{"type":"absolute","value":1698722045}},{"address":{"type":"absolute","value":1698722091}},{"address":{"type":"absolute","value":1698722098}},{"address":{"type":"absolute","value":1698722167}}]},{"address":{"type":"absolute","value":1698722288},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698722500}},{"address":{"type":"absolute","value":1698722757}},{"address":{"type":"absolute","value":1698722778}},{"address":{"type":"absolute","value":1698722848}},{"address":{"type":"absolute","value":1698722931}},{"address":{"type":"absolute","value":1698723156}},{"address":{"type":"absolute","value":1698723174}},{"address":{"type":"absolute","value":1698723178}},{"address":{"type":"absolute","value":1698723244}},{"address":{"type":"absolute","value":1698723262}},{"address":{"type":"absolute","value":1698723296}}]},{"address":{"type":"absolute","value":1698723440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698723642}},{"address":{"type":"absolute","value":1698723726}},{"address":{"type":"absolute","value":1698723857}},{"address":{"type":"absolute","value":1698723928}},{"address":{"type":"absolute","value":1698724000}},{"address":{"type":"absolute","value":1698724212}},{"address":{"type":"absolute","value":1698724216}},{"address":{"type":"absolute","value":1698724280}},{"address":{"type":"absolute","value":1698724317}}]},{"address":{"type":"absolute","value":1698724464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698724464}}]},{"address":{"type":"absolute","value":1698745032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698745032}}]},{"address":{"type":"absolute","value":1698766728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698766728}}]},{"address":{"type":"absolute","value":1698767272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698767272}}]},{"address":{"type":"absolute","value":1698767816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698767816}}]},{"address":{"type":"absolute","value":1698768192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698768192}}]},{"address":{"type":"absolute","value":1698784880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698784880}}]},{"address":{"type":"absolute","value":1698802608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698802608}}]},{"address":{"type":"absolute","value":1698803168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698803168}}]},{"address":{"type":"absolute","value":1698803728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698803728}}]},{"address":{"type":"absolute","value":1698804144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804224}},{"address":{"type":"absolute","value":1698804238}},{"address":{"type":"absolute","value":1698804383}}]},{"address":{"type":"absolute","value":1698804480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804480}}]},{"address":{"type":"absolute","value":1698804512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804592}},{"address":{"type":"absolute","value":1698804606}},{"address":{"type":"absolute","value":1698804737}}]},{"address":{"type":"absolute","value":1698804816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804816}}]},{"address":{"type":"absolute","value":1698804848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804961}},{"address":{"type":"absolute","value":1698804995}},{"address":{"type":"absolute","value":1698805026}},{"address":{"type":"absolute","value":1698805039}},{"address":{"type":"absolute","value":1698805088}},{"address":{"type":"absolute","value":1698805155}},{"address":{"type":"absolute","value":1698805179}}]},{"address":{"type":"absolute","value":1698805664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698804961}},{"address":{"type":"absolute","value":1698804995}},{"address":{"type":"absolute","value":1698805026}},{"address":{"type":"absolute","value":1698805039}},{"address":{"type":"absolute","value":1698805088}},{"address":{"type":"absolute","value":1698805155}},{"address":{"type":"absolute","value":1698805179}}]},{"address":{"type":"absolute","value":1698805680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698805680}}]},{"address":{"type":"absolute","value":1698808128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698808128}}]},{"address":{"type":"absolute","value":1698808160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698808160}}]},{"address":{"type":"absolute","value":1698810608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698810608}}]},{"address":{"type":"absolute","value":1698810640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698810784}},{"address":{"type":"absolute","value":1698810831}},{"address":{"type":"absolute","value":1698810941}},{"address":{"type":"absolute","value":1698810985}}]},{"address":{"type":"absolute","value":1698811216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698811216}}]},{"address":{"type":"absolute","value":1698813712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698813712}}]},{"address":{"type":"absolute","value":1698817280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698817280}}]},{"address":{"type":"absolute","value":1698817344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698817344}}]},{"address":{"type":"absolute","value":1698819552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698819552}}]},{"address":{"type":"absolute","value":1698821760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698821760}}]},{"address":{"type":"absolute","value":1698824720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698824720}}]},{"address":{"type":"absolute","value":1698827680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698811216}},{"address":{"type":"absolute","value":1698813712}},{"address":{"type":"absolute","value":1698817280}}]},{"address":{"type":"absolute","value":1698827760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698827760}},{"address":{"type":"absolute","value":1698827865}}]},{"address":{"type":"absolute","value":1698827952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698827952}},{"address":{"type":"absolute","value":1698828057}}]},{"address":{"type":"absolute","value":1698828144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828144}}]},{"address":{"type":"absolute","value":1698828192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828192}}]},{"address":{"type":"absolute","value":1698828240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828398}}]},{"address":{"type":"absolute","value":1698828912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698828912}},{"address":{"type":"absolute","value":1698829058}},{"address":{"type":"absolute","value":1698829136}}]},{"address":{"type":"absolute","value":1698829312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698829312}},{"address":{"type":"absolute","value":1698829472}},{"address":{"type":"absolute","value":1698829532}},{"address":{"type":"absolute","value":1698829600}},{"address":{"type":"absolute","value":1698829671}},{"address":{"type":"absolute","value":1698829728}},{"address":{"type":"absolute","value":1698829807}}]},{"address":{"type":"absolute","value":1698829936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698829936}},{"address":{"type":"absolute","value":1698830096}},{"address":{"type":"absolute","value":1698830156}},{"address":{"type":"absolute","value":1698830224}},{"address":{"type":"absolute","value":1698830285}},{"address":{"type":"absolute","value":1698830352}},{"address":{"type":"absolute","value":1698830441}}]},{"address":{"type":"absolute","value":1698830592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698830592}},{"address":{"type":"absolute","value":1698830739}},{"address":{"type":"absolute","value":1698830799}},{"address":{"type":"absolute","value":1698830864}},{"address":{"type":"absolute","value":1698830935}},{"address":{"type":"absolute","value":1698830992}},{"address":{"type":"absolute","value":1698831065}}]},{"address":{"type":"absolute","value":1698831184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698831184}},{"address":{"type":"absolute","value":1698831409}},{"address":{"type":"absolute","value":1698831493}},{"address":{"type":"absolute","value":1698831688}},{"address":{"type":"absolute","value":1698831709}},{"address":{"type":"absolute","value":1698831780}},{"address":{"type":"absolute","value":1698831929}},{"address":{"type":"absolute","value":1698832013}},{"address":{"type":"absolute","value":1698832151}},{"address":{"type":"absolute","value":1698832172}},{"address":{"type":"absolute","value":1698832176}},{"address":{"type":"absolute","value":1698832242}},{"address":{"type":"absolute","value":1698832291}}]},{"address":{"type":"absolute","value":1698832432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698832432}},{"address":{"type":"absolute","value":1698832643}},{"address":{"type":"absolute","value":1698832727}},{"address":{"type":"absolute","value":1698832898}},{"address":{"type":"absolute","value":1698832969}},{"address":{"type":"absolute","value":1698833099}},{"address":{"type":"absolute","value":1698833183}},{"address":{"type":"absolute","value":1698833296}},{"address":{"type":"absolute","value":1698833300}},{"address":{"type":"absolute","value":1698833367}},{"address":{"type":"absolute","value":1698833411}}]},{"address":{"type":"absolute","value":1698833800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698833800}},{"address":{"type":"absolute","value":1698852224}}]},{"address":{"type":"absolute","value":1698858208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698858747}},{"address":{"type":"absolute","value":1698876616}}]},{"address":{"type":"absolute","value":1698883416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698883416}}]},{"address":{"type":"absolute","value":1698885112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698885112}}]},{"address":{"type":"absolute","value":1698892616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698889168}}]},{"address":{"type":"absolute","value":1698892936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698892936}},{"address":{"type":"absolute","value":1698914560}}]},{"address":{"type":"absolute","value":1698921616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698922180}},{"address":{"type":"absolute","value":1698943224}}]},{"address":{"type":"absolute","value":1698950280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698950280}}]},{"address":{"type":"absolute","value":1698951696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698951696}}]},{"address":{"type":"absolute","value":1698953856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698953856}}]},{"address":{"type":"absolute","value":1698956128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956176}},{"address":{"type":"absolute","value":1698956199}}]},{"address":{"type":"absolute","value":1698956256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956361}},{"address":{"type":"absolute","value":1698956385}},{"address":{"type":"absolute","value":1698956427}},{"address":{"type":"absolute","value":1698956476}},{"address":{"type":"absolute","value":1698956487}},{"address":{"type":"absolute","value":1698956514}},{"address":{"type":"absolute","value":1698956556}},{"address":{"type":"absolute","value":1698956585}},{"address":{"type":"absolute","value":1698956635}},{"address":{"type":"absolute","value":1698956668}},{"address":{"type":"absolute","value":1698956746}}]},{"address":{"type":"absolute","value":1698956832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956832}}]},{"address":{"type":"absolute","value":1698956864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698956864}},{"address":{"type":"absolute","value":1698956976}},{"address":{"type":"absolute","value":1698957059}},{"address":{"type":"absolute","value":1698957216}},{"address":{"type":"absolute","value":1698957232}}]},{"address":{"type":"absolute","value":1698957264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957290}}]},{"address":{"type":"absolute","value":1698957344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957427}},{"address":{"type":"absolute","value":1698957472}},{"address":{"type":"absolute","value":1698957552}},{"address":{"type":"absolute","value":1698957664}}]},{"address":{"type":"absolute","value":1698957856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957856}}]},{"address":{"type":"absolute","value":1698957888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698957888}},{"address":{"type":"absolute","value":1698957929}}]},{"address":{"type":"absolute","value":1698958000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958000}}]},{"address":{"type":"absolute","value":1698958240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958240}}]},{"address":{"type":"absolute","value":1698958400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958400}}]},{"address":{"type":"absolute","value":1698958576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698958710}},{"address":{"type":"absolute","value":1698958781}},{"address":{"type":"absolute","value":1698958816}},{"address":{"type":"absolute","value":1698958869}},{"address":{"type":"absolute","value":1698958953}},{"address":{"type":"absolute","value":1698958979}},{"address":{"type":"absolute","value":1698959005}},{"address":{"type":"absolute","value":1698959099}},{"address":{"type":"absolute","value":1698959173}}]},{"address":{"type":"absolute","value":1698959280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698959289}},{"address":{"type":"absolute","value":1698959296}}]},{"address":{"type":"absolute","value":1698959328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698959337}},{"address":{"type":"absolute","value":1698959344}}]},{"address":{"type":"absolute","value":1698959376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698959376}},{"address":{"type":"absolute","value":1698959509}},{"address":{"type":"absolute","value":1698959621}},{"address":{"type":"absolute","value":1698959856}},{"address":{"type":"absolute","value":1698959873}}]},{"address":{"type":"absolute","value":1698959904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698960027}}]},{"address":{"type":"absolute","value":1698960128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698960166}}]},{"address":{"type":"absolute","value":1698960344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698960344}},{"address":{"type":"absolute","value":1698960598}},{"address":{"type":"absolute","value":1698960840}},{"address":{"type":"absolute","value":1698962067}},{"address":{"type":"absolute","value":1698963474}},{"address":{"type":"absolute","value":1698964028}},{"address":{"type":"absolute","value":1698964329}},{"address":{"type":"absolute","value":1698964337}}]},{"address":{"type":"absolute","value":1698964368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698964368}}]},{"address":{"type":"absolute","value":1698964432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698964432}}]},{"address":{"type":"absolute","value":1698965072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965072}}]},{"address":{"type":"absolute","value":1698965152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965152}}]},{"address":{"type":"absolute","value":1698965792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965812}}]},{"address":{"type":"absolute","value":1698965856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965856}},{"address":{"type":"absolute","value":1698965880}},{"address":{"type":"absolute","value":1698965907}},{"address":{"type":"absolute","value":1698965935}},{"address":{"type":"absolute","value":1698965969}}]},{"address":{"type":"absolute","value":1698965984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698965984}}]},{"address":{"type":"absolute","value":1698966080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698966138}},{"address":{"type":"absolute","value":1698966198}}]},{"address":{"type":"absolute","value":1698966320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698966448}},{"address":{"type":"absolute","value":1698966521}},{"address":{"type":"absolute","value":1698966560}},{"address":{"type":"absolute","value":1698966611}},{"address":{"type":"absolute","value":1698966627}},{"address":{"type":"absolute","value":1698966676}},{"address":{"type":"absolute","value":1698966788}},{"address":{"type":"absolute","value":1698966848}},{"address":{"type":"absolute","value":1698966870}},{"address":{"type":"absolute","value":1698966896}}]},{"address":{"type":"absolute","value":1698967040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698966448}},{"address":{"type":"absolute","value":1698966521}},{"address":{"type":"absolute","value":1698966560}},{"address":{"type":"absolute","value":1698966611}},{"address":{"type":"absolute","value":1698966627}},{"address":{"type":"absolute","value":1698966676}},{"address":{"type":"absolute","value":1698966788}},{"address":{"type":"absolute","value":1698966848}},{"address":{"type":"absolute","value":1698966870}},{"address":{"type":"absolute","value":1698966896}}]},{"address":{"type":"absolute","value":1698967072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698967219}},{"address":{"type":"absolute","value":1698967344}},{"address":{"type":"absolute","value":1698967552}},{"address":{"type":"absolute","value":1698967569}},{"address":{"type":"absolute","value":1698967648}},{"address":{"type":"absolute","value":1698967760}}]},{"address":{"type":"absolute","value":1698967808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698968043}}]},{"address":{"type":"absolute","value":1698968192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698968192}},{"address":{"type":"absolute","value":1698968512}},{"address":{"type":"absolute","value":1698968773}},{"address":{"type":"absolute","value":1698970142}},{"address":{"type":"absolute","value":1698970923}},{"address":{"type":"absolute","value":1698971012}},{"address":{"type":"absolute","value":1698971071}},{"address":{"type":"absolute","value":1698971328}},{"address":{"type":"absolute","value":1698971405}},{"address":{"type":"absolute","value":1698971424}}]},{"address":{"type":"absolute","value":1698971584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698971584}},{"address":{"type":"absolute","value":1698971972}},{"address":{"type":"absolute","value":1698972233}},{"address":{"type":"absolute","value":1698973418}},{"address":{"type":"absolute","value":1698974199}},{"address":{"type":"absolute","value":1698974300}},{"address":{"type":"absolute","value":1698974359}},{"address":{"type":"absolute","value":1698974580}},{"address":{"type":"absolute","value":1698974657}},{"address":{"type":"absolute","value":1698974676}}]},{"address":{"type":"absolute","value":1698979904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698979904}},{"address":{"type":"absolute","value":1698980169}},{"address":{"type":"absolute","value":1698980509}}]},{"address":{"type":"absolute","value":1698980856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698980915}},{"address":{"type":"absolute","value":1698980941}},{"address":{"type":"absolute","value":1698980964}},{"address":{"type":"absolute","value":1698980977}},{"address":{"type":"absolute","value":1698980986}},{"address":{"type":"absolute","value":1698981010}},{"address":{"type":"absolute","value":1698981230}}]},{"address":{"type":"absolute","value":1698981432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698981521}},{"address":{"type":"absolute","value":1698982110}},{"address":{"type":"absolute","value":1698984066}}]},{"address":{"type":"absolute","value":1698984576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698984826}},{"address":{"type":"absolute","value":1698985151}},{"address":{"type":"absolute","value":1698985540}},{"address":{"type":"absolute","value":1698985592}}]},{"address":{"type":"absolute","value":1698988256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698988256}},{"address":{"type":"absolute","value":1698988285}}]},{"address":{"type":"absolute","value":1698989376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698989464}}]},{"address":{"type":"absolute","value":1698989488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698989488}}]},{"address":{"type":"absolute","value":1698989792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698990131}},{"address":{"type":"absolute","value":1698990263}}]},{"address":{"type":"absolute","value":1698990304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698990304}},{"address":{"type":"absolute","value":1698990553}}]},{"address":{"type":"absolute","value":1698991040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698991462}}]},{"address":{"type":"absolute","value":1698991600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698991879}}]},{"address":{"type":"absolute","value":1698992320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698992516}}]},{"address":{"type":"absolute","value":1698992576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698992767}},{"address":{"type":"absolute","value":1698994280}},{"address":{"type":"absolute","value":1698994407}},{"address":{"type":"absolute","value":1698994864}},{"address":{"type":"absolute","value":1698994977}},{"address":{"type":"absolute","value":1698995073}},{"address":{"type":"absolute","value":1698995097}},{"address":{"type":"absolute","value":1698995440}},{"address":{"type":"absolute","value":1698996240}},{"address":{"type":"absolute","value":1698996956}},{"address":{"type":"absolute","value":1698997914}}]},{"address":{"type":"absolute","value":1698998096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698998183}},{"address":{"type":"absolute","value":1698998192}}]},{"address":{"type":"absolute","value":1698998224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698998360}}]},{"address":{"type":"absolute","value":1698998704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698998704}},{"address":{"type":"absolute","value":1698998731}}]},{"address":{"type":"absolute","value":1698999664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698999752}}]},{"address":{"type":"absolute","value":1698999776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698999776}},{"address":{"type":"absolute","value":1698999916}}]},{"address":{"type":"absolute","value":1699000112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699000112}}]},{"address":{"type":"absolute","value":1699000208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699000208}},{"address":{"type":"absolute","value":1699000226}},{"address":{"type":"absolute","value":1699000244}},{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699000320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699000524}},{"address":{"type":"absolute","value":1699000938}}]},{"address":{"type":"absolute","value":1699001248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699001413}}]},{"address":{"type":"absolute","value":1699001888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699001972}},{"address":{"type":"absolute","value":1699002042}},{"address":{"type":"absolute","value":1699002324}},{"address":{"type":"absolute","value":1699002425}},{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699002512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699002621}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699002736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699002736}},{"address":{"type":"absolute","value":1699003021}}]},{"address":{"type":"absolute","value":1699003744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699004073}}]},{"address":{"type":"absolute","value":1699004880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005164}}]},{"address":{"type":"absolute","value":1699005232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005232}},{"address":{"type":"absolute","value":1699005295}}]},{"address":{"type":"absolute","value":1699005360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005360}},{"address":{"type":"absolute","value":1699005426}}]},{"address":{"type":"absolute","value":1699005488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699005628}},{"address":{"type":"absolute","value":1699005812}},{"address":{"type":"absolute","value":1699006109}},{"address":{"type":"absolute","value":1699006327}},{"address":{"type":"absolute","value":1699006385}},{"address":{"type":"absolute","value":1699007429}},{"address":{"type":"absolute","value":1699007487}},{"address":{"type":"absolute","value":1699008472}},{"address":{"type":"absolute","value":1699008507}},{"address":{"type":"absolute","value":1699008522}},{"address":{"type":"absolute","value":1699008656}},{"address":{"type":"absolute","value":1699008740}},{"address":{"type":"absolute","value":1699009480}},{"address":{"type":"absolute","value":1699010029}},{"address":{"type":"absolute","value":1699010925}}]},{"address":{"type":"absolute","value":1699011472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699011560}}]},{"address":{"type":"absolute","value":1699011584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699011814}},{"address":{"type":"absolute","value":1699011824}}]},{"address":{"type":"absolute","value":1699011856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699011957}},{"address":{"type":"absolute","value":1699012471}}]},{"address":{"type":"absolute","value":1699012656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699012656}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699012880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699012880}},{"address":{"type":"absolute","value":1699013096}}]},{"address":{"type":"absolute","value":1699013552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699013552}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699013664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699013858}}]},{"address":{"type":"absolute","value":1699014208},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699014258}},{"address":{"type":"absolute","value":1699014273}}]},{"address":{"type":"absolute","value":1699014448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699014708}}]},{"address":{"type":"absolute","value":1699015168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699015168}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699015424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699015722}}]},{"address":{"type":"absolute","value":1699016448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699016680}},{"address":{"type":"absolute","value":1699016808}}]},{"address":{"type":"absolute","value":1699016976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699017086}},{"address":{"type":"absolute","value":1699017296}},{"address":{"type":"absolute","value":1699017319}},{"address":{"type":"absolute","value":1699017873}},{"address":{"type":"absolute","value":1699017953}},{"address":{"type":"absolute","value":1699017976}},{"address":{"type":"absolute","value":1699018131}},{"address":{"type":"absolute","value":1699018238}},{"address":{"type":"absolute","value":1699018496}},{"address":{"type":"absolute","value":1699018509}},{"address":{"type":"absolute","value":1699018640}},{"address":{"type":"absolute","value":1699018836}},{"address":{"type":"absolute","value":1699018880}},{"address":{"type":"absolute","value":1699018912}},{"address":{"type":"absolute","value":1699018960}}]},{"address":{"type":"absolute","value":1699019440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699019538}},{"address":{"type":"absolute","value":1699019650}}]},{"address":{"type":"absolute","value":1699019664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699020042}},{"address":{"type":"absolute","value":1699020232}},{"address":{"type":"absolute","value":1699021088}}]},{"address":{"type":"absolute","value":1699021664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699021664}},{"address":{"type":"absolute","value":1699021985}},{"address":{"type":"absolute","value":1699022034}},{"address":{"type":"absolute","value":1699022384}}]},{"address":{"type":"absolute","value":1699023184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699023672}},{"address":{"type":"absolute","value":1699025081}}]},{"address":{"type":"absolute","value":1699025232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699025868}},{"address":{"type":"absolute","value":1699026096}},{"address":{"type":"absolute","value":1699026116}},{"address":{"type":"absolute","value":1699026903}},{"address":{"type":"absolute","value":1699027048}}]},{"address":{"type":"absolute","value":1699027680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699027808}},{"address":{"type":"absolute","value":1699028153}},{"address":{"type":"absolute","value":1699029200}}]},{"address":{"type":"absolute","value":1699029984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699029984}},{"address":{"type":"absolute","value":1699030013}}]},{"address":{"type":"absolute","value":1699031104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699031104}}]},{"address":{"type":"absolute","value":1699031152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699031338}},{"address":{"type":"absolute","value":1699031588}},{"address":{"type":"absolute","value":1699031605}},{"address":{"type":"absolute","value":1699031744}},{"address":{"type":"absolute","value":1699031809}},{"address":{"type":"absolute","value":1699031929}},{"address":{"type":"absolute","value":1699031953}},{"address":{"type":"absolute","value":1699032050}},{"address":{"type":"absolute","value":1699032083}},{"address":{"type":"absolute","value":1699032149}},{"address":{"type":"absolute","value":1699032173}}]},{"address":{"type":"absolute","value":1699032416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699032416}},{"address":{"type":"absolute","value":1699032508}},{"address":{"type":"absolute","value":1699033407}},{"address":{"type":"absolute","value":1699034480}}]},{"address":{"type":"absolute","value":1699034832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699035087}},{"address":{"type":"absolute","value":1699036468}},{"address":{"type":"absolute","value":1699036550}},{"address":{"type":"absolute","value":1699037273}}]},{"address":{"type":"absolute","value":1699037472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699037472}},{"address":{"type":"absolute","value":1699037560}},{"address":{"type":"absolute","value":1699037745}},{"address":{"type":"absolute","value":1699037781}}]},{"address":{"type":"absolute","value":1699038096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699038134}}]},{"address":{"type":"absolute","value":1699038176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699038243}},{"address":{"type":"absolute","value":1699038256}}]},{"address":{"type":"absolute","value":1699038272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699038420}},{"address":{"type":"absolute","value":1699038715}},{"address":{"type":"absolute","value":1699038736}},{"address":{"type":"absolute","value":1699038754}}]},{"address":{"type":"absolute","value":1699038944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}}]},{"address":{"type":"absolute","value":1699039024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039058}},{"address":{"type":"absolute","value":1699039086}},{"address":{"type":"absolute","value":1699039136}},{"address":{"type":"absolute","value":1699039196}},{"address":{"type":"absolute","value":1699039212}}]},{"address":{"type":"absolute","value":1699039232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039336}},{"address":{"type":"absolute","value":1699039389}},{"address":{"type":"absolute","value":1699039505}},{"address":{"type":"absolute","value":1699039536}},{"address":{"type":"absolute","value":1699039603}}]},{"address":{"type":"absolute","value":1699039920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699040012}},{"address":{"type":"absolute","value":1699040481}},{"address":{"type":"absolute","value":1699040512}}]},{"address":{"type":"absolute","value":1699040544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699040880}},{"address":{"type":"absolute","value":1699041320}},{"address":{"type":"absolute","value":1699041360}}]},{"address":{"type":"absolute","value":1699041504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699041732}},{"address":{"type":"absolute","value":1699042010}}]},{"address":{"type":"absolute","value":1699043008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043181}},{"address":{"type":"absolute","value":1699043482}},{"address":{"type":"absolute","value":1699043504}}]},{"address":{"type":"absolute","value":1699043568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043593}},{"address":{"type":"absolute","value":1699043647}},{"address":{"type":"absolute","value":1699043664}},{"address":{"type":"absolute","value":1699043694}},{"address":{"type":"absolute","value":1699043729}},{"address":{"type":"absolute","value":1699043768}},{"address":{"type":"absolute","value":1699043798}},{"address":{"type":"absolute","value":1699044016}},{"address":{"type":"absolute","value":1699044099}},{"address":{"type":"absolute","value":1699044127}},{"address":{"type":"absolute","value":1699044242}}]},{"address":{"type":"absolute","value":1699044464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}},{"address":{"type":"absolute","value":1699044464}},{"address":{"type":"absolute","value":1699044512}},{"address":{"type":"absolute","value":1699044547}},{"address":{"type":"absolute","value":1699044586}}]},{"address":{"type":"absolute","value":1699044608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699044636}},{"address":{"type":"absolute","value":1699044667}},{"address":{"type":"absolute","value":1699044698}},{"address":{"type":"absolute","value":1699044729}},{"address":{"type":"absolute","value":1699044760}},{"address":{"type":"absolute","value":1699044800}},{"address":{"type":"absolute","value":1699044882}},{"address":{"type":"absolute","value":1699044896}},{"address":{"type":"absolute","value":1699044976}}]},{"address":{"type":"absolute","value":1699045216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045216}},{"address":{"type":"absolute","value":1699045259}},{"address":{"type":"absolute","value":1699045314}},{"address":{"type":"absolute","value":1699045328}}]},{"address":{"type":"absolute","value":1699045360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045360}}]},{"address":{"type":"absolute","value":1699045472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045472}}]},{"address":{"type":"absolute","value":1699045696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045719}}]},{"address":{"type":"absolute","value":1699045792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045898}},{"address":{"type":"absolute","value":1699045981}},{"address":{"type":"absolute","value":1699046016}},{"address":{"type":"absolute","value":1699046064}}]},{"address":{"type":"absolute","value":1699046160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046235}}]},{"address":{"type":"absolute","value":1699046272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046507}},{"address":{"type":"absolute","value":1699046587}},{"address":{"type":"absolute","value":1699046656}},{"address":{"type":"absolute","value":1699046677}},{"address":{"type":"absolute","value":1699046704}},{"address":{"type":"absolute","value":1699046736}}]},{"address":{"type":"absolute","value":1699046768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046820}},{"address":{"type":"absolute","value":1699046836}},{"address":{"type":"absolute","value":1699046882}}]},{"address":{"type":"absolute","value":1699047088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699047240}},{"address":{"type":"absolute","value":1699047251}},{"address":{"type":"absolute","value":1699047318}},{"address":{"type":"absolute","value":1699047386}},{"address":{"type":"absolute","value":1699047408}},{"address":{"type":"absolute","value":1699047456}}]},{"address":{"type":"absolute","value":1699047488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699047584}},{"address":{"type":"absolute","value":1699048388}},{"address":{"type":"absolute","value":1699048468}}]},{"address":{"type":"absolute","value":1699048640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049225}}]},{"address":{"type":"absolute","value":1699049408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049503}},{"address":{"type":"absolute","value":1699049552}}]},{"address":{"type":"absolute","value":1699049568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049606}}]},{"address":{"type":"absolute","value":1699049648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049648}},{"address":{"type":"absolute","value":1699050050}}]},{"address":{"type":"absolute","value":1699050320},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699050453}},{"address":{"type":"absolute","value":1699050509}}]},{"address":{"type":"absolute","value":1699050576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699050618}},{"address":{"type":"absolute","value":1699050661}},{"address":{"type":"absolute","value":1699050672}},{"address":{"type":"absolute","value":1699050688}}]},{"address":{"type":"absolute","value":1699050944},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699049648}},{"address":{"type":"absolute","value":1699050050}}]},{"address":{"type":"absolute","value":1699050976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699051123}},{"address":{"type":"absolute","value":1699051212}},{"address":{"type":"absolute","value":1699051254}},{"address":{"type":"absolute","value":1699051360}},{"address":{"type":"absolute","value":1699051548}}]},{"address":{"type":"absolute","value":1699051824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699051824}},{"address":{"type":"absolute","value":1699051888}},{"address":{"type":"absolute","value":1699052017}},{"address":{"type":"absolute","value":1699052128}},{"address":{"type":"absolute","value":1699052157}}]},{"address":{"type":"absolute","value":1699052240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699052240}},{"address":{"type":"absolute","value":1699052456}},{"address":{"type":"absolute","value":1699052564}},{"address":{"type":"absolute","value":1699052591}}]},{"address":{"type":"absolute","value":1699052912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699053033}},{"address":{"type":"absolute","value":1699053270}},{"address":{"type":"absolute","value":1699053452}},{"address":{"type":"absolute","value":1699053501}},{"address":{"type":"absolute","value":1699053616}},{"address":{"type":"absolute","value":1699054016}}]},{"address":{"type":"absolute","value":1699054608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699054720}},{"address":{"type":"absolute","value":1699055157}},{"address":{"type":"absolute","value":1699055446}},{"address":{"type":"absolute","value":1699055491}},{"address":{"type":"absolute","value":1699055562}}]},{"address":{"type":"absolute","value":1699055984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699056572}}]},{"address":{"type":"absolute","value":1699056848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057445}}]},{"address":{"type":"absolute","value":1699057840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057840}}]},{"address":{"type":"absolute","value":1699057904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057904}}]},{"address":{"type":"absolute","value":1699057968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699057968}}]},{"address":{"type":"absolute","value":1699058032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699058096}},{"address":{"type":"absolute","value":1699058324}},{"address":{"type":"absolute","value":1699058337}},{"address":{"type":"absolute","value":1699058411}},{"address":{"type":"absolute","value":1699058414}},{"address":{"type":"absolute","value":1699059072}},{"address":{"type":"absolute","value":1699059204}},{"address":{"type":"absolute","value":1699059290}},{"address":{"type":"absolute","value":1699059327}},{"address":{"type":"absolute","value":1699059408}},{"address":{"type":"absolute","value":1699059472}},{"address":{"type":"absolute","value":1699059596}},{"address":{"type":"absolute","value":1699059808}}]},{"address":{"type":"absolute","value":1699058496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699058560}},{"address":{"type":"absolute","value":1699058788}},{"address":{"type":"absolute","value":1699058801}},{"address":{"type":"absolute","value":1699058874}},{"address":{"type":"absolute","value":1699058877}},{"address":{"type":"absolute","value":1699060192}},{"address":{"type":"absolute","value":1699060437}},{"address":{"type":"absolute","value":1699060478}},{"address":{"type":"absolute","value":1699060576}},{"address":{"type":"absolute","value":1699060672}},{"address":{"type":"absolute","value":1699060820}},{"address":{"type":"absolute","value":1699060954}}]},{"address":{"type":"absolute","value":1699058960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699059072}},{"address":{"type":"absolute","value":1699059204}},{"address":{"type":"absolute","value":1699059290}},{"address":{"type":"absolute","value":1699059327}},{"address":{"type":"absolute","value":1699059408}},{"address":{"type":"absolute","value":1699059472}},{"address":{"type":"absolute","value":1699059596}},{"address":{"type":"absolute","value":1699059808}}]},{"address":{"type":"absolute","value":1699060064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699060192}},{"address":{"type":"absolute","value":1699060437}},{"address":{"type":"absolute","value":1699060478}},{"address":{"type":"absolute","value":1699060576}},{"address":{"type":"absolute","value":1699060672}},{"address":{"type":"absolute","value":1699060820}},{"address":{"type":"absolute","value":1699060954}}]},{"address":{"type":"absolute","value":1699061552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699061552}}]},{"address":{"type":"absolute","value":1699061584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699061584}},{"address":{"type":"absolute","value":1699061842}},{"address":{"type":"absolute","value":1699061935}},{"address":{"type":"absolute","value":1699062270}},{"address":{"type":"absolute","value":1699062874}},{"address":{"type":"absolute","value":1699062976}},{"address":{"type":"absolute","value":1699063184}}]},{"address":{"type":"absolute","value":1699063456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699063483}},{"address":{"type":"absolute","value":1699063539}},{"address":{"type":"absolute","value":1699063568}},{"address":{"type":"absolute","value":1699063596}},{"address":{"type":"absolute","value":1699063648}},{"address":{"type":"absolute","value":1699063689}},{"address":{"type":"absolute","value":1699063702}},{"address":{"type":"absolute","value":1699063808}},{"address":{"type":"absolute","value":1699063858}}]},{"address":{"type":"absolute","value":1699063920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699063970}},{"address":{"type":"absolute","value":1699064016}},{"address":{"type":"absolute","value":1699064052}},{"address":{"type":"absolute","value":1699064062}}]},{"address":{"type":"absolute","value":1699065232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065264}},{"address":{"type":"absolute","value":1699065364}},{"address":{"type":"absolute","value":1699065401}},{"address":{"type":"absolute","value":1699065649}},{"address":{"type":"absolute","value":1699065655}},{"address":{"type":"absolute","value":1699065664}},{"address":{"type":"absolute","value":1699065697}},{"address":{"type":"absolute","value":1699065708}},{"address":{"type":"absolute","value":1699065729}}]},{"address":{"type":"absolute","value":1699065760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065776}},{"address":{"type":"absolute","value":1699065803}}]},{"address":{"type":"absolute","value":1699065856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065856}}]},{"address":{"type":"absolute","value":1699065936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699065936}}]},{"address":{"type":"absolute","value":1699066096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699066096}},{"address":{"type":"absolute","value":1699066219}},{"address":{"type":"absolute","value":1699066240}},{"address":{"type":"absolute","value":1699066368}},{"address":{"type":"absolute","value":1699066739}},{"address":{"type":"absolute","value":1699066776}}]},{"address":{"type":"absolute","value":1699067200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699067250}},{"address":{"type":"absolute","value":1699067270}}]},{"address":{"type":"absolute","value":1699068688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699068704}},{"address":{"type":"absolute","value":1699068725}}]},{"address":{"type":"absolute","value":1699068752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699068752}},{"address":{"type":"absolute","value":1699068856}},{"address":{"type":"absolute","value":1699068884}},{"address":{"type":"absolute","value":1699068906}},{"address":{"type":"absolute","value":1699068976}}]},{"address":{"type":"absolute","value":1699069168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699069232}},{"address":{"type":"absolute","value":1699069252}}]},{"address":{"type":"absolute","value":1699071328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699071344}},{"address":{"type":"absolute","value":1699071365}}]},{"address":{"type":"absolute","value":1699071392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699071392}},{"address":{"type":"absolute","value":1699071496}},{"address":{"type":"absolute","value":1699071524}},{"address":{"type":"absolute","value":1699071546}},{"address":{"type":"absolute","value":1699071616}}]},{"address":{"type":"absolute","value":1699071824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699071856}},{"address":{"type":"absolute","value":1699071876}}]},{"address":{"type":"absolute","value":1699077520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699077536}},{"address":{"type":"absolute","value":1699077557}}]},{"address":{"type":"absolute","value":1699077584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699077584}},{"address":{"type":"absolute","value":1699077692}},{"address":{"type":"absolute","value":1699077728}},{"address":{"type":"absolute","value":1699077750}},{"address":{"type":"absolute","value":1699077824}}]},{"address":{"type":"absolute","value":1699077920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699077920}}]},{"address":{"type":"absolute","value":1699078112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699078112}}]},{"address":{"type":"absolute","value":1699078336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699078336}}]},{"address":{"type":"absolute","value":1699078560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699078560}},{"address":{"type":"absolute","value":1699078674}},{"address":{"type":"absolute","value":1699078888}},{"address":{"type":"absolute","value":1699078904}}]},{"address":{"type":"absolute","value":1699079040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699079183}},{"address":{"type":"absolute","value":1699079344}},{"address":{"type":"absolute","value":1699090156}},{"address":{"type":"absolute","value":1699090261}},{"address":{"type":"absolute","value":1699090304}},{"address":{"type":"absolute","value":1699090352}}]},{"address":{"type":"absolute","value":1699090400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699090400}},{"address":{"type":"absolute","value":1699090511}},{"address":{"type":"absolute","value":1699090532}},{"address":{"type":"absolute","value":1699090554}},{"address":{"type":"absolute","value":1699090704}}]},{"address":{"type":"absolute","value":1699090800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699090800}}]},{"address":{"type":"absolute","value":1699090896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699090935}},{"address":{"type":"absolute","value":1699090949}},{"address":{"type":"absolute","value":1699090978}}]},{"address":{"type":"absolute","value":1699091024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699091046}},{"address":{"type":"absolute","value":1699091184}},{"address":{"type":"absolute","value":1699093506}},{"address":{"type":"absolute","value":1699093513}},{"address":{"type":"absolute","value":1699094307}},{"address":{"type":"absolute","value":1699094437}}]},{"address":{"type":"absolute","value":1699094768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699094793}},{"address":{"type":"absolute","value":1699094912}},{"address":{"type":"absolute","value":1699097114}},{"address":{"type":"absolute","value":1699097121}},{"address":{"type":"absolute","value":1699097963}},{"address":{"type":"absolute","value":1699098039}}]},{"address":{"type":"absolute","value":1699098368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699098435}},{"address":{"type":"absolute","value":1699098564}},{"address":{"type":"absolute","value":1699098592}},{"address":{"type":"absolute","value":1699100810}},{"address":{"type":"absolute","value":1699101647}},{"address":{"type":"absolute","value":1699101744}},{"address":{"type":"absolute","value":1699102551}},{"address":{"type":"absolute","value":1699102692}}]},{"address":{"type":"absolute","value":1699103440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699103440}}]},{"address":{"type":"absolute","value":1699103728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699103728}}]},{"address":{"type":"absolute","value":1699104016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699104016}},{"address":{"type":"absolute","value":1699104131}},{"address":{"type":"absolute","value":1699104207}},{"address":{"type":"absolute","value":1699104248}}]},{"address":{"type":"absolute","value":1699104512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699104658}},{"address":{"type":"absolute","value":1699104912}},{"address":{"type":"absolute","value":1699105477}},{"address":{"type":"absolute","value":1699108897}},{"address":{"type":"absolute","value":1699111086}},{"address":{"type":"absolute","value":1699111200}},{"address":{"type":"absolute","value":1699111233}},{"address":{"type":"absolute","value":1699111280}}]},{"address":{"type":"absolute","value":1699111328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699111328}},{"address":{"type":"absolute","value":1699111444}},{"address":{"type":"absolute","value":1699111472}},{"address":{"type":"absolute","value":1699111494}},{"address":{"type":"absolute","value":1699111657}},{"address":{"type":"absolute","value":1699111680}},{"address":{"type":"absolute","value":1699111702}}]},{"address":{"type":"absolute","value":1699111760},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699111760}}]},{"address":{"type":"absolute","value":1699111872},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699111911}},{"address":{"type":"absolute","value":1699111925}},{"address":{"type":"absolute","value":1699111954}}]},{"address":{"type":"absolute","value":1699112016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699112075}},{"address":{"type":"absolute","value":1699125415}}]},{"address":{"type":"absolute","value":1699126160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699126222}},{"address":{"type":"absolute","value":1699139594}}]},{"address":{"type":"absolute","value":1699140352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699140435}},{"address":{"type":"absolute","value":1699140544}},{"address":{"type":"absolute","value":1699142983}},{"address":{"type":"absolute","value":1699142992}},{"address":{"type":"absolute","value":1699143842}}]},{"address":{"type":"absolute","value":1699144704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699144704}},{"address":{"type":"absolute","value":1699144727}},{"address":{"type":"absolute","value":1699144752}}]},{"address":{"type":"absolute","value":1699144784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699145105}},{"address":{"type":"absolute","value":1699146992}}]},{"address":{"type":"absolute","value":1699147264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699147339}},{"address":{"type":"absolute","value":1699147696}},{"address":{"type":"absolute","value":1699147726}},{"address":{"type":"absolute","value":1699148544}}]},{"address":{"type":"absolute","value":1699148608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699148948}},{"address":{"type":"absolute","value":1699150844}}]},{"address":{"type":"absolute","value":1699151120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699151195}},{"address":{"type":"absolute","value":1699151552}},{"address":{"type":"absolute","value":1699151582}},{"address":{"type":"absolute","value":1699152400}}]},{"address":{"type":"absolute","value":1699152464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699152799}},{"address":{"type":"absolute","value":1699154533}}]},{"address":{"type":"absolute","value":1699154816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699154891}},{"address":{"type":"absolute","value":1699155248}},{"address":{"type":"absolute","value":1699155278}},{"address":{"type":"absolute","value":1699156096}}]},{"address":{"type":"absolute","value":1699156176},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699156176}},{"address":{"type":"absolute","value":1699156211}},{"address":{"type":"absolute","value":1699156241}},{"address":{"type":"absolute","value":1699156345}},{"address":{"type":"absolute","value":1699156516}}]},{"address":{"type":"absolute","value":1699156672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699156672}},{"address":{"type":"absolute","value":1699156862}},{"address":{"type":"absolute","value":1699156942}}]},{"address":{"type":"absolute","value":1699156960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699157045}},{"address":{"type":"absolute","value":1699157173}},{"address":{"type":"absolute","value":1699157264}},{"address":{"type":"absolute","value":1699157370}}]},{"address":{"type":"absolute","value":1699157456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699157584}},{"address":{"type":"absolute","value":1699157665}},{"address":{"type":"absolute","value":1699157761}},{"address":{"type":"absolute","value":1699157838}},{"address":{"type":"absolute","value":1699158013}},{"address":{"type":"absolute","value":1699158096}},{"address":{"type":"absolute","value":1699158154}}]},{"address":{"type":"absolute","value":1699158304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158304}},{"address":{"type":"absolute","value":1699158409}},{"address":{"type":"absolute","value":1699158462}}]},{"address":{"type":"absolute","value":1699158935},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699158935}},{"address":{"type":"absolute","value":1699158994}},{"address":{"type":"absolute","value":1699162583}},{"address":{"type":"absolute","value":1699162607}}]},{"address":{"type":"absolute","value":1699162633},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699162633}},{"address":{"type":"absolute","value":1699162766}},{"address":{"type":"absolute","value":1699162793}},{"address":{"type":"absolute","value":1699162840}},{"address":{"type":"absolute","value":1699163017}}]},{"address":{"type":"absolute","value":1699163060},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163060}}]},{"address":{"type":"absolute","value":1699163328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163328}}]},{"address":{"type":"absolute","value":1699163504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163504}},{"address":{"type":"absolute","value":1699163663}},{"address":{"type":"absolute","value":1699163680}},{"address":{"type":"absolute","value":1699163694}},{"address":{"type":"absolute","value":1699163729}},{"address":{"type":"absolute","value":1699163920}},{"address":{"type":"absolute","value":1699163967}},{"address":{"type":"absolute","value":1699163984}},{"address":{"type":"absolute","value":1699164016}},{"address":{"type":"absolute","value":1699164050}}]},{"address":{"type":"absolute","value":1699164256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699163504}},{"address":{"type":"absolute","value":1699163663}},{"address":{"type":"absolute","value":1699163680}},{"address":{"type":"absolute","value":1699163694}},{"address":{"type":"absolute","value":1699163729}},{"address":{"type":"absolute","value":1699163920}},{"address":{"type":"absolute","value":1699163967}},{"address":{"type":"absolute","value":1699163984}},{"address":{"type":"absolute","value":1699164016}},{"address":{"type":"absolute","value":1699164050}},{"address":{"type":"absolute","value":1699164275}},{"address":{"type":"absolute","value":1699164309}}]},{"address":{"type":"absolute","value":1699164368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699164392}},{"address":{"type":"absolute","value":1699164500}},{"address":{"type":"absolute","value":1699164528}},{"address":{"type":"absolute","value":1699164574}},{"address":{"type":"absolute","value":1699164608}},{"address":{"type":"absolute","value":1699164635}},{"address":{"type":"absolute","value":1699164704}},{"address":{"type":"absolute","value":1699164727}},{"address":{"type":"absolute","value":1699164784}},{"address":{"type":"absolute","value":1699164787}},{"address":{"type":"absolute","value":1699164836}},{"address":{"type":"absolute","value":1699164848}},{"address":{"type":"absolute","value":1699164876}},{"address":{"type":"absolute","value":1699164928}},{"address":{"type":"absolute","value":1699164951}}]},{"address":{"type":"absolute","value":1699164960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699164960}}]},{"address":{"type":"absolute","value":1699165136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699165207}},{"address":{"type":"absolute","value":1699165464}},{"address":{"type":"absolute","value":1699167624}}]},{"address":{"type":"absolute","value":1699167664},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699167872}},{"address":{"type":"absolute","value":1699173696}}]},{"address":{"type":"absolute","value":1699173744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699173789}},{"address":{"type":"absolute","value":1699173888}},{"address":{"type":"absolute","value":1699178297}}]},{"address":{"type":"absolute","value":1699178336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699178336}},{"address":{"type":"absolute","value":1699178395}},{"address":{"type":"absolute","value":1699178464}},{"address":{"type":"absolute","value":1699178498}},{"address":{"type":"absolute","value":1699178512}},{"address":{"type":"absolute","value":1699178528}},{"address":{"type":"absolute","value":1699178566}},{"address":{"type":"absolute","value":1699178608}},{"address":{"type":"absolute","value":1699178644}},{"address":{"type":"absolute","value":1699178704}},{"address":{"type":"absolute","value":1699178755}}]},{"address":{"type":"absolute","value":1699178864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699178864}},{"address":{"type":"absolute","value":1699178907}},{"address":{"type":"absolute","value":1699178963}},{"address":{"type":"absolute","value":1699178993}},{"address":{"type":"absolute","value":1699179008}},{"address":{"type":"absolute","value":1699179024}},{"address":{"type":"absolute","value":1699179065}},{"address":{"type":"absolute","value":1699179104}},{"address":{"type":"absolute","value":1699179144}},{"address":{"type":"absolute","value":1699179202}},{"address":{"type":"absolute","value":1699179246}},{"address":{"type":"absolute","value":1699179268}},{"address":{"type":"absolute","value":1699179316}}]},{"address":{"type":"absolute","value":1699179392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179392}},{"address":{"type":"absolute","value":1699179463}},{"address":{"type":"absolute","value":1699179519}},{"address":{"type":"absolute","value":1699179605}},{"address":{"type":"absolute","value":1699179634}}]},{"address":{"type":"absolute","value":1699179712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179764}}]},{"address":{"type":"absolute","value":1699179776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179825}}]},{"address":{"type":"absolute","value":1699179840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699179840}},{"address":{"type":"absolute","value":1699179972}},{"address":{"type":"absolute","value":1699179995}}]},{"address":{"type":"absolute","value":1699180048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180048}},{"address":{"type":"absolute","value":1699180180}},{"address":{"type":"absolute","value":1699180203}}]},{"address":{"type":"absolute","value":1699180256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180256}},{"address":{"type":"absolute","value":1699180388}},{"address":{"type":"absolute","value":1699180411}}]},{"address":{"type":"absolute","value":1699180464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180464}},{"address":{"type":"absolute","value":1699180596}},{"address":{"type":"absolute","value":1699180619}}]},{"address":{"type":"absolute","value":1699180672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180672}},{"address":{"type":"absolute","value":1699180856}},{"address":{"type":"absolute","value":1699180880}},{"address":{"type":"absolute","value":1699180901}}]},{"address":{"type":"absolute","value":1699180912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699180912}},{"address":{"type":"absolute","value":1699181096}},{"address":{"type":"absolute","value":1699181120}},{"address":{"type":"absolute","value":1699181141}}]},{"address":{"type":"absolute","value":1699181152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699181152}},{"address":{"type":"absolute","value":1699181336}},{"address":{"type":"absolute","value":1699181360}},{"address":{"type":"absolute","value":1699181381}}]},{"address":{"type":"absolute","value":1699181392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699181392}},{"address":{"type":"absolute","value":1699181576}},{"address":{"type":"absolute","value":1699181600}},{"address":{"type":"absolute","value":1699181621}}]},{"address":{"type":"absolute","value":1699181632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699181831}},{"address":{"type":"absolute","value":1699182017}},{"address":{"type":"absolute","value":1699182199}},{"address":{"type":"absolute","value":1699182471}},{"address":{"type":"absolute","value":1699182746}},{"address":{"type":"absolute","value":1699182928}},{"address":{"type":"absolute","value":1699183120}},{"address":{"type":"absolute","value":1699183172}},{"address":{"type":"absolute","value":1699183181}},{"address":{"type":"absolute","value":1699183245}}]},{"address":{"type":"absolute","value":1699183344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699183588}},{"address":{"type":"absolute","value":1699183618}},{"address":{"type":"absolute","value":1699183761}},{"address":{"type":"absolute","value":1699183988}},{"address":{"type":"absolute","value":1699184016}},{"address":{"type":"absolute","value":1699184276}},{"address":{"type":"absolute","value":1699184304}},{"address":{"type":"absolute","value":1699184541}},{"address":{"type":"absolute","value":1699184817}},{"address":{"type":"absolute","value":1699185061}},{"address":{"type":"absolute","value":1699185136}},{"address":{"type":"absolute","value":1699185145}},{"address":{"type":"absolute","value":1699185209}}]},{"address":{"type":"absolute","value":1699185280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699185280}},{"address":{"type":"absolute","value":1699185320}}]},{"address":{"type":"absolute","value":1699187520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699187520}}]},{"address":{"type":"absolute","value":1699187712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699187712}},{"address":{"type":"absolute","value":1699187734}},{"address":{"type":"absolute","value":1699187807}},{"address":{"type":"absolute","value":1699187844}},{"address":{"type":"absolute","value":1699187856}},{"address":{"type":"absolute","value":1699187914}}]},{"address":{"type":"absolute","value":1699187984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699188121}},{"address":{"type":"absolute","value":1699188240}},{"address":{"type":"absolute","value":1699192884}},{"address":{"type":"absolute","value":1699192992}},{"address":{"type":"absolute","value":1699193025}},{"address":{"type":"absolute","value":1699193072}}]},{"address":{"type":"absolute","value":1699193120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193120}},{"address":{"type":"absolute","value":1699193231}},{"address":{"type":"absolute","value":1699193252}},{"address":{"type":"absolute","value":1699193274}},{"address":{"type":"absolute","value":1699193392}}]},{"address":{"type":"absolute","value":1699193488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699187520}}]},{"address":{"type":"absolute","value":1699193504},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193504}}]},{"address":{"type":"absolute","value":1699193584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193584}}]},{"address":{"type":"absolute","value":1699193680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699193719}},{"address":{"type":"absolute","value":1699193733}},{"address":{"type":"absolute","value":1699193762}}]},{"address":{"type":"absolute","value":1699193888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699194072}},{"address":{"type":"absolute","value":1699196907}},{"address":{"type":"absolute","value":1699197456}}]},{"address":{"type":"absolute","value":1699198016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699198184}},{"address":{"type":"absolute","value":1699200882}},{"address":{"type":"absolute","value":1699201440}}]},{"address":{"type":"absolute","value":1699202000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699202168}},{"address":{"type":"absolute","value":1699205054}},{"address":{"type":"absolute","value":1699205648}}]},{"address":{"type":"absolute","value":1699206160},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699206160}},{"address":{"type":"absolute","value":1699206320}},{"address":{"type":"absolute","value":1699206352}},{"address":{"type":"absolute","value":1699206496}},{"address":{"type":"absolute","value":1699206888}},{"address":{"type":"absolute","value":1699207009}},{"address":{"type":"absolute","value":1699207015}},{"address":{"type":"absolute","value":1699207028}},{"address":{"type":"absolute","value":1699207106}},{"address":{"type":"absolute","value":1699207156}},{"address":{"type":"absolute","value":1699207251}}]},{"address":{"type":"absolute","value":1699207280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699207438}},{"address":{"type":"absolute","value":1699207794}},{"address":{"type":"absolute","value":1699207907}},{"address":{"type":"absolute","value":1699207939}},{"address":{"type":"absolute","value":1699207971}},{"address":{"type":"absolute","value":1699207991}},{"address":{"type":"absolute","value":1699208016}},{"address":{"type":"absolute","value":1699208096}}]},{"address":{"type":"absolute","value":1699208304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208359}},{"address":{"type":"absolute","value":1699208384}},{"address":{"type":"absolute","value":1699208405}},{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}},{"address":{"type":"absolute","value":1699224292}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1699208448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208488}}]},{"address":{"type":"absolute","value":1699208496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208496}},{"address":{"type":"absolute","value":1699208608}},{"address":{"type":"absolute","value":1699208690}},{"address":{"type":"absolute","value":1699208757}},{"address":{"type":"absolute","value":1699208816}}]},{"address":{"type":"absolute","value":1699208848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208879}}]},{"address":{"type":"absolute","value":1699208928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208974}},{"address":{"type":"absolute","value":1699208992}},{"address":{"type":"absolute","value":1699209008}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699210681}},{"address":{"type":"absolute","value":1699210747}},{"address":{"type":"absolute","value":1699223534}}]},{"address":{"type":"absolute","value":1699209024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209067}},{"address":{"type":"absolute","value":1699209076}},{"address":{"type":"absolute","value":1699209088}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699212704}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226256}}]},{"address":{"type":"absolute","value":1699209104},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209137}},{"address":{"type":"absolute","value":1699209152}},{"address":{"type":"absolute","value":1699209166}}]},{"address":{"type":"absolute","value":1699209184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209197}},{"address":{"type":"absolute","value":1699209216}},{"address":{"type":"absolute","value":1699230294}}]},{"address":{"type":"absolute","value":1699209232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209245}},{"address":{"type":"absolute","value":1699209250}}]},{"address":{"type":"absolute","value":1699209264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209277}},{"address":{"type":"absolute","value":1699209282}}]},{"address":{"type":"absolute","value":1699209296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209313}},{"address":{"type":"absolute","value":1699209328}}]},{"address":{"type":"absolute","value":1699209344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209360}},{"address":{"type":"absolute","value":1699209376}}]},{"address":{"type":"absolute","value":1699209392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209405}},{"address":{"type":"absolute","value":1699209424}},{"address":{"type":"absolute","value":1699212960}}]},{"address":{"type":"absolute","value":1699209440},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209491}},{"address":{"type":"absolute","value":1699209504}}]},{"address":{"type":"absolute","value":1699209536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209536}}]},{"address":{"type":"absolute","value":1699209584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209584}}]},{"address":{"type":"absolute","value":1699209632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699208359}},{"address":{"type":"absolute","value":1699208384}},{"address":{"type":"absolute","value":1699208405}},{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}},{"address":{"type":"absolute","value":1699224292}},{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1699209648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209689}},{"address":{"type":"absolute","value":1699209696}},{"address":{"type":"absolute","value":1699214352}},{"address":{"type":"absolute","value":1699214366}}]},{"address":{"type":"absolute","value":1699209712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699209749}},{"address":{"type":"absolute","value":1699209760}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214528}},{"address":{"type":"absolute","value":1699214553}},{"address":{"type":"absolute","value":1699214729}},{"address":{"type":"absolute","value":1699214795}}]},{"address":{"type":"absolute","value":1699209776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699209813}},{"address":{"type":"absolute","value":1699209824}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214909}}]},{"address":{"type":"absolute","value":1699209840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210038}},{"address":{"type":"absolute","value":1699210052}},{"address":{"type":"absolute","value":1699210080}},{"address":{"type":"absolute","value":1699210176}},{"address":{"type":"absolute","value":1699210234}},{"address":{"type":"absolute","value":1699210257}},{"address":{"type":"absolute","value":1699224292}}]},{"address":{"type":"absolute","value":1699210384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210401}},{"address":{"type":"absolute","value":1699210416}},{"address":{"type":"absolute","value":1699225329}},{"address":{"type":"absolute","value":1699225483}},{"address":{"type":"absolute","value":1699225537}},{"address":{"type":"absolute","value":1699225637}},{"address":{"type":"absolute","value":1699225652}},{"address":{"type":"absolute","value":1699225668}},{"address":{"type":"absolute","value":1699225701}}]},{"address":{"type":"absolute","value":1699210432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210452}}]},{"address":{"type":"absolute","value":1699210496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210533}}]},{"address":{"type":"absolute","value":1699210576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}}]},{"address":{"type":"absolute","value":1699210640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699210681}},{"address":{"type":"absolute","value":1699210747}}]},{"address":{"type":"absolute","value":1699210832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699211078}},{"address":{"type":"absolute","value":1699211136}},{"address":{"type":"absolute","value":1699211176}},{"address":{"type":"absolute","value":1699211223}}]},{"address":{"type":"absolute","value":1699211312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699211343}},{"address":{"type":"absolute","value":1699211360}},{"address":{"type":"absolute","value":1699211374}},{"address":{"type":"absolute","value":1699211425}},{"address":{"type":"absolute","value":1699211440}},{"address":{"type":"absolute","value":1699211477}},{"address":{"type":"absolute","value":1699211528}}]},{"address":{"type":"absolute","value":1699211584},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699211922}},{"address":{"type":"absolute","value":1699211952}},{"address":{"type":"absolute","value":1699212017}},{"address":{"type":"absolute","value":1699212032}},{"address":{"type":"absolute","value":1699212112}}]},{"address":{"type":"absolute","value":1699212384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212403}},{"address":{"type":"absolute","value":1699212422}},{"address":{"type":"absolute","value":1699212459}}]},{"address":{"type":"absolute","value":1699212656},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699210681}},{"address":{"type":"absolute","value":1699210747}}]},{"address":{"type":"absolute","value":1699212704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699212704}}]},{"address":{"type":"absolute","value":1699212736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212736}}]},{"address":{"type":"absolute","value":1699212960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212960}}]},{"address":{"type":"absolute","value":1699212992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699212992}},{"address":{"type":"absolute","value":1699213118}},{"address":{"type":"absolute","value":1699213131}},{"address":{"type":"absolute","value":1699213168}}]},{"address":{"type":"absolute","value":1699213184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699213241}},{"address":{"type":"absolute","value":1699213260}},{"address":{"type":"absolute","value":1699213493}},{"address":{"type":"absolute","value":1699213518}},{"address":{"type":"absolute","value":1699213602}},{"address":{"type":"absolute","value":1699213621}},{"address":{"type":"absolute","value":1699213649}},{"address":{"type":"absolute","value":1699213760}},{"address":{"type":"absolute","value":1699213785}},{"address":{"type":"absolute","value":1699213843}},{"address":{"type":"absolute","value":1699213877}},{"address":{"type":"absolute","value":1699214042}},{"address":{"type":"absolute","value":1699214064}},{"address":{"type":"absolute","value":1699214096}},{"address":{"type":"absolute","value":1699214160}},{"address":{"type":"absolute","value":1699214226}}]},{"address":{"type":"absolute","value":1699214352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699214352}},{"address":{"type":"absolute","value":1699214366}}]},{"address":{"type":"absolute","value":1699214416},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214528}},{"address":{"type":"absolute","value":1699214553}},{"address":{"type":"absolute","value":1699214729}},{"address":{"type":"absolute","value":1699214795}}]},{"address":{"type":"absolute","value":1699214864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699210606}},{"address":{"type":"absolute","value":1699214909}}]},{"address":{"type":"absolute","value":1699214928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699214960}},{"address":{"type":"absolute","value":1699215008}}]},{"address":{"type":"absolute","value":1699215056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215069}},{"address":{"type":"absolute","value":1699215153}}]},{"address":{"type":"absolute","value":1699215168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215213}},{"address":{"type":"absolute","value":1699215232}}]},{"address":{"type":"absolute","value":1699215248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698482784}},{"address":{"type":"absolute","value":1698482842}},{"address":{"type":"absolute","value":1698482912}},{"address":{"type":"absolute","value":1699215272}}]},{"address":{"type":"absolute","value":1699215296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1698527152}},{"address":{"type":"absolute","value":1698527202}},{"address":{"type":"absolute","value":1698527214}},{"address":{"type":"absolute","value":1698527248}},{"address":{"type":"absolute","value":1698527296}},{"address":{"type":"absolute","value":1698527317}}]},{"address":{"type":"absolute","value":1699215312},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215353}}]},{"address":{"type":"absolute","value":1699215360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215360}},{"address":{"type":"absolute","value":1699215404}}]},{"address":{"type":"absolute","value":1699215424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699215424}},{"address":{"type":"absolute","value":1699215775}},{"address":{"type":"absolute","value":1699215800}},{"address":{"type":"absolute","value":1699215824}},{"address":{"type":"absolute","value":1699215876}}]},{"address":{"type":"absolute","value":1699215904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699216051}},{"address":{"type":"absolute","value":1699216064}}]},{"address":{"type":"absolute","value":1699216080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699216174}},{"address":{"type":"absolute","value":1699216218}}]},{"address":{"type":"absolute","value":1699216240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698483598}},{"address":{"type":"absolute","value":1698483603}},{"address":{"type":"absolute","value":1698483632}},{"address":{"type":"absolute","value":1699216340}},{"address":{"type":"absolute","value":1699216386}},{"address":{"type":"absolute","value":1699216427}}]},{"address":{"type":"absolute","value":1699216464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698528337}},{"address":{"type":"absolute","value":1698529936}},{"address":{"type":"absolute","value":1699216509}}]},{"address":{"type":"absolute","value":1699216560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699216560}},{"address":{"type":"absolute","value":1699216737}},{"address":{"type":"absolute","value":1699216988}},{"address":{"type":"absolute","value":1699216995}},{"address":{"type":"absolute","value":1699217133}},{"address":{"type":"absolute","value":1699217344}},{"address":{"type":"absolute","value":1699217530}}]},{"address":{"type":"absolute","value":1699217632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699217716}},{"address":{"type":"absolute","value":1699217769}},{"address":{"type":"absolute","value":1699217811}}]},{"address":{"type":"absolute","value":1699217840},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699218102}},{"address":{"type":"absolute","value":1699218448}}]},{"address":{"type":"absolute","value":1699218464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699218678}},{"address":{"type":"absolute","value":1699218846}}]},{"address":{"type":"absolute","value":1699218976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699219145}},{"address":{"type":"absolute","value":1699219202}},{"address":{"type":"absolute","value":1699219224}},{"address":{"type":"absolute","value":1699219249}}]},{"address":{"type":"absolute","value":1699219296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699219445}},{"address":{"type":"absolute","value":1699219478}},{"address":{"type":"absolute","value":1699219501}},{"address":{"type":"absolute","value":1699219616}}]},{"address":{"type":"absolute","value":1699219744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699219766}},{"address":{"type":"absolute","value":1699220011}},{"address":{"type":"absolute","value":1699220069}},{"address":{"type":"absolute","value":1699220096}}]},{"address":{"type":"absolute","value":1699220112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220160}},{"address":{"type":"absolute","value":1699220176}},{"address":{"type":"absolute","value":1699220184}},{"address":{"type":"absolute","value":1699220311}},{"address":{"type":"absolute","value":1699220368}},{"address":{"type":"absolute","value":1699220454}}]},{"address":{"type":"absolute","value":1699220480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220568}},{"address":{"type":"absolute","value":1699220589}},{"address":{"type":"absolute","value":1699220624}}]},{"address":{"type":"absolute","value":1699220640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220568}},{"address":{"type":"absolute","value":1699220589}},{"address":{"type":"absolute","value":1699220624}},{"address":{"type":"absolute","value":1699220693}},{"address":{"type":"absolute","value":1699220736}},{"address":{"type":"absolute","value":1699220759}}]},{"address":{"type":"absolute","value":1699220784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220805}},{"address":{"type":"absolute","value":1699220871}}]},{"address":{"type":"absolute","value":1699220928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220987}},{"address":{"type":"absolute","value":1699221015}},{"address":{"type":"absolute","value":1699221127}},{"address":{"type":"absolute","value":1699221477}},{"address":{"type":"absolute","value":1699221523}},{"address":{"type":"absolute","value":1699221593}},{"address":{"type":"absolute","value":1699221628}},{"address":{"type":"absolute","value":1699221643}},{"address":{"type":"absolute","value":1699221690}},{"address":{"type":"absolute","value":1699221746}},{"address":{"type":"absolute","value":1699221893}},{"address":{"type":"absolute","value":1699221988}},{"address":{"type":"absolute","value":1699222022}},{"address":{"type":"absolute","value":1699222057}},{"address":{"type":"absolute","value":1699222260}},{"address":{"type":"absolute","value":1699222287}},{"address":{"type":"absolute","value":1699222452}},{"address":{"type":"absolute","value":1699222456}},{"address":{"type":"absolute","value":1699222832}},{"address":{"type":"absolute","value":1699222845}},{"address":{"type":"absolute","value":1699222976}},{"address":{"type":"absolute","value":1699223175}}]},{"address":{"type":"absolute","value":1699223280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699220987}},{"address":{"type":"absolute","value":1699221015}},{"address":{"type":"absolute","value":1699221127}},{"address":{"type":"absolute","value":1699221477}},{"address":{"type":"absolute","value":1699221523}},{"address":{"type":"absolute","value":1699221593}},{"address":{"type":"absolute","value":1699221628}},{"address":{"type":"absolute","value":1699221643}},{"address":{"type":"absolute","value":1699221690}},{"address":{"type":"absolute","value":1699221746}},{"address":{"type":"absolute","value":1699221893}},{"address":{"type":"absolute","value":1699221988}},{"address":{"type":"absolute","value":1699222022}},{"address":{"type":"absolute","value":1699222057}},{"address":{"type":"absolute","value":1699222260}},{"address":{"type":"absolute","value":1699222287}},{"address":{"type":"absolute","value":1699222452}},{"address":{"type":"absolute","value":1699222456}},{"address":{"type":"absolute","value":1699222832}},{"address":{"type":"absolute","value":1699222845}},{"address":{"type":"absolute","value":1699222976}},{"address":{"type":"absolute","value":1699223175}},{"address":{"type":"absolute","value":1699223382}},{"address":{"type":"absolute","value":1699223408}},{"address":{"type":"absolute","value":1699223437}}]},{"address":{"type":"absolute","value":1699223488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699223534}}]},{"address":{"type":"absolute","value":1699223600},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699223534}}]},{"address":{"type":"absolute","value":1699223648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699223687}},{"address":{"type":"absolute","value":1699223737}},{"address":{"type":"absolute","value":1699223824}}]},{"address":{"type":"absolute","value":1699223936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699224059}},{"address":{"type":"absolute","value":1699224068}}]},{"address":{"type":"absolute","value":1699224128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699224292}}]},{"address":{"type":"absolute","value":1699224576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699224656}},{"address":{"type":"absolute","value":1699224671}},{"address":{"type":"absolute","value":1699224686}}]},{"address":{"type":"absolute","value":1699225200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225231}},{"address":{"type":"absolute","value":1699225280}}]},{"address":{"type":"absolute","value":1699225296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225329}},{"address":{"type":"absolute","value":1699225483}},{"address":{"type":"absolute","value":1699225537}},{"address":{"type":"absolute","value":1699225637}},{"address":{"type":"absolute","value":1699225652}},{"address":{"type":"absolute","value":1699225668}},{"address":{"type":"absolute","value":1699225701}}]},{"address":{"type":"absolute","value":1699225904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225924}}]},{"address":{"type":"absolute","value":1699225968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225998}}]},{"address":{"type":"absolute","value":1699226032},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226063}},{"address":{"type":"absolute","value":1699226101}},{"address":{"type":"absolute","value":1699226128}},{"address":{"type":"absolute","value":1699226133}}]},{"address":{"type":"absolute","value":1699226256},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226256}}]},{"address":{"type":"absolute","value":1699226336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699225998}},{"address":{"type":"absolute","value":1699226379}},{"address":{"type":"absolute","value":1699226487}}]},{"address":{"type":"absolute","value":1699226598},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226598}}]},{"address":{"type":"absolute","value":1699226648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226648}},{"address":{"type":"absolute","value":1699226730}},{"address":{"type":"absolute","value":1699226771}},{"address":{"type":"absolute","value":1699226807}}]},{"address":{"type":"absolute","value":1699226814},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226814}}]},{"address":{"type":"absolute","value":1699226833},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226833}}]},{"address":{"type":"absolute","value":1699226871},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699226871}},{"address":{"type":"absolute","value":1699226979}},{"address":{"type":"absolute","value":1699227034}}]},{"address":{"type":"absolute","value":1699227064},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227064}},{"address":{"type":"absolute","value":1699227175}},{"address":{"type":"absolute","value":1699227334}},{"address":{"type":"absolute","value":1699227353}}]},{"address":{"type":"absolute","value":1699227374},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227374}},{"address":{"type":"absolute","value":1699227504}},{"address":{"type":"absolute","value":1699227597}},{"address":{"type":"absolute","value":1699227623}}]},{"address":{"type":"absolute","value":1699227629},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227629}},{"address":{"type":"absolute","value":1699227740}}]},{"address":{"type":"absolute","value":1699227746},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699227746}},{"address":{"type":"absolute","value":1699227911}}]},{"address":{"type":"absolute","value":1699227920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228034}},{"address":{"type":"absolute","value":1699228065}}]},{"address":{"type":"absolute","value":1699228093},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228134}},{"address":{"type":"absolute","value":1699228189}}]},{"address":{"type":"absolute","value":1699228196},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228196}},{"address":{"type":"absolute","value":1699228363}}]},{"address":{"type":"absolute","value":1699228369},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228369}},{"address":{"type":"absolute","value":1699228477}},{"address":{"type":"absolute","value":1699228536}}]},{"address":{"type":"absolute","value":1699228542},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228542}},{"address":{"type":"absolute","value":1699228762}},{"address":{"type":"absolute","value":1699228772}},{"address":{"type":"absolute","value":1699228802}}]},{"address":{"type":"absolute","value":1699228808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699228808}},{"address":{"type":"absolute","value":1699228887}}]},{"address":{"type":"absolute","value":1699228894},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229120}},{"address":{"type":"absolute","value":1699229151}},{"address":{"type":"absolute","value":1699229199}},{"address":{"type":"absolute","value":1699229222}},{"address":{"type":"absolute","value":1699229277}},{"address":{"type":"absolute","value":1699229291}},{"address":{"type":"absolute","value":1699229305}},{"address":{"type":"absolute","value":1699229328}},{"address":{"type":"absolute","value":1699229381}},{"address":{"type":"absolute","value":1699229409}}]},{"address":{"type":"absolute","value":1699229418},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229418}},{"address":{"type":"absolute","value":1699229472}}]},{"address":{"type":"absolute","value":1699229489},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229489}},{"address":{"type":"absolute","value":1699229553}}]},{"address":{"type":"absolute","value":1699229560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229560}}]},{"address":{"type":"absolute","value":1699229592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699229592}},{"address":{"type":"absolute","value":1699229773}},{"address":{"type":"absolute","value":1699229845}},{"address":{"type":"absolute","value":1699230022}},{"address":{"type":"absolute","value":1699230063}}]},{"address":{"type":"absolute","value":1699230105},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230105}},{"address":{"type":"absolute","value":1699230228}}]},{"address":{"type":"absolute","value":1699230234},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230294}}]},{"address":{"type":"absolute","value":1699230544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230601}},{"address":{"type":"absolute","value":1699230611}},{"address":{"type":"absolute","value":1699230640}}]},{"address":{"type":"absolute","value":1699230672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230702}},{"address":{"type":"absolute","value":1699230728}}]},{"address":{"type":"absolute","value":1699230752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230785}}]},{"address":{"type":"absolute","value":1699230864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699230913}}]},{"address":{"type":"absolute","value":1699231232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699231232}}]},{"address":{"type":"absolute","value":1699231280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699231472}},{"address":{"type":"absolute","value":1699231517}},{"address":{"type":"absolute","value":1699231772}},{"address":{"type":"absolute","value":1699231793}},{"address":{"type":"absolute","value":1699231874}},{"address":{"type":"absolute","value":1699232027}},{"address":{"type":"absolute","value":1699232109}},{"address":{"type":"absolute","value":1699232645}},{"address":{"type":"absolute","value":1699233082}},{"address":{"type":"absolute","value":1699233146}},{"address":{"type":"absolute","value":1699233364}},{"address":{"type":"absolute","value":1699233378}}]},{"address":{"type":"absolute","value":1699233856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234426}}]},{"address":{"type":"absolute","value":1699234544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234544}},{"address":{"type":"absolute","value":1699234597}},{"address":{"type":"absolute","value":1699234627}},{"address":{"type":"absolute","value":1699234699}},{"address":{"type":"absolute","value":1699234725}},{"address":{"type":"absolute","value":1699234797}},{"address":{"type":"absolute","value":1699234868}},{"address":{"type":"absolute","value":1699234912}}]},{"address":{"type":"absolute","value":1699234992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}}]},{"address":{"type":"absolute","value":1699235904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699235904}},{"address":{"type":"absolute","value":1699235962}},{"address":{"type":"absolute","value":1699235999}},{"address":{"type":"absolute","value":1699236072}},{"address":{"type":"absolute","value":1699236098}},{"address":{"type":"absolute","value":1699236173}},{"address":{"type":"absolute","value":1699236244}},{"address":{"type":"absolute","value":1699236276}}]},{"address":{"type":"absolute","value":1699236352},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699236352}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699236432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699236480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699236480}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699236528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236560}}]},{"address":{"type":"absolute","value":1699236608},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236560}}]},{"address":{"type":"absolute","value":1699236640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699236712}},{"address":{"type":"absolute","value":1699236720}}]},{"address":{"type":"absolute","value":1699236768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236811}},{"address":{"type":"absolute","value":1699236836}},{"address":{"type":"absolute","value":1699236868}},{"address":{"type":"absolute","value":1699236896}}]},{"address":{"type":"absolute","value":1699236912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699236959}},{"address":{"type":"absolute","value":1699236992}},{"address":{"type":"absolute","value":1699237059}},{"address":{"type":"absolute","value":1699237082}},{"address":{"type":"absolute","value":1699237104}}]},{"address":{"type":"absolute","value":1699237120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237168}},{"address":{"type":"absolute","value":1699237188}}]},{"address":{"type":"absolute","value":1699237216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699237280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237312}}]},{"address":{"type":"absolute","value":1699237376},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237616}},{"address":{"type":"absolute","value":1699237643}},{"address":{"type":"absolute","value":1699237808}},{"address":{"type":"absolute","value":1699237859}},{"address":{"type":"absolute","value":1699237877}}]},{"address":{"type":"absolute","value":1699238000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238080}},{"address":{"type":"absolute","value":1699238099}},{"address":{"type":"absolute","value":1699238112}}]},{"address":{"type":"absolute","value":1699238128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699238164}},{"address":{"type":"absolute","value":1699238288}},{"address":{"type":"absolute","value":1699238320}},{"address":{"type":"absolute","value":1699238337}},{"address":{"type":"absolute","value":1699238352}},{"address":{"type":"absolute","value":1699238368}}]},{"address":{"type":"absolute","value":1699238480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1699238912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238956}},{"address":{"type":"absolute","value":1699238970}},{"address":{"type":"absolute","value":1699238977}}]},{"address":{"type":"absolute","value":1699239008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1699239024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699238552}},{"address":{"type":"absolute","value":1699238617}},{"address":{"type":"absolute","value":1699238681}},{"address":{"type":"absolute","value":1699238707}},{"address":{"type":"absolute","value":1699238729}},{"address":{"type":"absolute","value":1699238819}}]},{"address":{"type":"absolute","value":1699239040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239120}}]},{"address":{"type":"absolute","value":1699239136},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}}]},{"address":{"type":"absolute","value":1699240240},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699240240}},{"address":{"type":"absolute","value":1699240296}},{"address":{"type":"absolute","value":1699240358}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699240432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699240432}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699240496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}}]},{"address":{"type":"absolute","value":1699240512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699240720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699240720}},{"address":{"type":"absolute","value":1699240749}},{"address":{"type":"absolute","value":1699240768}},{"address":{"type":"absolute","value":1699240824}},{"address":{"type":"absolute","value":1699240835}}]},{"address":{"type":"absolute","value":1699240928},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699240928}}]},{"address":{"type":"absolute","value":1699240976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699240240}},{"address":{"type":"absolute","value":1699240296}},{"address":{"type":"absolute","value":1699240358}},{"address":{"type":"absolute","value":1699240432}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699241005}},{"address":{"type":"absolute","value":1699241036}},{"address":{"type":"absolute","value":1699241056}},{"address":{"type":"absolute","value":1699241106}},{"address":{"type":"absolute","value":1699241124}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699241168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241269}}]},{"address":{"type":"absolute","value":1699241328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241328}},{"address":{"type":"absolute","value":1699241363}},{"address":{"type":"absolute","value":1699241408}}]},{"address":{"type":"absolute","value":1699241456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241328}},{"address":{"type":"absolute","value":1699241363}},{"address":{"type":"absolute","value":1699241408}},{"address":{"type":"absolute","value":1699241490}},{"address":{"type":"absolute","value":1699241504}}]},{"address":{"type":"absolute","value":1699241552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241593}},{"address":{"type":"absolute","value":1699241632}}]},{"address":{"type":"absolute","value":1699241680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241593}},{"address":{"type":"absolute","value":1699241632}},{"address":{"type":"absolute","value":1699241714}},{"address":{"type":"absolute","value":1699241728}}]},{"address":{"type":"absolute","value":1699241776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241785}},{"address":{"type":"absolute","value":1699241810}},{"address":{"type":"absolute","value":1699241840}}]},{"address":{"type":"absolute","value":1699241856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699241897}}]},{"address":{"type":"absolute","value":1699243120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243189}},{"address":{"type":"absolute","value":1699243251}}]},{"address":{"type":"absolute","value":1699243280},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699243410}},{"address":{"type":"absolute","value":1699243433}}]},{"address":{"type":"absolute","value":1699243568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699243568}},{"address":{"type":"absolute","value":1699243765}},{"address":{"type":"absolute","value":1699244162}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1699244400},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699239508}},{"address":{"type":"absolute","value":1699239554}},{"address":{"type":"absolute","value":1699239631}},{"address":{"type":"absolute","value":1699239792}},{"address":{"type":"absolute","value":1699240128}},{"address":{"type":"absolute","value":1699244400}}]},{"address":{"type":"absolute","value":1699244448},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699244464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699244506}}]},{"address":{"type":"absolute","value":1699244640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699244701}},{"address":{"type":"absolute","value":1699244720}},{"address":{"type":"absolute","value":1699244736}}]},{"address":{"type":"absolute","value":1699244768},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699245152},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699245152}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699245200},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699245200}},{"address":{"type":"absolute","value":1699245270}},{"address":{"type":"absolute","value":1699245327}}]},{"address":{"type":"absolute","value":1699245392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699245474}},{"address":{"type":"absolute","value":1699246404}},{"address":{"type":"absolute","value":1699246484}},{"address":{"type":"absolute","value":1699246560}},{"address":{"type":"absolute","value":1699246612}},{"address":{"type":"absolute","value":1699246732}},{"address":{"type":"absolute","value":1699246810}},{"address":{"type":"absolute","value":1699246930}},{"address":{"type":"absolute","value":1699247056}},{"address":{"type":"absolute","value":1699247148}},{"address":{"type":"absolute","value":1699247524}},{"address":{"type":"absolute","value":1699247632}},{"address":{"type":"absolute","value":1699247874}},{"address":{"type":"absolute","value":1699247997}},{"address":{"type":"absolute","value":1699248208}},{"address":{"type":"absolute","value":1699248285}},{"address":{"type":"absolute","value":1699248466}},{"address":{"type":"absolute","value":1699248595}},{"address":{"type":"absolute","value":1699248776}},{"address":{"type":"absolute","value":1699248796}},{"address":{"type":"absolute","value":1699248992}},{"address":{"type":"absolute","value":1699249636}},{"address":{"type":"absolute","value":1699249906}},{"address":{"type":"absolute","value":1699249973}}]},{"address":{"type":"absolute","value":1699250096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699250096}},{"address":{"type":"absolute","value":1699250139}},{"address":{"type":"absolute","value":1699250150}},{"address":{"type":"absolute","value":1699250181}},{"address":{"type":"absolute","value":1699250352}},{"address":{"type":"absolute","value":1699250418}},{"address":{"type":"absolute","value":1699250480}},{"address":{"type":"absolute","value":1699250497}}]},{"address":{"type":"absolute","value":1699250896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699250915}},{"address":{"type":"absolute","value":1699250930}},{"address":{"type":"absolute","value":1699250943}},{"address":{"type":"absolute","value":1699250954}}]},{"address":{"type":"absolute","value":1699250976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251025}},{"address":{"type":"absolute","value":1699251067}},{"address":{"type":"absolute","value":1699251088}},{"address":{"type":"absolute","value":1699251104}},{"address":{"type":"absolute","value":1699251136}}]},{"address":{"type":"absolute","value":1699251264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251300}},{"address":{"type":"absolute","value":1699251338}},{"address":{"type":"absolute","value":1699251401}},{"address":{"type":"absolute","value":1699251440}},{"address":{"type":"absolute","value":1699251573}},{"address":{"type":"absolute","value":1699251597}},{"address":{"type":"absolute","value":1699251664}},{"address":{"type":"absolute","value":1699251696}},{"address":{"type":"absolute","value":1699251728}},{"address":{"type":"absolute","value":1699251741}}]},{"address":{"type":"absolute","value":1699251776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699237168}},{"address":{"type":"absolute","value":1699237188}},{"address":{"type":"absolute","value":1699251796}},{"address":{"type":"absolute","value":1699251842}},{"address":{"type":"absolute","value":1699251854}}]},{"address":{"type":"absolute","value":1699251888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251888}}]},{"address":{"type":"absolute","value":1699251936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251936}}]},{"address":{"type":"absolute","value":1699251968},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699251968}}]},{"address":{"type":"absolute","value":1699252016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699252096}},{"address":{"type":"absolute","value":1699252197}},{"address":{"type":"absolute","value":1699252237}},{"address":{"type":"absolute","value":1699252411}},{"address":{"type":"absolute","value":1699252464}}]},{"address":{"type":"absolute","value":1699252544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699252752}},{"address":{"type":"absolute","value":1699252851}},{"address":{"type":"absolute","value":1699252953}},{"address":{"type":"absolute","value":1699252982}},{"address":{"type":"absolute","value":1699253068}},{"address":{"type":"absolute","value":1699253125}},{"address":{"type":"absolute","value":1699253189}},{"address":{"type":"absolute","value":1699253232}},{"address":{"type":"absolute","value":1699253284}},{"address":{"type":"absolute","value":1699253610}},{"address":{"type":"absolute","value":1699253728}},{"address":{"type":"absolute","value":1699253828}},{"address":{"type":"absolute","value":1699253836}},{"address":{"type":"absolute","value":1699253856}}]},{"address":{"type":"absolute","value":1699254128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699254213}},{"address":{"type":"absolute","value":1699254245}},{"address":{"type":"absolute","value":1699254416}},{"address":{"type":"absolute","value":1699254520}},{"address":{"type":"absolute","value":1699254568}},{"address":{"type":"absolute","value":1699254646}},{"address":{"type":"absolute","value":1699254753}},{"address":{"type":"absolute","value":1699254770}},{"address":{"type":"absolute","value":1699254922}},{"address":{"type":"absolute","value":1699254960}},{"address":{"type":"absolute","value":1699255075}},{"address":{"type":"absolute","value":1699255149}},{"address":{"type":"absolute","value":1699255168}},{"address":{"type":"absolute","value":1699255184}},{"address":{"type":"absolute","value":1699255228}},{"address":{"type":"absolute","value":1699255297}},{"address":{"type":"absolute","value":1699255388}},{"address":{"type":"absolute","value":1699255413}}]},{"address":{"type":"absolute","value":1699255472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699255617}},{"address":{"type":"absolute","value":1699255648}}]},{"address":{"type":"absolute","value":1699255696},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699255696}},{"address":{"type":"absolute","value":1699255853}}]},{"address":{"type":"absolute","value":1699256016},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699256064}}]},{"address":{"type":"absolute","value":1699256096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699256096}},{"address":{"type":"absolute","value":1699256140}},{"address":{"type":"absolute","value":1699256169}},{"address":{"type":"absolute","value":1699256266}},{"address":{"type":"absolute","value":1699256285}},{"address":{"type":"absolute","value":1699256496}},{"address":{"type":"absolute","value":1699256527}},{"address":{"type":"absolute","value":1699256589}},{"address":{"type":"absolute","value":1699256629}},{"address":{"type":"absolute","value":1699256677}},{"address":{"type":"absolute","value":1699256699}},{"address":{"type":"absolute","value":1699256864}},{"address":{"type":"absolute","value":1699256877}},{"address":{"type":"absolute","value":1699256889}},{"address":{"type":"absolute","value":1699256972}},{"address":{"type":"absolute","value":1699257083}},{"address":{"type":"absolute","value":1699257140}}]},{"address":{"type":"absolute","value":1699257232},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699257274}},{"address":{"type":"absolute","value":1699257296}}]},{"address":{"type":"absolute","value":1699257344},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699257344}},{"address":{"type":"absolute","value":1699257409}},{"address":{"type":"absolute","value":1699257448}},{"address":{"type":"absolute","value":1699257479}},{"address":{"type":"absolute","value":1699257521}}]},{"address":{"type":"absolute","value":1699257616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699257695}},{"address":{"type":"absolute","value":1699257768}},{"address":{"type":"absolute","value":1699257952}},{"address":{"type":"absolute","value":1699258051}},{"address":{"type":"absolute","value":1699258131}},{"address":{"type":"absolute","value":1699258147}},{"address":{"type":"absolute","value":1699258232}},{"address":{"type":"absolute","value":1699258276}},{"address":{"type":"absolute","value":1699258304}},{"address":{"type":"absolute","value":1699258354}},{"address":{"type":"absolute","value":1699258400}},{"address":{"type":"absolute","value":1699258512}},{"address":{"type":"absolute","value":1699258573}},{"address":{"type":"absolute","value":1699258610}},{"address":{"type":"absolute","value":1699258640}},{"address":{"type":"absolute","value":1699258672}}]},{"address":{"type":"absolute","value":1699258800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699258800}},{"address":{"type":"absolute","value":1699258864}},{"address":{"type":"absolute","value":1699258923}},{"address":{"type":"absolute","value":1699258965}},{"address":{"type":"absolute","value":1699259028}}]},{"address":{"type":"absolute","value":1699259056},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699259111}},{"address":{"type":"absolute","value":1699259181}},{"address":{"type":"absolute","value":1699259200}},{"address":{"type":"absolute","value":1699259312}},{"address":{"type":"absolute","value":1699259397}},{"address":{"type":"absolute","value":1699259414}},{"address":{"type":"absolute","value":1699259495}},{"address":{"type":"absolute","value":1699259552}},{"address":{"type":"absolute","value":1699259602}},{"address":{"type":"absolute","value":1699259636}},{"address":{"type":"absolute","value":1699259714}},{"address":{"type":"absolute","value":1699259782}},{"address":{"type":"absolute","value":1699259820}},{"address":{"type":"absolute","value":1699259842}},{"address":{"type":"absolute","value":1699259936}}]},{"address":{"type":"absolute","value":1699259952},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699257344}},{"address":{"type":"absolute","value":1699257409}},{"address":{"type":"absolute","value":1699257448}},{"address":{"type":"absolute","value":1699257479}},{"address":{"type":"absolute","value":1699257521}},{"address":{"type":"absolute","value":1699258800}},{"address":{"type":"absolute","value":1699258864}},{"address":{"type":"absolute","value":1699258923}},{"address":{"type":"absolute","value":1699258965}},{"address":{"type":"absolute","value":1699259028}},{"address":{"type":"absolute","value":1699259952}},{"address":{"type":"absolute","value":1699260062}},{"address":{"type":"absolute","value":1699260080}},{"address":{"type":"absolute","value":1699260103}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1699260192},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699260296}}]},{"address":{"type":"absolute","value":1699260304},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699260304}},{"address":{"type":"absolute","value":1699260354}},{"address":{"type":"absolute","value":1699260416}},{"address":{"type":"absolute","value":1699260436}},{"address":{"type":"absolute","value":1699260562}},{"address":{"type":"absolute","value":1699260583}}]},{"address":{"type":"absolute","value":1699260720},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699260814}},{"address":{"type":"absolute","value":1699260888}},{"address":{"type":"absolute","value":1699260996}},{"address":{"type":"absolute","value":1699261067}},{"address":{"type":"absolute","value":1699261172}},{"address":{"type":"absolute","value":1699261282}},{"address":{"type":"absolute","value":1699261328}},{"address":{"type":"absolute","value":1699261363}}]},{"address":{"type":"absolute","value":1699261616},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261616}}]},{"address":{"type":"absolute","value":1699261648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261693}}]},{"address":{"type":"absolute","value":1699261712},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261739}}]},{"address":{"type":"absolute","value":1699261792},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261828}},{"address":{"type":"absolute","value":1699261885}}]},{"address":{"type":"absolute","value":1699261904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261931}}]},{"address":{"type":"absolute","value":1699261984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}}]},{"address":{"type":"absolute","value":1699262080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262080}}]},{"address":{"type":"absolute","value":1699262128},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262128}},{"address":{"type":"absolute","value":1699262158}},{"address":{"type":"absolute","value":1699262193}},{"address":{"type":"absolute","value":1699262211}},{"address":{"type":"absolute","value":1699262288}},{"address":{"type":"absolute","value":1699262304}}]},{"address":{"type":"absolute","value":1699262336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699262384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699262496},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699262512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}}]},{"address":{"type":"absolute","value":1699262688},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}},{"address":{"type":"absolute","value":1699262739}},{"address":{"type":"absolute","value":1699262797}}]},{"address":{"type":"absolute","value":1699262816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262836}}]},{"address":{"type":"absolute","value":1699262864},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262898}},{"address":{"type":"absolute","value":1699262949}}]},{"address":{"type":"absolute","value":1699263008},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263030}},{"address":{"type":"absolute","value":1699263085}},{"address":{"type":"absolute","value":1699263133}},{"address":{"type":"absolute","value":1699263220}}]},{"address":{"type":"absolute","value":1699263264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263290}}]},{"address":{"type":"absolute","value":1699263296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}}]},{"address":{"type":"absolute","value":1699263328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262608}},{"address":{"type":"absolute","value":1699262640}},{"address":{"type":"absolute","value":1699263353}},{"address":{"type":"absolute","value":1699263395}},{"address":{"type":"absolute","value":1699263452}},{"address":{"type":"absolute","value":1699263488}}]},{"address":{"type":"absolute","value":1699263520},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263601}},{"address":{"type":"absolute","value":1699263617}}]},{"address":{"type":"absolute","value":1699263648},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}}]},{"address":{"type":"absolute","value":1699263824},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1699263824}},{"address":{"type":"absolute","value":1699263846}},{"address":{"type":"absolute","value":1699263878}}]},{"address":{"type":"absolute","value":1699263904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263904}},{"address":{"type":"absolute","value":1699263985}}]},{"address":{"type":"absolute","value":1699264048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}}]},{"address":{"type":"absolute","value":1699264224},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264224}}]},{"address":{"type":"absolute","value":1699264336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264336}},{"address":{"type":"absolute","value":1699264437}}]},{"address":{"type":"absolute","value":1699264512},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261739}},{"address":{"type":"absolute","value":1699264512}}]},{"address":{"type":"absolute","value":1699264528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699261931}},{"address":{"type":"absolute","value":1699264528}}]},{"address":{"type":"absolute","value":1699264544},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699264560},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698444640}},{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699264647}},{"address":{"type":"absolute","value":1699264688}}]},{"address":{"type":"absolute","value":1699264736},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699262003}},{"address":{"type":"absolute","value":1699262016}},{"address":{"type":"absolute","value":1699262034}},{"address":{"type":"absolute","value":1699262048}},{"address":{"type":"absolute","value":1699264736}},{"address":{"type":"absolute","value":1699264813}},{"address":{"type":"absolute","value":1699264881}},{"address":{"type":"absolute","value":1699264896}},{"address":{"type":"absolute","value":1699264964}}]},{"address":{"type":"absolute","value":1699264992},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264992}},{"address":{"type":"absolute","value":1699265024}},{"address":{"type":"absolute","value":1699265037}}]},{"address":{"type":"absolute","value":1699265088},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265088}},{"address":{"type":"absolute","value":1699265099}},{"address":{"type":"absolute","value":1699265162}},{"address":{"type":"absolute","value":1699265200}},{"address":{"type":"absolute","value":1699265216}},{"address":{"type":"absolute","value":1699265232}},{"address":{"type":"absolute","value":1699265248}}]},{"address":{"type":"absolute","value":1699265264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265264}},{"address":{"type":"absolute","value":1699265291}}]},{"address":{"type":"absolute","value":1699265328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699265328}}]},{"address":{"type":"absolute","value":1699265392},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699265552}},{"address":{"type":"absolute","value":1699265574}},{"address":{"type":"absolute","value":1699265650}},{"address":{"type":"absolute","value":1699265673}}]},{"address":{"type":"absolute","value":1699265776},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698445404}},{"address":{"type":"absolute","value":1698445578}},{"address":{"type":"absolute","value":1698445600}},{"address":{"type":"absolute","value":1698445680}},{"address":{"type":"absolute","value":1699265800}},{"address":{"type":"absolute","value":1699265808}}]},{"address":{"type":"absolute","value":1699265856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}}]},{"address":{"type":"absolute","value":1699265888},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699265888}}]},{"address":{"type":"absolute","value":1699265936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699265936}}]},{"address":{"type":"absolute","value":1699265984},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699266037}}]},{"address":{"type":"absolute","value":1699266048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699266048}},{"address":{"type":"absolute","value":1699266638}}]},{"address":{"type":"absolute","value":1699266816},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699262128}},{"address":{"type":"absolute","value":1699262158}},{"address":{"type":"absolute","value":1699262193}},{"address":{"type":"absolute","value":1699262211}},{"address":{"type":"absolute","value":1699262288}},{"address":{"type":"absolute","value":1699262304}},{"address":{"type":"absolute","value":1699266816}},{"address":{"type":"absolute","value":1699266863}}]},{"address":{"type":"absolute","value":1699266896},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699264336}},{"address":{"type":"absolute","value":1699264437}},{"address":{"type":"absolute","value":1699266896}},{"address":{"type":"absolute","value":1699266949}}]},{"address":{"type":"absolute","value":1699266976},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699266976}}]},{"address":{"type":"absolute","value":1699267024},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267024}}]},{"address":{"type":"absolute","value":1699267072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267072}}]},{"address":{"type":"absolute","value":1699267120},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267120}}]},{"address":{"type":"absolute","value":1699267184},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}}]},{"address":{"type":"absolute","value":1699267216},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}}]},{"address":{"type":"absolute","value":1699267248},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267339}},{"address":{"type":"absolute","value":1699267376}},{"address":{"type":"absolute","value":1699267393}}]},{"address":{"type":"absolute","value":1699267408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267454}}]},{"address":{"type":"absolute","value":1699267472},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699267523}},{"address":{"type":"absolute","value":1699267552}}]},{"address":{"type":"absolute","value":1699267568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267568}}]},{"address":{"type":"absolute","value":1699267632},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267692}},{"address":{"type":"absolute","value":1699267740}}]},{"address":{"type":"absolute","value":1699267808},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699267868}},{"address":{"type":"absolute","value":1699267916}}]},{"address":{"type":"absolute","value":1699268000},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699268000}}]},{"address":{"type":"absolute","value":1699268112},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699268261}},{"address":{"type":"absolute","value":1699268304}}]},{"address":{"type":"absolute","value":1699268336},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699268349}},{"address":{"type":"absolute","value":1699268368}}]},{"address":{"type":"absolute","value":1699268384},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699043593}},{"address":{"type":"absolute","value":1699043647}},{"address":{"type":"absolute","value":1699043664}},{"address":{"type":"absolute","value":1699043694}},{"address":{"type":"absolute","value":1699043729}},{"address":{"type":"absolute","value":1699043768}},{"address":{"type":"absolute","value":1699043798}},{"address":{"type":"absolute","value":1699044016}},{"address":{"type":"absolute","value":1699044099}},{"address":{"type":"absolute","value":1699044127}},{"address":{"type":"absolute","value":1699044242}},{"address":{"type":"absolute","value":1699268384}}]},{"address":{"type":"absolute","value":1699268432},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699039007}},{"address":{"type":"absolute","value":1699044464}},{"address":{"type":"absolute","value":1699044512}},{"address":{"type":"absolute","value":1699044547}},{"address":{"type":"absolute","value":1699044586}},{"address":{"type":"absolute","value":1699268432}}]},{"address":{"type":"absolute","value":1699268480},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699044636}},{"address":{"type":"absolute","value":1699044667}},{"address":{"type":"absolute","value":1699044698}},{"address":{"type":"absolute","value":1699044729}},{"address":{"type":"absolute","value":1699044760}},{"address":{"type":"absolute","value":1699044800}},{"address":{"type":"absolute","value":1699044882}},{"address":{"type":"absolute","value":1699044896}},{"address":{"type":"absolute","value":1699044976}},{"address":{"type":"absolute","value":1699268480}}]},{"address":{"type":"absolute","value":1699268528},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699045216}},{"address":{"type":"absolute","value":1699045259}},{"address":{"type":"absolute","value":1699045314}},{"address":{"type":"absolute","value":1699045328}},{"address":{"type":"absolute","value":1699268528}}]},{"address":{"type":"absolute","value":1699268576},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699046507}},{"address":{"type":"absolute","value":1699046587}},{"address":{"type":"absolute","value":1699046656}},{"address":{"type":"absolute","value":1699046677}},{"address":{"type":"absolute","value":1699046704}},{"address":{"type":"absolute","value":1699046736}},{"address":{"type":"absolute","value":1699047240}},{"address":{"type":"absolute","value":1699047251}},{"address":{"type":"absolute","value":1699047318}},{"address":{"type":"absolute","value":1699047386}},{"address":{"type":"absolute","value":1699047408}},{"address":{"type":"absolute","value":1699047456}},{"address":{"type":"absolute","value":1699268604}},{"address":{"type":"absolute","value":1699268624}},{"address":{"type":"absolute","value":1699268640}}]},{"address":{"type":"absolute","value":1699268672},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699268730}},{"address":{"type":"absolute","value":1699268735}},{"address":{"type":"absolute","value":1699268850}},{"address":{"type":"absolute","value":1699269065}},{"address":{"type":"absolute","value":1699269125}}]},{"address":{"type":"absolute","value":1699269168},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699269292}},{"address":{"type":"absolute","value":1699269315}},{"address":{"type":"absolute","value":1699269367}},{"address":{"type":"absolute","value":1699269390}},{"address":{"type":"absolute","value":1699269439}},{"address":{"type":"absolute","value":1699269486}},{"address":{"type":"absolute","value":1699269509}},{"address":{"type":"absolute","value":1699269562}},{"address":{"type":"absolute","value":1699269585}},{"address":{"type":"absolute","value":1699269653}},{"address":{"type":"absolute","value":1699269676}},{"address":{"type":"absolute","value":1699269728}},{"address":{"type":"absolute","value":1699269751}},{"address":{"type":"absolute","value":1699269808}}]},{"address":{"type":"absolute","value":1699269856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}}]},{"address":{"type":"absolute","value":1699271296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699234992}},{"address":{"type":"absolute","value":1699235108}},{"address":{"type":"absolute","value":1699235200}},{"address":{"type":"absolute","value":1699235264}},{"address":{"type":"absolute","value":1699235432}},{"address":{"type":"absolute","value":1699235488}},{"address":{"type":"absolute","value":1699235528}},{"address":{"type":"absolute","value":1699235553}},{"address":{"type":"absolute","value":1699235600}},{"address":{"type":"absolute","value":1699235747}},{"address":{"type":"absolute","value":1699235776}},{"address":{"type":"absolute","value":1699235856}},{"address":{"type":"absolute","value":1699240512}},{"address":{"type":"absolute","value":1699240581}},{"address":{"type":"absolute","value":1699240592}},{"address":{"type":"absolute","value":1699240678}},{"address":{"type":"absolute","value":1699244768}},{"address":{"type":"absolute","value":1699245037}},{"address":{"type":"absolute","value":1699245061}},{"address":{"type":"absolute","value":1699262428}},{"address":{"type":"absolute","value":1699262464}},{"address":{"type":"absolute","value":1699263732}},{"address":{"type":"absolute","value":1699263776}},{"address":{"type":"absolute","value":1699264076}},{"address":{"type":"absolute","value":1699264128}},{"address":{"type":"absolute","value":1699266037}},{"address":{"type":"absolute","value":1699266048}},{"address":{"type":"absolute","value":1699266638}},{"address":{"type":"absolute","value":1699269856}},{"address":{"type":"absolute","value":1699269891}},{"address":{"type":"absolute","value":1699269900}},{"address":{"type":"absolute","value":1699270153}},{"address":{"type":"absolute","value":1699270515}},{"address":{"type":"absolute","value":1699270693}},{"address":{"type":"absolute","value":1699271296}},{"address":{"type":"absolute","value":1699271336}},{"address":{"type":"absolute","value":1699271345}},{"address":{"type":"absolute","value":1699271472}},{"address":{"type":"absolute","value":1699271493}},{"address":{"type":"absolute","value":1699271894}},{"address":{"type":"absolute","value":1699271969}},{"address":{"type":"absolute","value":1699272000}},{"address":{"type":"absolute","value":1699272460}},{"address":{"type":"absolute","value":1699272473}},{"address":{"type":"absolute","value":1699272498}}]},{"address":{"type":"absolute","value":1699272640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1698447846}},{"address":{"type":"absolute","value":1698447856}},{"address":{"type":"absolute","value":1699267184}},{"address":{"type":"absolute","value":1699272640}},{"address":{"type":"absolute","value":1699272678}},{"address":{"type":"absolute","value":1699272752}},{"address":{"type":"absolute","value":1699272770}}]},{"address":{"type":"absolute","value":1699272848},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699272848}},{"address":{"type":"absolute","value":1699273304}},{"address":{"type":"absolute","value":1699273631}},{"address":{"type":"absolute","value":1699273958}},{"address":{"type":"absolute","value":1699274827}},{"address":{"type":"absolute","value":1699274880}},{"address":{"type":"absolute","value":1699275381}}]},{"address":{"type":"absolute","value":1699275456},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699275522}},{"address":{"type":"absolute","value":1699275621}},{"address":{"type":"absolute","value":1699276104}}]},{"address":{"type":"absolute","value":1699276464},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276485}},{"address":{"type":"absolute","value":1699276496}},{"address":{"type":"absolute","value":1699276521}},{"address":{"type":"absolute","value":1699276533}}]},{"address":{"type":"absolute","value":1699276719},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276750}}]},{"address":{"type":"absolute","value":1699276800},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276840}}]},{"address":{"type":"absolute","value":1699276960},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699276960}},{"address":{"type":"absolute","value":1699277031}}]},{"address":{"type":"absolute","value":1699277072},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277072}},{"address":{"type":"absolute","value":1699277160}}]},{"address":{"type":"absolute","value":1699277360},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277408}}]},{"address":{"type":"absolute","value":1699277424},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277424}},{"address":{"type":"absolute","value":1699277472}},{"address":{"type":"absolute","value":1699277483}},{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1699277536},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277424}},{"address":{"type":"absolute","value":1699277472}},{"address":{"type":"absolute","value":1699277483}},{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1699277568},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699277568}},{"address":{"type":"absolute","value":1699277609}},{"address":{"type":"absolute","value":1699277729}}]},{"address":{"type":"absolute","value":1699278048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278048}},{"address":{"type":"absolute","value":1699278061}},{"address":{"type":"absolute","value":1699278080}}]},{"address":{"type":"absolute","value":1699278096},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278096}},{"address":{"type":"absolute","value":1699278114}},{"address":{"type":"absolute","value":1699278120}},{"address":{"type":"absolute","value":1699278130}},{"address":{"type":"absolute","value":1699278173}},{"address":{"type":"absolute","value":1699278182}},{"address":{"type":"absolute","value":1699278194}}]},{"address":{"type":"absolute","value":1699278272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278306}},{"address":{"type":"absolute","value":1699278328}},{"address":{"type":"absolute","value":1699278348}},{"address":{"type":"absolute","value":1699278379}},{"address":{"type":"absolute","value":1699278482}},{"address":{"type":"absolute","value":1699278508}},{"address":{"type":"absolute","value":1699278524}},{"address":{"type":"absolute","value":1699278544}},{"address":{"type":"absolute","value":1699278592}},{"address":{"type":"absolute","value":1699278612}}]},{"address":{"type":"absolute","value":1699278784},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699278835}},{"address":{"type":"absolute","value":1699278953}},{"address":{"type":"absolute","value":1699278992}},{"address":{"type":"absolute","value":1699278996}},{"address":{"type":"absolute","value":1699279056}},{"address":{"type":"absolute","value":1699279074}},{"address":{"type":"absolute","value":1699279088}},{"address":{"type":"absolute","value":1699279126}},{"address":{"type":"absolute","value":1699279167}},{"address":{"type":"absolute","value":1699279226}},{"address":{"type":"absolute","value":1699279256}},{"address":{"type":"absolute","value":1699279269}},{"address":{"type":"absolute","value":1699279292}},{"address":{"type":"absolute","value":1699279344}},{"address":{"type":"absolute","value":1699279397}}]},{"address":{"type":"absolute","value":1699279488},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699279488}},{"address":{"type":"absolute","value":1699279587}},{"address":{"type":"absolute","value":1699279654}},{"address":{"type":"absolute","value":1699279713}},{"address":{"type":"absolute","value":1699279742}},{"address":{"type":"absolute","value":1699279780}}]},{"address":{"type":"absolute","value":1699279904},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699279969}},{"address":{"type":"absolute","value":1699280037}}]},{"address":{"type":"absolute","value":1699280144},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280144}},{"address":{"type":"absolute","value":1699280273}},{"address":{"type":"absolute","value":1699280354}},{"address":{"type":"absolute","value":1699280378}}]},{"address":{"type":"absolute","value":1699280640},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280724}}]},{"address":{"type":"absolute","value":1699280752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280777}},{"address":{"type":"absolute","value":1699280811}}]},{"address":{"type":"absolute","value":1699280880},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699280897}},{"address":{"type":"absolute","value":1699280976}}]},{"address":{"type":"absolute","value":1699281040},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281040}},{"address":{"type":"absolute","value":1699281056}},{"address":{"type":"absolute","value":1699281093}},{"address":{"type":"absolute","value":1699281210}}]},{"address":{"type":"absolute","value":1699281264},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281264}}]},{"address":{"type":"absolute","value":1699281296},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281264}}]},{"address":{"type":"absolute","value":1699281328},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281328}},{"address":{"type":"absolute","value":1699281376}},{"address":{"type":"absolute","value":1699281384}}]},{"address":{"type":"absolute","value":1699281408},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281408}},{"address":{"type":"absolute","value":1699281455}},{"address":{"type":"absolute","value":1699281493}},{"address":{"type":"absolute","value":1699281523}},{"address":{"type":"absolute","value":1699281536}}]},{"address":{"type":"absolute","value":1699281552},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281552}},{"address":{"type":"absolute","value":1699281586}},{"address":{"type":"absolute","value":1699281644}},{"address":{"type":"absolute","value":1699281652}},{"address":{"type":"absolute","value":1699281663}}]},{"address":{"type":"absolute","value":1699281680},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281680}},{"address":{"type":"absolute","value":1699281701}},{"address":{"type":"absolute","value":1699281724}}]},{"address":{"type":"absolute","value":1699281744},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281744}},{"address":{"type":"absolute","value":1699281778}},{"address":{"type":"absolute","value":1699281839}},{"address":{"type":"absolute","value":1699281850}}]},{"address":{"type":"absolute","value":1699281856},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281856}},{"address":{"type":"absolute","value":1699281874}},{"address":{"type":"absolute","value":1699281904}}]},{"address":{"type":"absolute","value":1699281920},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699281920}},{"address":{"type":"absolute","value":1699281944}},{"address":{"type":"absolute","value":1699281964}},{"address":{"type":"absolute","value":1699282028}},{"address":{"type":"absolute","value":1699282036}},{"address":{"type":"absolute","value":1699282045}},{"address":{"type":"absolute","value":1699282052}}]},{"address":{"type":"absolute","value":1699282080},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282080}},{"address":{"type":"absolute","value":1699282114}},{"address":{"type":"absolute","value":1699282131}},{"address":{"type":"absolute","value":1699282172}},{"address":{"type":"absolute","value":1699282181}},{"address":{"type":"absolute","value":1699282190}},{"address":{"type":"absolute","value":1699282197}},{"address":{"type":"absolute","value":1699282208}},{"address":{"type":"absolute","value":1699282235}}]},{"address":{"type":"absolute","value":1699282272},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282287}}]},{"address":{"type":"absolute","value":1699282368},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282448}},{"address":{"type":"absolute","value":1699282496}},{"address":{"type":"absolute","value":1699282518}}]},{"address":{"type":"absolute","value":1699282592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282628}},{"address":{"type":"absolute","value":1699282651}},{"address":{"type":"absolute","value":1699282716}}]},{"address":{"type":"absolute","value":1699282752},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282808}}]},{"address":{"type":"absolute","value":1699282832},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699282888}}]},{"address":{"type":"absolute","value":1699282912},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283106}},{"address":{"type":"absolute","value":1699283189}}]},{"address":{"type":"absolute","value":1699283728},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]},{"address":{"type":"absolute","value":1699283936},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699284001}},{"address":{"type":"absolute","value":1699284018}},{"address":{"type":"absolute","value":1699284037}}]},{"address":{"type":"absolute","value":1699284048},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699284048}}]},{"address":{"type":"absolute","value":1699284592},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699284592}}]},{"address":{"type":"absolute","value":1699284704},"matched_basic_blocks":[{"address":{"type":"absolute","value":1699283803}},{"address":{"type":"absolute","value":1699283845}}]}]},"feature_counts":{"file":21651,"functions":[{"address":{"type":"absolute","value":1698435072},"count":22},{"address":{"type":"absolute","value":1698435088},"count":69},{"address":{"type":"absolute","value":1698435584},"count":44},{"address":{"type":"absolute","value":1698435888},"count":58},{"address":{"type":"absolute","value":1698435968},"count":62},{"address":{"type":"absolute","value":1698435984},"count":63},{"address":{"type":"absolute","value":1698436000},"count":5},{"address":{"type":"absolute","value":1698436016},"count":8},{"address":{"type":"absolute","value":1698436032},"count":8},{"address":{"type":"absolute","value":1698436048},"count":8},{"address":{"type":"absolute","value":1698436064},"count":8},{"address":{"type":"absolute","value":1698436080},"count":26},{"address":{"type":"absolute","value":1698436128},"count":19},{"address":{"type":"absolute","value":1698436160},"count":49},{"address":{"type":"absolute","value":1698436176},"count":29},{"address":{"type":"absolute","value":1698436240},"count":19},{"address":{"type":"absolute","value":1698436272},"count":23},{"address":{"type":"absolute","value":1698436320},"count":18},{"address":{"type":"absolute","value":1698436352},"count":25},{"address":{"type":"absolute","value":1698436400},"count":18},{"address":{"type":"absolute","value":1698436432},"count":62},{"address":{"type":"absolute","value":1698436448},"count":30},{"address":{"type":"absolute","value":1698436512},"count":167},{"address":{"type":"absolute","value":1698436528},"count":86},{"address":{"type":"absolute","value":1698436544},"count":16},{"address":{"type":"absolute","value":1698436560},"count":16},{"address":{"type":"absolute","value":1698436576},"count":21},{"address":{"type":"absolute","value":1698436624},"count":16},{"address":{"type":"absolute","value":1698436640},"count":16},{"address":{"type":"absolute","value":1698436656},"count":62},{"address":{"type":"absolute","value":1698436672},"count":40},{"address":{"type":"absolute","value":1698436688},"count":63},{"address":{"type":"absolute","value":1698436704},"count":63},{"address":{"type":"absolute","value":1698436720},"count":51},{"address":{"type":"absolute","value":1698436736},"count":27},{"address":{"type":"absolute","value":1698436752},"count":42},{"address":{"type":"absolute","value":1698436768},"count":30},{"address":{"type":"absolute","value":1698436784},"count":40},{"address":{"type":"absolute","value":1698436800},"count":40},{"address":{"type":"absolute","value":1698436816},"count":25},{"address":{"type":"absolute","value":1698436864},"count":39},{"address":{"type":"absolute","value":1698436880},"count":43},{"address":{"type":"absolute","value":1698436896},"count":39},{"address":{"type":"absolute","value":1698436912},"count":67},{"address":{"type":"absolute","value":1698436928},"count":67},{"address":{"type":"absolute","value":1698436944},"count":51},{"address":{"type":"absolute","value":1698436960},"count":42},{"address":{"type":"absolute","value":1698436976},"count":18},{"address":{"type":"absolute","value":1698437008},"count":19},{"address":{"type":"absolute","value":1698437024},"count":21},{"address":{"type":"absolute","value":1698437040},"count":45},{"address":{"type":"absolute","value":1698437056},"count":38},{"address":{"type":"absolute","value":1698437072},"count":70},{"address":{"type":"absolute","value":1698437088},"count":40},{"address":{"type":"absolute","value":1698437104},"count":23},{"address":{"type":"absolute","value":1698437152},"count":23},{"address":{"type":"absolute","value":1698437200},"count":18},{"address":{"type":"absolute","value":1698437232},"count":55},{"address":{"type":"absolute","value":1698437248},"count":78},{"address":{"type":"absolute","value":1698437264},"count":70},{"address":{"type":"absolute","value":1698437280},"count":93},{"address":{"type":"absolute","value":1698437296},"count":44},{"address":{"type":"absolute","value":1698437312},"count":70},{"address":{"type":"absolute","value":1698437328},"count":93},{"address":{"type":"absolute","value":1698437344},"count":85},{"address":{"type":"absolute","value":1698437360},"count":43},{"address":{"type":"absolute","value":1698437376},"count":114},{"address":{"type":"absolute","value":1698437392},"count":59},{"address":{"type":"absolute","value":1698437408},"count":151},{"address":{"type":"absolute","value":1698437424},"count":93},{"address":{"type":"absolute","value":1698437440},"count":267},{"address":{"type":"absolute","value":1698437456},"count":28},{"address":{"type":"absolute","value":1698437472},"count":50},{"address":{"type":"absolute","value":1698437488},"count":18},{"address":{"type":"absolute","value":1698437504},"count":28},{"address":{"type":"absolute","value":1698437520},"count":20},{"address":{"type":"absolute","value":1698437536},"count":55},{"address":{"type":"absolute","value":1698437552},"count":32},{"address":{"type":"absolute","value":1698437568},"count":30},{"address":{"type":"absolute","value":1698437584},"count":30},{"address":{"type":"absolute","value":1698437600},"count":18},{"address":{"type":"absolute","value":1698437632},"count":87},{"address":{"type":"absolute","value":1698437648},"count":46},{"address":{"type":"absolute","value":1698437664},"count":18},{"address":{"type":"absolute","value":1698437696},"count":18},{"address":{"type":"absolute","value":1698437728},"count":24},{"address":{"type":"absolute","value":1698437808},"count":48},{"address":{"type":"absolute","value":1698437872},"count":142},{"address":{"type":"absolute","value":1698437920},"count":158},{"address":{"type":"absolute","value":1698437984},"count":48},{"address":{"type":"absolute","value":1698438048},"count":116},{"address":{"type":"absolute","value":1698438112},"count":56},{"address":{"type":"absolute","value":1698438160},"count":40},{"address":{"type":"absolute","value":1698438176},"count":25},{"address":{"type":"absolute","value":1698438192},"count":70},{"address":{"type":"absolute","value":1698438208},"count":50},{"address":{"type":"absolute","value":1698438224},"count":74},{"address":{"type":"absolute","value":1698438240},"count":60},{"address":{"type":"absolute","value":1698438256},"count":87},{"address":{"type":"absolute","value":1698438272},"count":90},{"address":{"type":"absolute","value":1698438288},"count":46},{"address":{"type":"absolute","value":1698438304},"count":60},{"address":{"type":"absolute","value":1698438320},"count":29},{"address":{"type":"absolute","value":1698438336},"count":89},{"address":{"type":"absolute","value":1698438352},"count":42},{"address":{"type":"absolute","value":1698438368},"count":64},{"address":{"type":"absolute","value":1698438384},"count":24},{"address":{"type":"absolute","value":1698438512},"count":29},{"address":{"type":"absolute","value":1698438608},"count":66},{"address":{"type":"absolute","value":1698438624},"count":24},{"address":{"type":"absolute","value":1698438704},"count":24},{"address":{"type":"absolute","value":1698438784},"count":24},{"address":{"type":"absolute","value":1698438864},"count":24},{"address":{"type":"absolute","value":1698438944},"count":24},{"address":{"type":"absolute","value":1698439024},"count":24},{"address":{"type":"absolute","value":1698439104},"count":24},{"address":{"type":"absolute","value":1698439184},"count":18},{"address":{"type":"absolute","value":1698439216},"count":24},{"address":{"type":"absolute","value":1698439296},"count":27},{"address":{"type":"absolute","value":1698439312},"count":35},{"address":{"type":"absolute","value":1698439328},"count":22},{"address":{"type":"absolute","value":1698439344},"count":31},{"address":{"type":"absolute","value":1698439472},"count":28},{"address":{"type":"absolute","value":1698439568},"count":32},{"address":{"type":"absolute","value":1698439584},"count":26},{"address":{"type":"absolute","value":1698439600},"count":24},{"address":{"type":"absolute","value":1698439680},"count":28},{"address":{"type":"absolute","value":1698439696},"count":35},{"address":{"type":"absolute","value":1698439712},"count":9},{"address":{"type":"absolute","value":1698439728},"count":32},{"address":{"type":"absolute","value":1698439744},"count":32},{"address":{"type":"absolute","value":1698439760},"count":29},{"address":{"type":"absolute","value":1698439856},"count":42},{"address":{"type":"absolute","value":1698439872},"count":24},{"address":{"type":"absolute","value":1698439952},"count":24},{"address":{"type":"absolute","value":1698440032},"count":24},{"address":{"type":"absolute","value":1698440112},"count":24},{"address":{"type":"absolute","value":1698440192},"count":24},{"address":{"type":"absolute","value":1698440272},"count":24},{"address":{"type":"absolute","value":1698440352},"count":29},{"address":{"type":"absolute","value":1698440448},"count":29},{"address":{"type":"absolute","value":1698440544},"count":29},{"address":{"type":"absolute","value":1698440640},"count":24},{"address":{"type":"absolute","value":1698440720},"count":24},{"address":{"type":"absolute","value":1698440784},"count":29},{"address":{"type":"absolute","value":1698440864},"count":18},{"address":{"type":"absolute","value":1698440896},"count":24},{"address":{"type":"absolute","value":1698440976},"count":50},{"address":{"type":"absolute","value":1698440992},"count":25},{"address":{"type":"absolute","value":1698441008},"count":32},{"address":{"type":"absolute","value":1698441056},"count":96},{"address":{"type":"absolute","value":1698441120},"count":41},{"address":{"type":"absolute","value":1698441184},"count":46},{"address":{"type":"absolute","value":1698441232},"count":29},{"address":{"type":"absolute","value":1698441328},"count":29},{"address":{"type":"absolute","value":1698441424},"count":67},{"address":{"type":"absolute","value":1698441440},"count":24},{"address":{"type":"absolute","value":1698441504},"count":29},{"address":{"type":"absolute","value":1698441584},"count":57},{"address":{"type":"absolute","value":1698441600},"count":24},{"address":{"type":"absolute","value":1698441680},"count":58},{"address":{"type":"absolute","value":1698441744},"count":48},{"address":{"type":"absolute","value":1698441760},"count":18},{"address":{"type":"absolute","value":1698441792},"count":69},{"address":{"type":"absolute","value":1698441888},"count":34},{"address":{"type":"absolute","value":1698442016},"count":47},{"address":{"type":"absolute","value":1698442096},"count":29},{"address":{"type":"absolute","value":1698442112},"count":31},{"address":{"type":"absolute","value":1698442160},"count":18},{"address":{"type":"absolute","value":1698442176},"count":24},{"address":{"type":"absolute","value":1698442256},"count":18},{"address":{"type":"absolute","value":1698442288},"count":27},{"address":{"type":"absolute","value":1698442304},"count":46},{"address":{"type":"absolute","value":1698442320},"count":24},{"address":{"type":"absolute","value":1698442400},"count":66},{"address":{"type":"absolute","value":1698442416},"count":39},{"address":{"type":"absolute","value":1698442512},"count":165},{"address":{"type":"absolute","value":1698442624},"count":24},{"address":{"type":"absolute","value":1698442704},"count":30},{"address":{"type":"absolute","value":1698442816},"count":30},{"address":{"type":"absolute","value":1698442928},"count":61},{"address":{"type":"absolute","value":1698442944},"count":105},{"address":{"type":"absolute","value":1698443056},"count":35},{"address":{"type":"absolute","value":1698443136},"count":18},{"address":{"type":"absolute","value":1698443168},"count":36},{"address":{"type":"absolute","value":1698443184},"count":18},{"address":{"type":"absolute","value":1698443216},"count":55},{"address":{"type":"absolute","value":1698443232},"count":26},{"address":{"type":"absolute","value":1698443280},"count":71},{"address":{"type":"absolute","value":1698443296},"count":55},{"address":{"type":"absolute","value":1698443312},"count":75},{"address":{"type":"absolute","value":1698443376},"count":76},{"address":{"type":"absolute","value":1698443392},"count":121},{"address":{"type":"absolute","value":1698443408},"count":16},{"address":{"type":"absolute","value":1698443424},"count":22},{"address":{"type":"absolute","value":1698443440},"count":34},{"address":{"type":"absolute","value":1698443456},"count":7},{"address":{"type":"absolute","value":1698443472},"count":7},{"address":{"type":"absolute","value":1698443488},"count":7},{"address":{"type":"absolute","value":1698443504},"count":21},{"address":{"type":"absolute","value":1698443520},"count":35},{"address":{"type":"absolute","value":1698443536},"count":22},{"address":{"type":"absolute","value":1698443552},"count":37},{"address":{"type":"absolute","value":1698443568},"count":36},{"address":{"type":"absolute","value":1698443584},"count":45},{"address":{"type":"absolute","value":1698443600},"count":32},{"address":{"type":"absolute","value":1698443616},"count":31},{"address":{"type":"absolute","value":1698443632},"count":36},{"address":{"type":"absolute","value":1698443648},"count":31},{"address":{"type":"absolute","value":1698443664},"count":36},{"address":{"type":"absolute","value":1698443680},"count":35},{"address":{"type":"absolute","value":1698443696},"count":26},{"address":{"type":"absolute","value":1698443712},"count":39},{"address":{"type":"absolute","value":1698443728},"count":23},{"address":{"type":"absolute","value":1698443776},"count":24},{"address":{"type":"absolute","value":1698443824},"count":7},{"address":{"type":"absolute","value":1698443840},"count":10},{"address":{"type":"absolute","value":1698443872},"count":7},{"address":{"type":"absolute","value":1698443888},"count":37},{"address":{"type":"absolute","value":1698444032},"count":7},{"address":{"type":"absolute","value":1698444048},"count":6},{"address":{"type":"absolute","value":1698444064},"count":9},{"address":{"type":"absolute","value":1698444080},"count":65},{"address":{"type":"absolute","value":1698444496},"count":23},{"address":{"type":"absolute","value":1698444544},"count":17},{"address":{"type":"absolute","value":1698444592},"count":19},{"address":{"type":"absolute","value":1698444640},"count":27},{"address":{"type":"absolute","value":1698444688},"count":27},{"address":{"type":"absolute","value":1698444736},"count":23},{"address":{"type":"absolute","value":1698444784},"count":23},{"address":{"type":"absolute","value":1698444832},"count":27},{"address":{"type":"absolute","value":1698444880},"count":28},{"address":{"type":"absolute","value":1698444944},"count":72},{"address":{"type":"absolute","value":1698445344},"count":72},{"address":{"type":"absolute","value":1698445376},"count":56},{"address":{"type":"absolute","value":1698445728},"count":77},{"address":{"type":"absolute","value":1698446304},"count":91},{"address":{"type":"absolute","value":1698446864},"count":58},{"address":{"type":"absolute","value":1698446992},"count":20},{"address":{"type":"absolute","value":1698447040},"count":57},{"address":{"type":"absolute","value":1698447424},"count":35},{"address":{"type":"absolute","value":1698447600},"count":54},{"address":{"type":"absolute","value":1698447808},"count":27},{"address":{"type":"absolute","value":1698447888},"count":37},{"address":{"type":"absolute","value":1698448032},"count":33},{"address":{"type":"absolute","value":1698448080},"count":50},{"address":{"type":"absolute","value":1698448288},"count":122},{"address":{"type":"absolute","value":1698449552},"count":36},{"address":{"type":"absolute","value":1698451312},"count":23},{"address":{"type":"absolute","value":1698451424},"count":35},{"address":{"type":"absolute","value":1698451520},"count":21},{"address":{"type":"absolute","value":1698451568},"count":22},{"address":{"type":"absolute","value":1698451616},"count":40},{"address":{"type":"absolute","value":1698451728},"count":46},{"address":{"type":"absolute","value":1698451856},"count":6},{"address":{"type":"absolute","value":1698451872},"count":37},{"address":{"type":"absolute","value":1698451888},"count":27},{"address":{"type":"absolute","value":1698451920},"count":35},{"address":{"type":"absolute","value":1698452048},"count":37},{"address":{"type":"absolute","value":1698452176},"count":46},{"address":{"type":"absolute","value":1698452192},"count":33},{"address":{"type":"absolute","value":1698452320},"count":37},{"address":{"type":"absolute","value":1698452448},"count":37},{"address":{"type":"absolute","value":1698452592},"count":31},{"address":{"type":"absolute","value":1698452688},"count":31},{"address":{"type":"absolute","value":1698452784},"count":36},{"address":{"type":"absolute","value":1698452960},"count":9},{"address":{"type":"absolute","value":1698452992},"count":9},{"address":{"type":"absolute","value":1698453024},"count":20},{"address":{"type":"absolute","value":1698453072},"count":17},{"address":{"type":"absolute","value":1698453136},"count":43},{"address":{"type":"absolute","value":1698453312},"count":21},{"address":{"type":"absolute","value":1698453344},"count":70},{"address":{"type":"absolute","value":1698453792},"count":45},{"address":{"type":"absolute","value":1698453936},"count":87},{"address":{"type":"absolute","value":1698454496},"count":63},{"address":{"type":"absolute","value":1698454672},"count":31},{"address":{"type":"absolute","value":1698454736},"count":290},{"address":{"type":"absolute","value":1698460704},"count":29},{"address":{"type":"absolute","value":1698460768},"count":64},{"address":{"type":"absolute","value":1698461184},"count":52},{"address":{"type":"absolute","value":1698461472},"count":16},{"address":{"type":"absolute","value":1698461504},"count":16},{"address":{"type":"absolute","value":1698461536},"count":21},{"address":{"type":"absolute","value":1698461584},"count":16},{"address":{"type":"absolute","value":1698461616},"count":16},{"address":{"type":"absolute","value":1698461648},"count":63},{"address":{"type":"absolute","value":1698461984},"count":41},{"address":{"type":"absolute","value":1698462112},"count":64},{"address":{"type":"absolute","value":1698462144},"count":64},{"address":{"type":"absolute","value":1698462176},"count":43},{"address":{"type":"absolute","value":1698462192},"count":31},{"address":{"type":"absolute","value":1698462304},"count":41},{"address":{"type":"absolute","value":1698462416},"count":41},{"address":{"type":"absolute","value":1698462624},"count":52},{"address":{"type":"absolute","value":1698462656},"count":28},{"address":{"type":"absolute","value":1698462736},"count":33},{"address":{"type":"absolute","value":1698462832},"count":27},{"address":{"type":"absolute","value":1698462912},"count":23},{"address":{"type":"absolute","value":1698462992},"count":20},{"address":{"type":"absolute","value":1698463024},"count":168},{"address":{"type":"absolute","value":1698464512},"count":86},{"address":{"type":"absolute","value":1698465008},"count":58},{"address":{"type":"absolute","value":1698465264},"count":125},{"address":{"type":"absolute","value":1698466688},"count":20},{"address":{"type":"absolute","value":1698466720},"count":74},{"address":{"type":"absolute","value":1698466992},"count":7},{"address":{"type":"absolute","value":1698467008},"count":30},{"address":{"type":"absolute","value":1698467072},"count":65},{"address":{"type":"absolute","value":1698467408},"count":48},{"address":{"type":"absolute","value":1698467504},"count":8},{"address":{"type":"absolute","value":1698467520},"count":50},{"address":{"type":"absolute","value":1698467616},"count":52},{"address":{"type":"absolute","value":1698467712},"count":49},{"address":{"type":"absolute","value":1698467744},"count":26},{"address":{"type":"absolute","value":1698467824},"count":82},{"address":{"type":"absolute","value":1698468096},"count":35},{"address":{"type":"absolute","value":1698468304},"count":60},{"address":{"type":"absolute","value":1698468496},"count":84},{"address":{"type":"absolute","value":1698469008},"count":31},{"address":{"type":"absolute","value":1698469040},"count":55},{"address":{"type":"absolute","value":1698469184},"count":67},{"address":{"type":"absolute","value":1698469776},"count":33},{"address":{"type":"absolute","value":1698469856},"count":40},{"address":{"type":"absolute","value":1698469984},"count":33},{"address":{"type":"absolute","value":1698470096},"count":23},{"address":{"type":"absolute","value":1698470160},"count":7},{"address":{"type":"absolute","value":1698470176},"count":20},{"address":{"type":"absolute","value":1698470240},"count":24},{"address":{"type":"absolute","value":1698470304},"count":33},{"address":{"type":"absolute","value":1698470448},"count":29},{"address":{"type":"absolute","value":1698470512},"count":74},{"address":{"type":"absolute","value":1698471072},"count":66},{"address":{"type":"absolute","value":1698471344},"count":27},{"address":{"type":"absolute","value":1698471392},"count":21},{"address":{"type":"absolute","value":1698471456},"count":21},{"address":{"type":"absolute","value":1698471520},"count":62},{"address":{"type":"absolute","value":1698472000},"count":10},{"address":{"type":"absolute","value":1698472016},"count":10},{"address":{"type":"absolute","value":1698472048},"count":8},{"address":{"type":"absolute","value":1698472064},"count":18},{"address":{"type":"absolute","value":1698472112},"count":26},{"address":{"type":"absolute","value":1698472176},"count":28},{"address":{"type":"absolute","value":1698472256},"count":12},{"address":{"type":"absolute","value":1698472288},"count":39},{"address":{"type":"absolute","value":1698473280},"count":57},{"address":{"type":"absolute","value":1698474016},"count":30},{"address":{"type":"absolute","value":1698474112},"count":49},{"address":{"type":"absolute","value":1698474336},"count":43},{"address":{"type":"absolute","value":1698474496},"count":72},{"address":{"type":"absolute","value":1698475088},"count":125},{"address":{"type":"absolute","value":1698475616},"count":42},{"address":{"type":"absolute","value":1698475680},"count":74},{"address":{"type":"absolute","value":1698476064},"count":119},{"address":{"type":"absolute","value":1698476416},"count":106},{"address":{"type":"absolute","value":1698476928},"count":51},{"address":{"type":"absolute","value":1698477120},"count":47},{"address":{"type":"absolute","value":1698477472},"count":48},{"address":{"type":"absolute","value":1698477568},"count":36},{"address":{"type":"absolute","value":1698477648},"count":40},{"address":{"type":"absolute","value":1698477728},"count":56},{"address":{"type":"absolute","value":1698477840},"count":133},{"address":{"type":"absolute","value":1698478560},"count":58},{"address":{"type":"absolute","value":1698478848},"count":52},{"address":{"type":"absolute","value":1698479024},"count":36},{"address":{"type":"absolute","value":1698479136},"count":36},{"address":{"type":"absolute","value":1698479248},"count":35},{"address":{"type":"absolute","value":1698479408},"count":22},{"address":{"type":"absolute","value":1698479456},"count":28},{"address":{"type":"absolute","value":1698479536},"count":209},{"address":{"type":"absolute","value":1698480768},"count":37},{"address":{"type":"absolute","value":1698480848},"count":67},{"address":{"type":"absolute","value":1698481024},"count":93},{"address":{"type":"absolute","value":1698482016},"count":327},{"address":{"type":"absolute","value":1698482784},"count":79},{"address":{"type":"absolute","value":1698483136},"count":323},{"address":{"type":"absolute","value":1698483440},"count":37},{"address":{"type":"absolute","value":1698483568},"count":30},{"address":{"type":"absolute","value":1698483648},"count":283},{"address":{"type":"absolute","value":1698483792},"count":228},{"address":{"type":"absolute","value":1698483936},"count":225},{"address":{"type":"absolute","value":1698484080},"count":29},{"address":{"type":"absolute","value":1698485552},"count":48},{"address":{"type":"absolute","value":1698485696},"count":75},{"address":{"type":"absolute","value":1698485952},"count":32},{"address":{"type":"absolute","value":1698486000},"count":26},{"address":{"type":"absolute","value":1698486048},"count":42},{"address":{"type":"absolute","value":1698486144},"count":51},{"address":{"type":"absolute","value":1698486368},"count":121},{"address":{"type":"absolute","value":1698487168},"count":153},{"address":{"type":"absolute","value":1698488592},"count":100},{"address":{"type":"absolute","value":1698489552},"count":100},{"address":{"type":"absolute","value":1698490544},"count":81},{"address":{"type":"absolute","value":1698490800},"count":81},{"address":{"type":"absolute","value":1698491056},"count":104},{"address":{"type":"absolute","value":1698491888},"count":138},{"address":{"type":"absolute","value":1698492736},"count":115},{"address":{"type":"absolute","value":1698493136},"count":130},{"address":{"type":"absolute","value":1698493632},"count":108},{"address":{"type":"absolute","value":1698494208},"count":96},{"address":{"type":"absolute","value":1698494544},"count":145},{"address":{"type":"absolute","value":1698495024},"count":47},{"address":{"type":"absolute","value":1698495136},"count":98},{"address":{"type":"absolute","value":1698495504},"count":98},{"address":{"type":"absolute","value":1698495520},"count":98},{"address":{"type":"absolute","value":1698495536},"count":161},{"address":{"type":"absolute","value":1698495744},"count":62},{"address":{"type":"absolute","value":1698495904},"count":108},{"address":{"type":"absolute","value":1698496368},"count":142},{"address":{"type":"absolute","value":1698497376},"count":43},{"address":{"type":"absolute","value":1698497504},"count":58},{"address":{"type":"absolute","value":1698497680},"count":84},{"address":{"type":"absolute","value":1698497936},"count":71},{"address":{"type":"absolute","value":1698498240},"count":75},{"address":{"type":"absolute","value":1698498752},"count":137},{"address":{"type":"absolute","value":1698499424},"count":65},{"address":{"type":"absolute","value":1698499824},"count":154},{"address":{"type":"absolute","value":1698500224},"count":128},{"address":{"type":"absolute","value":1698500704},"count":95},{"address":{"type":"absolute","value":1698501104},"count":132},{"address":{"type":"absolute","value":1698501536},"count":85},{"address":{"type":"absolute","value":1698501776},"count":137},{"address":{"type":"absolute","value":1698501808},"count":137},{"address":{"type":"absolute","value":1698501824},"count":10},{"address":{"type":"absolute","value":1698501840},"count":11},{"address":{"type":"absolute","value":1698501856},"count":77},{"address":{"type":"absolute","value":1698502768},"count":134},{"address":{"type":"absolute","value":1698503872},"count":40},{"address":{"type":"absolute","value":1698503952},"count":102},{"address":{"type":"absolute","value":1698504240},"count":92},{"address":{"type":"absolute","value":1698504656},"count":73},{"address":{"type":"absolute","value":1698504896},"count":88},{"address":{"type":"absolute","value":1698505216},"count":88},{"address":{"type":"absolute","value":1698505536},"count":92},{"address":{"type":"absolute","value":1698505552},"count":92},{"address":{"type":"absolute","value":1698505568},"count":22},{"address":{"type":"absolute","value":1698505616},"count":109},{"address":{"type":"absolute","value":1698505648},"count":37},{"address":{"type":"absolute","value":1698505696},"count":74},{"address":{"type":"absolute","value":1698505984},"count":127},{"address":{"type":"absolute","value":1698506528},"count":187},{"address":{"type":"absolute","value":1698508336},"count":203},{"address":{"type":"absolute","value":1698509296},"count":134},{"address":{"type":"absolute","value":1698510512},"count":22},{"address":{"type":"absolute","value":1698510560},"count":21},{"address":{"type":"absolute","value":1698510608},"count":79},{"address":{"type":"absolute","value":1698510864},"count":55},{"address":{"type":"absolute","value":1698511040},"count":173},{"address":{"type":"absolute","value":1698512416},"count":36},{"address":{"type":"absolute","value":1698512480},"count":130},{"address":{"type":"absolute","value":1698513520},"count":128},{"address":{"type":"absolute","value":1698514576},"count":148},{"address":{"type":"absolute","value":1698516064},"count":37},{"address":{"type":"absolute","value":1698516192},"count":33},{"address":{"type":"absolute","value":1698516400},"count":24},{"address":{"type":"absolute","value":1698516448},"count":25},{"address":{"type":"absolute","value":1698516496},"count":51},{"address":{"type":"absolute","value":1698516624},"count":37},{"address":{"type":"absolute","value":1698516752},"count":38},{"address":{"type":"absolute","value":1698516880},"count":38},{"address":{"type":"absolute","value":1698517008},"count":32},{"address":{"type":"absolute","value":1698517136},"count":33},{"address":{"type":"absolute","value":1698517248},"count":36},{"address":{"type":"absolute","value":1698517504},"count":29},{"address":{"type":"absolute","value":1698517568},"count":95},{"address":{"type":"absolute","value":1698518256},"count":39},{"address":{"type":"absolute","value":1698518416},"count":45},{"address":{"type":"absolute","value":1698518512},"count":62},{"address":{"type":"absolute","value":1698518688},"count":31},{"address":{"type":"absolute","value":1698519808},"count":94},{"address":{"type":"absolute","value":1698519936},"count":38},{"address":{"type":"absolute","value":1698520032},"count":76},{"address":{"type":"absolute","value":1698520384},"count":25},{"address":{"type":"absolute","value":1698520432},"count":61},{"address":{"type":"absolute","value":1698520624},"count":65},{"address":{"type":"absolute","value":1698521824},"count":41},{"address":{"type":"absolute","value":1698522000},"count":43},{"address":{"type":"absolute","value":1698522176},"count":66},{"address":{"type":"absolute","value":1698522624},"count":113},{"address":{"type":"absolute","value":1698523424},"count":55},{"address":{"type":"absolute","value":1698523520},"count":29},{"address":{"type":"absolute","value":1698523536},"count":131},{"address":{"type":"absolute","value":1698526688},"count":57},{"address":{"type":"absolute","value":1698526960},"count":43},{"address":{"type":"absolute","value":1698527072},"count":68},{"address":{"type":"absolute","value":1698527328},"count":78},{"address":{"type":"absolute","value":1698527648},"count":90},{"address":{"type":"absolute","value":1698527968},"count":61},{"address":{"type":"absolute","value":1698528288},"count":47},{"address":{"type":"absolute","value":1698528432},"count":24},{"address":{"type":"absolute","value":1698528480},"count":50},{"address":{"type":"absolute","value":1698528640},"count":47},{"address":{"type":"absolute","value":1698528992},"count":28},{"address":{"type":"absolute","value":1698529072},"count":32},{"address":{"type":"absolute","value":1698529136},"count":78},{"address":{"type":"absolute","value":1698529152},"count":69},{"address":{"type":"absolute","value":1698529632},"count":57},{"address":{"type":"absolute","value":1698529792},"count":68},{"address":{"type":"absolute","value":1698529808},"count":57},{"address":{"type":"absolute","value":1698529824},"count":27},{"address":{"type":"absolute","value":1698529904},"count":67},{"address":{"type":"absolute","value":1698529936},"count":49},{"address":{"type":"absolute","value":1698529968},"count":47},{"address":{"type":"absolute","value":1698530160},"count":24},{"address":{"type":"absolute","value":1698530224},"count":63},{"address":{"type":"absolute","value":1698530672},"count":141},{"address":{"type":"absolute","value":1698531920},"count":86},{"address":{"type":"absolute","value":1698532496},"count":42},{"address":{"type":"absolute","value":1698532592},"count":30},{"address":{"type":"absolute","value":1698532656},"count":46},{"address":{"type":"absolute","value":1698532768},"count":42},{"address":{"type":"absolute","value":1698532864},"count":18},{"address":{"type":"absolute","value":1698532880},"count":23},{"address":{"type":"absolute","value":1698532944},"count":54},{"address":{"type":"absolute","value":1698533152},"count":76},{"address":{"type":"absolute","value":1698533568},"count":43},{"address":{"type":"absolute","value":1698533664},"count":36},{"address":{"type":"absolute","value":1698533760},"count":29},{"address":{"type":"absolute","value":1698533840},"count":80},{"address":{"type":"absolute","value":1698534208},"count":43},{"address":{"type":"absolute","value":1698534304},"count":16},{"address":{"type":"absolute","value":1698534352},"count":18},{"address":{"type":"absolute","value":1698534400},"count":18},{"address":{"type":"absolute","value":1698534448},"count":27},{"address":{"type":"absolute","value":1698534496},"count":18},{"address":{"type":"absolute","value":1698534544},"count":9},{"address":{"type":"absolute","value":1698534560},"count":33},{"address":{"type":"absolute","value":1698534640},"count":33},{"address":{"type":"absolute","value":1698534720},"count":23},{"address":{"type":"absolute","value":1698534768},"count":55},{"address":{"type":"absolute","value":1698534944},"count":39},{"address":{"type":"absolute","value":1698535056},"count":37},{"address":{"type":"absolute","value":1698535088},"count":44},{"address":{"type":"absolute","value":1698535232},"count":28},{"address":{"type":"absolute","value":1698535344},"count":16},{"address":{"type":"absolute","value":1698535376},"count":16},{"address":{"type":"absolute","value":1698535408},"count":140},{"address":{"type":"absolute","value":1698535424},"count":20},{"address":{"type":"absolute","value":1698535456},"count":45},{"address":{"type":"absolute","value":1698535552},"count":28},{"address":{"type":"absolute","value":1698535600},"count":28},{"address":{"type":"absolute","value":1698535648},"count":57},{"address":{"type":"absolute","value":1698535664},"count":49},{"address":{"type":"absolute","value":1698535696},"count":141},{"address":{"type":"absolute","value":1698535712},"count":33},{"address":{"type":"absolute","value":1698535744},"count":78},{"address":{"type":"absolute","value":1698535760},"count":20},{"address":{"type":"absolute","value":1698535792},"count":54},{"address":{"type":"absolute","value":1698535920},"count":28},{"address":{"type":"absolute","value":1698535968},"count":224},{"address":{"type":"absolute","value":1698535984},"count":227},{"address":{"type":"absolute","value":1698536032},"count":282},{"address":{"type":"absolute","value":1698536048},"count":33},{"address":{"type":"absolute","value":1698536080},"count":322},{"address":{"type":"absolute","value":1698536096},"count":78},{"address":{"type":"absolute","value":1698536112},"count":20},{"address":{"type":"absolute","value":1698536144},"count":50},{"address":{"type":"absolute","value":1698536272},"count":77},{"address":{"type":"absolute","value":1698536496},"count":53},{"address":{"type":"absolute","value":1698536640},"count":31},{"address":{"type":"absolute","value":1698536688},"count":140},{"address":{"type":"absolute","value":1698536832},"count":83},{"address":{"type":"absolute","value":1698537072},"count":92},{"address":{"type":"absolute","value":1698537408},"count":39},{"address":{"type":"absolute","value":1698537456},"count":53},{"address":{"type":"absolute","value":1698537632},"count":82},{"address":{"type":"absolute","value":1698538048},"count":66},{"address":{"type":"absolute","value":1698538256},"count":103},{"address":{"type":"absolute","value":1698538704},"count":42},{"address":{"type":"absolute","value":1698538832},"count":100},{"address":{"type":"absolute","value":1698539648},"count":109},{"address":{"type":"absolute","value":1698540464},"count":46},{"address":{"type":"absolute","value":1698541552},"count":43},{"address":{"type":"absolute","value":1698541872},"count":187},{"address":{"type":"absolute","value":1698543744},"count":88},{"address":{"type":"absolute","value":1698544480},"count":122},{"address":{"type":"absolute","value":1698545520},"count":52},{"address":{"type":"absolute","value":1698545968},"count":30},{"address":{"type":"absolute","value":1698546096},"count":39},{"address":{"type":"absolute","value":1698546224},"count":249},{"address":{"type":"absolute","value":1698551952},"count":7},{"address":{"type":"absolute","value":1698551968},"count":7},{"address":{"type":"absolute","value":1698551984},"count":32},{"address":{"type":"absolute","value":1698552080},"count":29},{"address":{"type":"absolute","value":1698552176},"count":47},{"address":{"type":"absolute","value":1698552304},"count":71},{"address":{"type":"absolute","value":1698552640},"count":44},{"address":{"type":"absolute","value":1698552736},"count":48},{"address":{"type":"absolute","value":1698552848},"count":68},{"address":{"type":"absolute","value":1698553440},"count":37},{"address":{"type":"absolute","value":1698553520},"count":60},{"address":{"type":"absolute","value":1698554240},"count":163},{"address":{"type":"absolute","value":1698555792},"count":196},{"address":{"type":"absolute","value":1698557600},"count":60},{"address":{"type":"absolute","value":1698558112},"count":68},{"address":{"type":"absolute","value":1698558576},"count":48},{"address":{"type":"absolute","value":1698558800},"count":61},{"address":{"type":"absolute","value":1698558944},"count":55},{"address":{"type":"absolute","value":1698559344},"count":107},{"address":{"type":"absolute","value":1698561040},"count":55},{"address":{"type":"absolute","value":1698561168},"count":49},{"address":{"type":"absolute","value":1698561408},"count":109},{"address":{"type":"absolute","value":1698562080},"count":70},{"address":{"type":"absolute","value":1698562512},"count":100},{"address":{"type":"absolute","value":1698563024},"count":88},{"address":{"type":"absolute","value":1698563392},"count":106},{"address":{"type":"absolute","value":1698564176},"count":96},{"address":{"type":"absolute","value":1698564960},"count":143},{"address":{"type":"absolute","value":1698565856},"count":127},{"address":{"type":"absolute","value":1698566736},"count":12},{"address":{"type":"absolute","value":1698566768},"count":95},{"address":{"type":"absolute","value":1698567296},"count":41},{"address":{"type":"absolute","value":1698567488},"count":15},{"address":{"type":"absolute","value":1698567520},"count":15},{"address":{"type":"absolute","value":1698567552},"count":96},{"address":{"type":"absolute","value":1698567872},"count":102},{"address":{"type":"absolute","value":1698568224},"count":83},{"address":{"type":"absolute","value":1698568512},"count":212},{"address":{"type":"absolute","value":1698571360},"count":184},{"address":{"type":"absolute","value":1698571376},"count":41},{"address":{"type":"absolute","value":1698572296},"count":18},{"address":{"type":"absolute","value":1698572336},"count":17},{"address":{"type":"absolute","value":1698572368},"count":46},{"address":{"type":"absolute","value":1698573344},"count":42},{"address":{"type":"absolute","value":1698576792},"count":44},{"address":{"type":"absolute","value":1698580304},"count":30},{"address":{"type":"absolute","value":1698580416},"count":25},{"address":{"type":"absolute","value":1698580504},"count":29},{"address":{"type":"absolute","value":1698580624},"count":15},{"address":{"type":"absolute","value":1698580656},"count":15},{"address":{"type":"absolute","value":1698580688},"count":69},{"address":{"type":"absolute","value":1698582416},"count":112},{"address":{"type":"absolute","value":1698583136},"count":110},{"address":{"type":"absolute","value":1698583152},"count":96},{"address":{"type":"absolute","value":1698583472},"count":102},{"address":{"type":"absolute","value":1698583824},"count":83},{"address":{"type":"absolute","value":1698584112},"count":75},{"address":{"type":"absolute","value":1698585168},"count":75},{"address":{"type":"absolute","value":1698586232},"count":71},{"address":{"type":"absolute","value":1698590136},"count":71},{"address":{"type":"absolute","value":1698594056},"count":45},{"address":{"type":"absolute","value":1698594152},"count":25},{"address":{"type":"absolute","value":1698594232},"count":26},{"address":{"type":"absolute","value":1698594336},"count":53},{"address":{"type":"absolute","value":1698594512},"count":18},{"address":{"type":"absolute","value":1698594544},"count":15},{"address":{"type":"absolute","value":1698594576},"count":19},{"address":{"type":"absolute","value":1698594624},"count":182},{"address":{"type":"absolute","value":1698595696},"count":139},{"address":{"type":"absolute","value":1698598064},"count":17},{"address":{"type":"absolute","value":1698598112},"count":16},{"address":{"type":"absolute","value":1698598144},"count":81},{"address":{"type":"absolute","value":1698598432},"count":162},{"address":{"type":"absolute","value":1698599616},"count":61},{"address":{"type":"absolute","value":1698599792},"count":41},{"address":{"type":"absolute","value":1698599952},"count":42},{"address":{"type":"absolute","value":1698599984},"count":39},{"address":{"type":"absolute","value":1698600080},"count":84},{"address":{"type":"absolute","value":1698600352},"count":83},{"address":{"type":"absolute","value":1698600624},"count":29},{"address":{"type":"absolute","value":1698600720},"count":63},{"address":{"type":"absolute","value":1698600928},"count":170},{"address":{"type":"absolute","value":1698606696},"count":162},{"address":{"type":"absolute","value":1698622528},"count":33},{"address":{"type":"absolute","value":1698622672},"count":49},{"address":{"type":"absolute","value":1698622824},"count":32},{"address":{"type":"absolute","value":1698627072},"count":46},{"address":{"type":"absolute","value":1698627168},"count":49},{"address":{"type":"absolute","value":1698627184},"count":49},{"address":{"type":"absolute","value":1698627200},"count":16},{"address":{"type":"absolute","value":1698627248},"count":21},{"address":{"type":"absolute","value":1698627312},"count":20},{"address":{"type":"absolute","value":1698627360},"count":213},{"address":{"type":"absolute","value":1698628080},"count":29},{"address":{"type":"absolute","value":1698628160},"count":82},{"address":{"type":"absolute","value":1698628896},"count":223},{"address":{"type":"absolute","value":1698630528},"count":222},{"address":{"type":"absolute","value":1698630544},"count":46},{"address":{"type":"absolute","value":1698630784},"count":46},{"address":{"type":"absolute","value":1698631024},"count":46},{"address":{"type":"absolute","value":1698631264},"count":52},{"address":{"type":"absolute","value":1698631536},"count":77},{"address":{"type":"absolute","value":1698631904},"count":149},{"address":{"type":"absolute","value":1698632160},"count":76},{"address":{"type":"absolute","value":1698632464},"count":118},{"address":{"type":"absolute","value":1698632720},"count":118},{"address":{"type":"absolute","value":1698633024},"count":107},{"address":{"type":"absolute","value":1698633696},"count":93},{"address":{"type":"absolute","value":1698634064},"count":171},{"address":{"type":"absolute","value":1698638088},"count":171},{"address":{"type":"absolute","value":1698642096},"count":21},{"address":{"type":"absolute","value":1698642128},"count":78},{"address":{"type":"absolute","value":1698642496},"count":82},{"address":{"type":"absolute","value":1698642784},"count":57},{"address":{"type":"absolute","value":1698643008},"count":69},{"address":{"type":"absolute","value":1698643312},"count":74},{"address":{"type":"absolute","value":1698643616},"count":78},{"address":{"type":"absolute","value":1698643968},"count":61},{"address":{"type":"absolute","value":1698644208},"count":70},{"address":{"type":"absolute","value":1698644512},"count":71},{"address":{"type":"absolute","value":1698644832},"count":87},{"address":{"type":"absolute","value":1698645456},"count":85},{"address":{"type":"absolute","value":1698645824},"count":23},{"address":{"type":"absolute","value":1698645891},"count":25},{"address":{"type":"absolute","value":1698645968},"count":47},{"address":{"type":"absolute","value":1698646304},"count":59},{"address":{"type":"absolute","value":1698646688},"count":90},{"address":{"type":"absolute","value":1698646946},"count":18},{"address":{"type":"absolute","value":1698647044},"count":32},{"address":{"type":"absolute","value":1698647077},"count":24},{"address":{"type":"absolute","value":1698647242},"count":19},{"address":{"type":"absolute","value":1698647287},"count":44},{"address":{"type":"absolute","value":1698648336},"count":21},{"address":{"type":"absolute","value":1698648368},"count":96},{"address":{"type":"absolute","value":1698650400},"count":96},{"address":{"type":"absolute","value":1698650768},"count":54},{"address":{"type":"absolute","value":1698650976},"count":67},{"address":{"type":"absolute","value":1698651248},"count":71},{"address":{"type":"absolute","value":1698651568},"count":135},{"address":{"type":"absolute","value":1698652656},"count":59},{"address":{"type":"absolute","value":1698652880},"count":106},{"address":{"type":"absolute","value":1698653760},"count":107},{"address":{"type":"absolute","value":1698654656},"count":112},{"address":{"type":"absolute","value":1698657376},"count":118},{"address":{"type":"absolute","value":1698658656},"count":37},{"address":{"type":"absolute","value":1698658768},"count":41},{"address":{"type":"absolute","value":1698658880},"count":15},{"address":{"type":"absolute","value":1698658912},"count":15},{"address":{"type":"absolute","value":1698658944},"count":70},{"address":{"type":"absolute","value":1698659472},"count":312},{"address":{"type":"absolute","value":1698663648},"count":115},{"address":{"type":"absolute","value":1698664208},"count":128},{"address":{"type":"absolute","value":1698664832},"count":105},{"address":{"type":"absolute","value":1698665328},"count":187},{"address":{"type":"absolute","value":1698666288},"count":180},{"address":{"type":"absolute","value":1698667136},"count":124},{"address":{"type":"absolute","value":1698669272},"count":124},{"address":{"type":"absolute","value":1698671408},"count":107},{"address":{"type":"absolute","value":1698678216},"count":107},{"address":{"type":"absolute","value":1698685088},"count":58},{"address":{"type":"absolute","value":1698685312},"count":44},{"address":{"type":"absolute","value":1698685504},"count":41},{"address":{"type":"absolute","value":1698685688},"count":38},{"address":{"type":"absolute","value":1698685952},"count":40},{"address":{"type":"absolute","value":1698686232},"count":38},{"address":{"type":"absolute","value":1698686432},"count":50},{"address":{"type":"absolute","value":1698694232},"count":51},{"address":{"type":"absolute","value":1698702032},"count":39},{"address":{"type":"absolute","value":1698702624},"count":25},{"address":{"type":"absolute","value":1698702808},"count":32},{"address":{"type":"absolute","value":1698702992},"count":72},{"address":{"type":"absolute","value":1698703568},"count":70},{"address":{"type":"absolute","value":1698704144},"count":63},{"address":{"type":"absolute","value":1698704576},"count":305},{"address":{"type":"absolute","value":1698709200},"count":303},{"address":{"type":"absolute","value":1698713936},"count":15},{"address":{"type":"absolute","value":1698713968},"count":15},{"address":{"type":"absolute","value":1698714000},"count":602},{"address":{"type":"absolute","value":1698719792},"count":77},{"address":{"type":"absolute","value":1698720320},"count":32},{"address":{"type":"absolute","value":1698720448},"count":130},{"address":{"type":"absolute","value":1698721072},"count":130},{"address":{"type":"absolute","value":1698721712},"count":119},{"address":{"type":"absolute","value":1698722288},"count":198},{"address":{"type":"absolute","value":1698723440},"count":187},{"address":{"type":"absolute","value":1698724464},"count":311},{"address":{"type":"absolute","value":1698745032},"count":311},{"address":{"type":"absolute","value":1698765496},"count":74},{"address":{"type":"absolute","value":1698766232},"count":35},{"address":{"type":"absolute","value":1698766480},"count":35},{"address":{"type":"absolute","value":1698766728},"count":52},{"address":{"type":"absolute","value":1698767272},"count":52},{"address":{"type":"absolute","value":1698767816},"count":46},{"address":{"type":"absolute","value":1698768192},"count":308},{"address":{"type":"absolute","value":1698784880},"count":308},{"address":{"type":"absolute","value":1698801576},"count":63},{"address":{"type":"absolute","value":1698802232},"count":55},{"address":{"type":"absolute","value":1698802424},"count":55},{"address":{"type":"absolute","value":1698802608},"count":82},{"address":{"type":"absolute","value":1698803168},"count":82},{"address":{"type":"absolute","value":1698803728},"count":68},{"address":{"type":"absolute","value":1698804144},"count":69},{"address":{"type":"absolute","value":1698804480},"count":15},{"address":{"type":"absolute","value":1698804512},"count":68},{"address":{"type":"absolute","value":1698804816},"count":15},{"address":{"type":"absolute","value":1698804848},"count":98},{"address":{"type":"absolute","value":1698805664},"count":96},{"address":{"type":"absolute","value":1698805680},"count":100},{"address":{"type":"absolute","value":1698808128},"count":15},{"address":{"type":"absolute","value":1698808160},"count":100},{"address":{"type":"absolute","value":1698810608},"count":15},{"address":{"type":"absolute","value":1698810640},"count":88},{"address":{"type":"absolute","value":1698811216},"count":224},{"address":{"type":"absolute","value":1698813712},"count":283},{"address":{"type":"absolute","value":1698817280},"count":30},{"address":{"type":"absolute","value":1698817344},"count":141},{"address":{"type":"absolute","value":1698819552},"count":141},{"address":{"type":"absolute","value":1698821760},"count":173},{"address":{"type":"absolute","value":1698824720},"count":173},{"address":{"type":"absolute","value":1698827680},"count":302},{"address":{"type":"absolute","value":1698827760},"count":55},{"address":{"type":"absolute","value":1698827952},"count":55},{"address":{"type":"absolute","value":1698828144},"count":17},{"address":{"type":"absolute","value":1698828192},"count":17},{"address":{"type":"absolute","value":1698828240},"count":74},{"address":{"type":"absolute","value":1698828912},"count":95},{"address":{"type":"absolute","value":1698829312},"count":153},{"address":{"type":"absolute","value":1698829936},"count":158},{"address":{"type":"absolute","value":1698830592},"count":147},{"address":{"type":"absolute","value":1698831184},"count":224},{"address":{"type":"absolute","value":1698832432},"count":205},{"address":{"type":"absolute","value":1698833800},"count":154},{"address":{"type":"absolute","value":1698858208},"count":148},{"address":{"type":"absolute","value":1698882600},"count":81},{"address":{"type":"absolute","value":1698883416},"count":90},{"address":{"type":"absolute","value":1698883824},"count":73},{"address":{"type":"absolute","value":1698884192},"count":115},{"address":{"type":"absolute","value":1698885112},"count":125},{"address":{"type":"absolute","value":1698886056},"count":87},{"address":{"type":"absolute","value":1698892616},"count":196},{"address":{"type":"absolute","value":1698892936},"count":165},{"address":{"type":"absolute","value":1698921616},"count":157},{"address":{"type":"absolute","value":1698950280},"count":101},{"address":{"type":"absolute","value":1698951696},"count":123},{"address":{"type":"absolute","value":1698952160},"count":107},{"address":{"type":"absolute","value":1698952576},"count":152},{"address":{"type":"absolute","value":1698953856},"count":164},{"address":{"type":"absolute","value":1698955192},"count":126},{"address":{"type":"absolute","value":1698956128},"count":27},{"address":{"type":"absolute","value":1698956256},"count":77},{"address":{"type":"absolute","value":1698956832},"count":15},{"address":{"type":"absolute","value":1698956864},"count":108},{"address":{"type":"absolute","value":1698957264},"count":33},{"address":{"type":"absolute","value":1698957344},"count":106},{"address":{"type":"absolute","value":1698957856},"count":17},{"address":{"type":"absolute","value":1698957888},"count":41},{"address":{"type":"absolute","value":1698958000},"count":64},{"address":{"type":"absolute","value":1698958240},"count":47},{"address":{"type":"absolute","value":1698958400},"count":49},{"address":{"type":"absolute","value":1698958576},"count":117},{"address":{"type":"absolute","value":1698959280},"count":20},{"address":{"type":"absolute","value":1698959328},"count":20},{"address":{"type":"absolute","value":1698959376},"count":73},{"address":{"type":"absolute","value":1698959904},"count":52},{"address":{"type":"absolute","value":1698960128},"count":60},{"address":{"type":"absolute","value":1698960304},"count":21},{"address":{"type":"absolute","value":1698960344},"count":299},{"address":{"type":"absolute","value":1698964368},"count":31},{"address":{"type":"absolute","value":1698964432},"count":40},{"address":{"type":"absolute","value":1698965072},"count":36},{"address":{"type":"absolute","value":1698965152},"count":41},{"address":{"type":"absolute","value":1698965792},"count":36},{"address":{"type":"absolute","value":1698965856},"count":55},{"address":{"type":"absolute","value":1698965984},"count":37},{"address":{"type":"absolute","value":1698966080},"count":59},{"address":{"type":"absolute","value":1698966320},"count":116},{"address":{"type":"absolute","value":1698967040},"count":115},{"address":{"type":"absolute","value":1698967072},"count":74},{"address":{"type":"absolute","value":1698967808},"count":87},{"address":{"type":"absolute","value":1698968192},"count":214},{"address":{"type":"absolute","value":1698971584},"count":208},{"address":{"type":"absolute","value":1698979904},"count":150},{"address":{"type":"absolute","value":1698980856},"count":129},{"address":{"type":"absolute","value":1698981432},"count":233},{"address":{"type":"absolute","value":1698984576},"count":184},{"address":{"type":"absolute","value":1698988256},"count":89},{"address":{"type":"absolute","value":1698989376},"count":25},{"address":{"type":"absolute","value":1698989488},"count":71},{"address":{"type":"absolute","value":1698989792},"count":87},{"address":{"type":"absolute","value":1698990304},"count":89},{"address":{"type":"absolute","value":1698991040},"count":66},{"address":{"type":"absolute","value":1698991600},"count":76},{"address":{"type":"absolute","value":1698992320},"count":50},{"address":{"type":"absolute","value":1698992576},"count":318},{"address":{"type":"absolute","value":1698998080},"count":7},{"address":{"type":"absolute","value":1698998096},"count":27},{"address":{"type":"absolute","value":1698998224},"count":72},{"address":{"type":"absolute","value":1698998704},"count":88},{"address":{"type":"absolute","value":1698999664},"count":25},{"address":{"type":"absolute","value":1698999776},"count":79},{"address":{"type":"absolute","value":1699000112},"count":20},{"address":{"type":"absolute","value":1699000208},"count":286},{"address":{"type":"absolute","value":1699000320},"count":75},{"address":{"type":"absolute","value":1699001248},"count":78},{"address":{"type":"absolute","value":1699001888},"count":301},{"address":{"type":"absolute","value":1699002512},"count":46},{"address":{"type":"absolute","value":1699002736},"count":126},{"address":{"type":"absolute","value":1699003744},"count":123},{"address":{"type":"absolute","value":1699004880},"count":39},{"address":{"type":"absolute","value":1699005232},"count":32},{"address":{"type":"absolute","value":1699005360},"count":36},{"address":{"type":"absolute","value":1699005488},"count":285},{"address":{"type":"absolute","value":1699011472},"count":25},{"address":{"type":"absolute","value":1699011584},"count":64},{"address":{"type":"absolute","value":1699011856},"count":84},{"address":{"type":"absolute","value":1699012656},"count":49},{"address":{"type":"absolute","value":1699012880},"count":76},{"address":{"type":"absolute","value":1699013552},"count":44},{"address":{"type":"absolute","value":1699013664},"count":67},{"address":{"type":"absolute","value":1699014208},"count":56},{"address":{"type":"absolute","value":1699014448},"count":79},{"address":{"type":"absolute","value":1699015168},"count":48},{"address":{"type":"absolute","value":1699015424},"count":116},{"address":{"type":"absolute","value":1699016448},"count":74},{"address":{"type":"absolute","value":1699016976},"count":182},{"address":{"type":"absolute","value":1699019424},"count":7},{"address":{"type":"absolute","value":1699019440},"count":32},{"address":{"type":"absolute","value":1699019664},"count":191},{"address":{"type":"absolute","value":1699021664},"count":155},{"address":{"type":"absolute","value":1699023184},"count":179},{"address":{"type":"absolute","value":1699025232},"count":181},{"address":{"type":"absolute","value":1699027680},"count":181},{"address":{"type":"absolute","value":1699029984},"count":90},{"address":{"type":"absolute","value":1699031104},"count":24},{"address":{"type":"absolute","value":1699031152},"count":178},{"address":{"type":"absolute","value":1699032416},"count":180},{"address":{"type":"absolute","value":1699034832},"count":229},{"address":{"type":"absolute","value":1699037456},"count":5},{"address":{"type":"absolute","value":1699037472},"count":82},{"address":{"type":"absolute","value":1699038096},"count":28},{"address":{"type":"absolute","value":1699038176},"count":35},{"address":{"type":"absolute","value":1699038272},"count":64},{"address":{"type":"absolute","value":1699038944},"count":25},{"address":{"type":"absolute","value":1699039024},"count":52},{"address":{"type":"absolute","value":1699039232},"count":106},{"address":{"type":"absolute","value":1699039920},"count":88},{"address":{"type":"absolute","value":1699040544},"count":128},{"address":{"type":"absolute","value":1699041504},"count":98},{"address":{"type":"absolute","value":1699043008},"count":89},{"address":{"type":"absolute","value":1699043568},"count":84},{"address":{"type":"absolute","value":1699044464},"count":45},{"address":{"type":"absolute","value":1699044608},"count":81},{"address":{"type":"absolute","value":1699045216},"count":39},{"address":{"type":"absolute","value":1699045360},"count":36},{"address":{"type":"absolute","value":1699045472},"count":56},{"address":{"type":"absolute","value":1699045696},"count":24},{"address":{"type":"absolute","value":1699045744},"count":19},{"address":{"type":"absolute","value":1699045792},"count":59},{"address":{"type":"absolute","value":1699046160},"count":19},{"address":{"type":"absolute","value":1699046272},"count":71},{"address":{"type":"absolute","value":1699046768},"count":58},{"address":{"type":"absolute","value":1699047088},"count":76},{"address":{"type":"absolute","value":1699047488},"count":129},{"address":{"type":"absolute","value":1699048640},"count":78},{"address":{"type":"absolute","value":1699049408},"count":46},{"address":{"type":"absolute","value":1699049568},"count":28},{"address":{"type":"absolute","value":1699049648},"count":44},{"address":{"type":"absolute","value":1699050320},"count":46},{"address":{"type":"absolute","value":1699050576},"count":84},{"address":{"type":"absolute","value":1699050944},"count":48},{"address":{"type":"absolute","value":1699050976},"count":113},{"address":{"type":"absolute","value":1699051824},"count":108},{"address":{"type":"absolute","value":1699052240},"count":119},{"address":{"type":"absolute","value":1699052912},"count":177},{"address":{"type":"absolute","value":1699054608},"count":167},{"address":{"type":"absolute","value":1699055984},"count":105},{"address":{"type":"absolute","value":1699056848},"count":86},{"address":{"type":"absolute","value":1699057792},"count":15},{"address":{"type":"absolute","value":1699057808},"count":14},{"address":{"type":"absolute","value":1699057824},"count":11},{"address":{"type":"absolute","value":1699057840},"count":34},{"address":{"type":"absolute","value":1699057904},"count":33},{"address":{"type":"absolute","value":1699057968},"count":33},{"address":{"type":"absolute","value":1699058032},"count":173},{"address":{"type":"absolute","value":1699058496},"count":170},{"address":{"type":"absolute","value":1699058960},"count":148},{"address":{"type":"absolute","value":1699060064},"count":150},{"address":{"type":"absolute","value":1699061328},"count":10},{"address":{"type":"absolute","value":1699061344},"count":49},{"address":{"type":"absolute","value":1699061552},"count":17},{"address":{"type":"absolute","value":1699061584},"count":221},{"address":{"type":"absolute","value":1699063456},"count":101},{"address":{"type":"absolute","value":1699063920},"count":54},{"address":{"type":"absolute","value":1699064080},"count":67},{"address":{"type":"absolute","value":1699065232},"count":126},{"address":{"type":"absolute","value":1699065760},"count":27},{"address":{"type":"absolute","value":1699065856},"count":45},{"address":{"type":"absolute","value":1699065936},"count":63},{"address":{"type":"absolute","value":1699066096},"count":143},{"address":{"type":"absolute","value":1699067104},"count":30},{"address":{"type":"absolute","value":1699067200},"count":101},{"address":{"type":"absolute","value":1699068688},"count":23},{"address":{"type":"absolute","value":1699068736},"count":6},{"address":{"type":"absolute","value":1699068752},"count":89},{"address":{"type":"absolute","value":1699069072},"count":30},{"address":{"type":"absolute","value":1699069168},"count":241},{"address":{"type":"absolute","value":1699071328},"count":23},{"address":{"type":"absolute","value":1699071376},"count":6},{"address":{"type":"absolute","value":1699071392},"count":89},{"address":{"type":"absolute","value":1699071712},"count":34},{"address":{"type":"absolute","value":1699071824},"count":126},{"address":{"type":"absolute","value":1699077520},"count":23},{"address":{"type":"absolute","value":1699077568},"count":6},{"address":{"type":"absolute","value":1699077584},"count":92},{"address":{"type":"absolute","value":1699077920},"count":54},{"address":{"type":"absolute","value":1699078096},"count":6},{"address":{"type":"absolute","value":1699078112},"count":74},{"address":{"type":"absolute","value":1699078336},"count":73},{"address":{"type":"absolute","value":1699078560},"count":56},{"address":{"type":"absolute","value":1699079040},"count":346},{"address":{"type":"absolute","value":1699090400},"count":111},{"address":{"type":"absolute","value":1699090800},"count":28},{"address":{"type":"absolute","value":1699090896},"count":46},{"address":{"type":"absolute","value":1699091024},"count":120},{"address":{"type":"absolute","value":1699094768},"count":125},{"address":{"type":"absolute","value":1699098368},"count":183},{"address":{"type":"absolute","value":1699103424},"count":6},{"address":{"type":"absolute","value":1699103440},"count":90},{"address":{"type":"absolute","value":1699103728},"count":89},{"address":{"type":"absolute","value":1699104016},"count":61},{"address":{"type":"absolute","value":1699104512},"count":329},{"address":{"type":"absolute","value":1699111328},"count":120},{"address":{"type":"absolute","value":1699111760},"count":34},{"address":{"type":"absolute","value":1699111872},"count":50},{"address":{"type":"absolute","value":1699112016},"count":322},{"address":{"type":"absolute","value":1699126160},"count":363},{"address":{"type":"absolute","value":1699140352},"count":152},{"address":{"type":"absolute","value":1699144704},"count":34},{"address":{"type":"absolute","value":1699144784},"count":157},{"address":{"type":"absolute","value":1699147264},"count":56},{"address":{"type":"absolute","value":1699148608},"count":170},{"address":{"type":"absolute","value":1699151120},"count":56},{"address":{"type":"absolute","value":1699152464},"count":170},{"address":{"type":"absolute","value":1699154816},"count":56},{"address":{"type":"absolute","value":1699156160},"count":6},{"address":{"type":"absolute","value":1699156176},"count":67},{"address":{"type":"absolute","value":1699156672},"count":72},{"address":{"type":"absolute","value":1699156960},"count":75},{"address":{"type":"absolute","value":1699157456},"count":87},{"address":{"type":"absolute","value":1699158304},"count":79},{"address":{"type":"absolute","value":1699158720},"count":80},{"address":{"type":"absolute","value":1699158736},"count":80},{"address":{"type":"absolute","value":1699158752},"count":80},{"address":{"type":"absolute","value":1699158768},"count":80},{"address":{"type":"absolute","value":1699158784},"count":80},{"address":{"type":"absolute","value":1699158800},"count":80},{"address":{"type":"absolute","value":1699158816},"count":36},{"address":{"type":"absolute","value":1699158935},"count":107},{"address":{"type":"absolute","value":1699162629},"count":6},{"address":{"type":"absolute","value":1699162633},"count":103},{"address":{"type":"absolute","value":1699163060},"count":39},{"address":{"type":"absolute","value":1699163179},"count":38},{"address":{"type":"absolute","value":1699163312},"count":6},{"address":{"type":"absolute","value":1699163328},"count":55},{"address":{"type":"absolute","value":1699163504},"count":122},{"address":{"type":"absolute","value":1699164256},"count":130},{"address":{"type":"absolute","value":1699164368},"count":99},{"address":{"type":"absolute","value":1699164960},"count":61},{"address":{"type":"absolute","value":1699165136},"count":94},{"address":{"type":"absolute","value":1699167664},"count":167},{"address":{"type":"absolute","value":1699173744},"count":175},{"address":{"type":"absolute","value":1699178336},"count":106},{"address":{"type":"absolute","value":1699178864},"count":97},{"address":{"type":"absolute","value":1699179392},"count":48},{"address":{"type":"absolute","value":1699179712},"count":34},{"address":{"type":"absolute","value":1699179776},"count":33},{"address":{"type":"absolute","value":1699179840},"count":67},{"address":{"type":"absolute","value":1699180048},"count":67},{"address":{"type":"absolute","value":1699180256},"count":67},{"address":{"type":"absolute","value":1699180464},"count":65},{"address":{"type":"absolute","value":1699180672},"count":80},{"address":{"type":"absolute","value":1699180912},"count":80},{"address":{"type":"absolute","value":1699181152},"count":78},{"address":{"type":"absolute","value":1699181392},"count":80},{"address":{"type":"absolute","value":1699181632},"count":167},{"address":{"type":"absolute","value":1699183344},"count":183},{"address":{"type":"absolute","value":1699185280},"count":36},{"address":{"type":"absolute","value":1699187504},"count":6},{"address":{"type":"absolute","value":1699187520},"count":70},{"address":{"type":"absolute","value":1699187712},"count":57},{"address":{"type":"absolute","value":1699187984},"count":178},{"address":{"type":"absolute","value":1699193120},"count":101},{"address":{"type":"absolute","value":1699193488},"count":72},{"address":{"type":"absolute","value":1699193504},"count":39},{"address":{"type":"absolute","value":1699193584},"count":28},{"address":{"type":"absolute","value":1699193680},"count":46},{"address":{"type":"absolute","value":1699193888},"count":114},{"address":{"type":"absolute","value":1699198016},"count":115},{"address":{"type":"absolute","value":1699202000},"count":116},{"address":{"type":"absolute","value":1699206160},"count":177},{"address":{"type":"absolute","value":1699207280},"count":163},{"address":{"type":"absolute","value":1699208304},"count":161},{"address":{"type":"absolute","value":1699208432},"count":7},{"address":{"type":"absolute","value":1699208448},"count":18},{"address":{"type":"absolute","value":1699208496},"count":74},{"address":{"type":"absolute","value":1699208848},"count":23},{"address":{"type":"absolute","value":1699208928},"count":45},{"address":{"type":"absolute","value":1699209024},"count":27},{"address":{"type":"absolute","value":1699209104},"count":34},{"address":{"type":"absolute","value":1699209184},"count":25},{"address":{"type":"absolute","value":1699209232},"count":18},{"address":{"type":"absolute","value":1699209264},"count":18},{"address":{"type":"absolute","value":1699209296},"count":18},{"address":{"type":"absolute","value":1699209344},"count":19},{"address":{"type":"absolute","value":1699209392},"count":19},{"address":{"type":"absolute","value":1699209440},"count":22},{"address":{"type":"absolute","value":1699209536},"count":16},{"address":{"type":"absolute","value":1699209584},"count":16},{"address":{"type":"absolute","value":1699209632},"count":161},{"address":{"type":"absolute","value":1699209648},"count":35},{"address":{"type":"absolute","value":1699209712},"count":88},{"address":{"type":"absolute","value":1699209776},"count":34},{"address":{"type":"absolute","value":1699209840},"count":101},{"address":{"type":"absolute","value":1699210384},"count":92},{"address":{"type":"absolute","value":1699210432},"count":23},{"address":{"type":"absolute","value":1699210496},"count":22},{"address":{"type":"absolute","value":1699210576},"count":23},{"address":{"type":"absolute","value":1699210640},"count":36},{"address":{"type":"absolute","value":1699210832},"count":88},{"address":{"type":"absolute","value":1699211312},"count":54},{"address":{"type":"absolute","value":1699211584},"count":88},{"address":{"type":"absolute","value":1699212384},"count":52},{"address":{"type":"absolute","value":1699212656},"count":36},{"address":{"type":"absolute","value":1699212704},"count":25},{"address":{"type":"absolute","value":1699212736},"count":41},{"address":{"type":"absolute","value":1699212896},"count":9},{"address":{"type":"absolute","value":1699212912},"count":9},{"address":{"type":"absolute","value":1699212928},"count":6},{"address":{"type":"absolute","value":1699212944},"count":7},{"address":{"type":"absolute","value":1699212992},"count":52},{"address":{"type":"absolute","value":1699213184},"count":118},{"address":{"type":"absolute","value":1699214352},"count":28},{"address":{"type":"absolute","value":1699214416},"count":88},{"address":{"type":"absolute","value":1699214864},"count":33},{"address":{"type":"absolute","value":1699214928},"count":41},{"address":{"type":"absolute","value":1699215056},"count":45},{"address":{"type":"absolute","value":1699215168},"count":28},{"address":{"type":"absolute","value":1699215248},"count":87},{"address":{"type":"absolute","value":1699215296},"count":67},{"address":{"type":"absolute","value":1699215312},"count":29},{"address":{"type":"absolute","value":1699215360},"count":32},{"address":{"type":"absolute","value":1699215424},"count":136},{"address":{"type":"absolute","value":1699215904},"count":48},{"address":{"type":"absolute","value":1699216080},"count":38},{"address":{"type":"absolute","value":1699216240},"count":53},{"address":{"type":"absolute","value":1699216464},"count":53},{"address":{"type":"absolute","value":1699216560},"count":93},{"address":{"type":"absolute","value":1699217632},"count":58},{"address":{"type":"absolute","value":1699217840},"count":57},{"address":{"type":"absolute","value":1699218464},"count":76},{"address":{"type":"absolute","value":1699218976},"count":60},{"address":{"type":"absolute","value":1699219296},"count":91},{"address":{"type":"absolute","value":1699219744},"count":75},{"address":{"type":"absolute","value":1699220112},"count":71},{"address":{"type":"absolute","value":1699220480},"count":56},{"address":{"type":"absolute","value":1699220640},"count":63},{"address":{"type":"absolute","value":1699220784},"count":35},{"address":{"type":"absolute","value":1699220928},"count":158},{"address":{"type":"absolute","value":1699223280},"count":161},{"address":{"type":"absolute","value":1699223488},"count":33},{"address":{"type":"absolute","value":1699223600},"count":35},{"address":{"type":"absolute","value":1699223648},"count":52},{"address":{"type":"absolute","value":1699223888},"count":6},{"address":{"type":"absolute","value":1699223904},"count":6},{"address":{"type":"absolute","value":1699223920},"count":7},{"address":{"type":"absolute","value":1699223936},"count":41},{"address":{"type":"absolute","value":1699224128},"count":58},{"address":{"type":"absolute","value":1699224576},"count":105},{"address":{"type":"absolute","value":1699225200},"count":27},{"address":{"type":"absolute","value":1699225296},"count":90},{"address":{"type":"absolute","value":1699225904},"count":23},{"address":{"type":"absolute","value":1699225968},"count":23},{"address":{"type":"absolute","value":1699226032},"count":38},{"address":{"type":"absolute","value":1699226224},"count":13},{"address":{"type":"absolute","value":1699226256},"count":25},{"address":{"type":"absolute","value":1699226288},"count":5},{"address":{"type":"absolute","value":1699226304},"count":6},{"address":{"type":"absolute","value":1699226320},"count":6},{"address":{"type":"absolute","value":1699226336},"count":52},{"address":{"type":"absolute","value":1699226544},"count":17},{"address":{"type":"absolute","value":1699226598},"count":23},{"address":{"type":"absolute","value":1699226648},"count":50},{"address":{"type":"absolute","value":1699226814},"count":16},{"address":{"type":"absolute","value":1699226833},"count":22},{"address":{"type":"absolute","value":1699226871},"count":42},{"address":{"type":"absolute","value":1699227064},"count":61},{"address":{"type":"absolute","value":1699227374},"count":59},{"address":{"type":"absolute","value":1699227629},"count":33},{"address":{"type":"absolute","value":1699227746},"count":35},{"address":{"type":"absolute","value":1699227920},"count":51},{"address":{"type":"absolute","value":1699228093},"count":44},{"address":{"type":"absolute","value":1699228196},"count":36},{"address":{"type":"absolute","value":1699228369},"count":37},{"address":{"type":"absolute","value":1699228542},"count":70},{"address":{"type":"absolute","value":1699228808},"count":34},{"address":{"type":"absolute","value":1699228894},"count":71},{"address":{"type":"absolute","value":1699229418},"count":35},{"address":{"type":"absolute","value":1699229489},"count":33},{"address":{"type":"absolute","value":1699229560},"count":22},{"address":{"type":"absolute","value":1699229592},"count":65},{"address":{"type":"absolute","value":1699230105},"count":32},{"address":{"type":"absolute","value":1699230234},"count":23},{"address":{"type":"absolute","value":1699230304},"count":17},{"address":{"type":"absolute","value":1699230544},"count":41},{"address":{"type":"absolute","value":1699230656},"count":7},{"address":{"type":"absolute","value":1699230672},"count":34},{"address":{"type":"absolute","value":1699230752},"count":24},{"address":{"type":"absolute","value":1699230864},"count":62},{"address":{"type":"absolute","value":1699231232},"count":24},{"address":{"type":"absolute","value":1699231280},"count":244},{"address":{"type":"absolute","value":1699233856},"count":115},{"address":{"type":"absolute","value":1699234544},"count":71},{"address":{"type":"absolute","value":1699234992},"count":79},{"address":{"type":"absolute","value":1699235904},"count":71},{"address":{"type":"absolute","value":1699236352},"count":45},{"address":{"type":"absolute","value":1699236432},"count":94},{"address":{"type":"absolute","value":1699236480},"count":94},{"address":{"type":"absolute","value":1699236528},"count":34},{"address":{"type":"absolute","value":1699236608},"count":38},{"address":{"type":"absolute","value":1699236640},"count":40},{"address":{"type":"absolute","value":1699236736},"count":25},{"address":{"type":"absolute","value":1699236768},"count":71},{"address":{"type":"absolute","value":1699236912},"count":75},{"address":{"type":"absolute","value":1699237120},"count":61},{"address":{"type":"absolute","value":1699237216},"count":51},{"address":{"type":"absolute","value":1699237280},"count":54},{"address":{"type":"absolute","value":1699237376},"count":88},{"address":{"type":"absolute","value":1699238000},"count":44},{"address":{"type":"absolute","value":1699238128},"count":91},{"address":{"type":"absolute","value":1699238480},"count":71},{"address":{"type":"absolute","value":1699238912},"count":41},{"address":{"type":"absolute","value":1699239008},"count":71},{"address":{"type":"absolute","value":1699239024},"count":71},{"address":{"type":"absolute","value":1699239040},"count":31},{"address":{"type":"absolute","value":1699239136},"count":113},{"address":{"type":"absolute","value":1699240240},"count":49},{"address":{"type":"absolute","value":1699240432},"count":42},{"address":{"type":"absolute","value":1699240496},"count":113},{"address":{"type":"absolute","value":1699240512},"count":94},{"address":{"type":"absolute","value":1699240720},"count":64},{"address":{"type":"absolute","value":1699240928},"count":21},{"address":{"type":"absolute","value":1699240976},"count":152},{"address":{"type":"absolute","value":1699241168},"count":29},{"address":{"type":"absolute","value":1699241328},"count":41},{"address":{"type":"absolute","value":1699241456},"count":52},{"address":{"type":"absolute","value":1699241552},"count":45},{"address":{"type":"absolute","value":1699241680},"count":56},{"address":{"type":"absolute","value":1699241776},"count":30},{"address":{"type":"absolute","value":1699241856},"count":51},{"address":{"type":"absolute","value":1699243120},"count":44},{"address":{"type":"absolute","value":1699243280},"count":60},{"address":{"type":"absolute","value":1699243568},"count":86},{"address":{"type":"absolute","value":1699244400},"count":115},{"address":{"type":"absolute","value":1699244448},"count":94},{"address":{"type":"absolute","value":1699244464},"count":43},{"address":{"type":"absolute","value":1699244640},"count":39},{"address":{"type":"absolute","value":1699244768},"count":110},{"address":{"type":"absolute","value":1699245152},"count":109},{"address":{"type":"absolute","value":1699245200},"count":45},{"address":{"type":"absolute","value":1699245392},"count":268},{"address":{"type":"absolute","value":1699250096},"count":110},{"address":{"type":"absolute","value":1699250896},"count":37},{"address":{"type":"absolute","value":1699250976},"count":77},{"address":{"type":"absolute","value":1699251264},"count":102},{"address":{"type":"absolute","value":1699251776},"count":78},{"address":{"type":"absolute","value":1699251888},"count":21},{"address":{"type":"absolute","value":1699251936},"count":22},{"address":{"type":"absolute","value":1699251968},"count":20},{"address":{"type":"absolute","value":1699252016},"count":138},{"address":{"type":"absolute","value":1699252544},"count":139},{"address":{"type":"absolute","value":1699254128},"count":126},{"address":{"type":"absolute","value":1699255472},"count":42},{"address":{"type":"absolute","value":1699255696},"count":53},{"address":{"type":"absolute","value":1699256016},"count":36},{"address":{"type":"absolute","value":1699256096},"count":104},{"address":{"type":"absolute","value":1699257232},"count":46},{"address":{"type":"absolute","value":1699257344},"count":58},{"address":{"type":"absolute","value":1699257616},"count":107},{"address":{"type":"absolute","value":1699258800},"count":54},{"address":{"type":"absolute","value":1699259056},"count":77},{"address":{"type":"absolute","value":1699259952},"count":76},{"address":{"type":"absolute","value":1699260192},"count":30},{"address":{"type":"absolute","value":1699260304},"count":80},{"address":{"type":"absolute","value":1699260720},"count":82},{"address":{"type":"absolute","value":1699261600},"count":8},{"address":{"type":"absolute","value":1699261616},"count":18},{"address":{"type":"absolute","value":1699261648},"count":31},{"address":{"type":"absolute","value":1699261712},"count":33},{"address":{"type":"absolute","value":1699261792},"count":48},{"address":{"type":"absolute","value":1699261904},"count":37},{"address":{"type":"absolute","value":1699261984},"count":49},{"address":{"type":"absolute","value":1699262080},"count":23},{"address":{"type":"absolute","value":1699262128},"count":48},{"address":{"type":"absolute","value":1699262336},"count":39},{"address":{"type":"absolute","value":1699262384},"count":40},{"address":{"type":"absolute","value":1699262496},"count":29},{"address":{"type":"absolute","value":1699262512},"count":47},{"address":{"type":"absolute","value":1699262688},"count":61},{"address":{"type":"absolute","value":1699262816},"count":29},{"address":{"type":"absolute","value":1699262864},"count":46},{"address":{"type":"absolute","value":1699263008},"count":68},{"address":{"type":"absolute","value":1699263264},"count":21},{"address":{"type":"absolute","value":1699263296},"count":39},{"address":{"type":"absolute","value":1699263328},"count":70},{"address":{"type":"absolute","value":1699263520},"count":68},{"address":{"type":"absolute","value":1699263648},"count":52},{"address":{"type":"absolute","value":1699263824},"count":46},{"address":{"type":"absolute","value":1699263904},"count":49},{"address":{"type":"absolute","value":1699264048},"count":43},{"address":{"type":"absolute","value":1699264176},"count":29},{"address":{"type":"absolute","value":1699264224},"count":32},{"address":{"type":"absolute","value":1699264288},"count":19},{"address":{"type":"absolute","value":1699264336},"count":53},{"address":{"type":"absolute","value":1699264512},"count":40},{"address":{"type":"absolute","value":1699264528},"count":44},{"address":{"type":"absolute","value":1699264544},"count":40},{"address":{"type":"absolute","value":1699264560},"count":62},{"address":{"type":"absolute","value":1699264736},"count":90},{"address":{"type":"absolute","value":1699264992},"count":42},{"address":{"type":"absolute","value":1699265088},"count":65},{"address":{"type":"absolute","value":1699265264},"count":27},{"address":{"type":"absolute","value":1699265328},"count":54},{"address":{"type":"absolute","value":1699265392},"count":98},{"address":{"type":"absolute","value":1699265776},"count":63},{"address":{"type":"absolute","value":1699265856},"count":110},{"address":{"type":"absolute","value":1699265888},"count":112},{"address":{"type":"absolute","value":1699265936},"count":112},{"address":{"type":"absolute","value":1699265984},"count":26},{"address":{"type":"absolute","value":1699266048},"count":128},{"address":{"type":"absolute","value":1699266816},"count":56},{"address":{"type":"absolute","value":1699266896},"count":57},{"address":{"type":"absolute","value":1699266976},"count":23},{"address":{"type":"absolute","value":1699267024},"count":24},{"address":{"type":"absolute","value":1699267072},"count":18},{"address":{"type":"absolute","value":1699267120},"count":28},{"address":{"type":"absolute","value":1699267184},"count":29},{"address":{"type":"absolute","value":1699267216},"count":29},{"address":{"type":"absolute","value":1699267248},"count":58},{"address":{"type":"absolute","value":1699267408},"count":20},{"address":{"type":"absolute","value":1699267472},"count":56},{"address":{"type":"absolute","value":1699267568},"count":33},{"address":{"type":"absolute","value":1699267632},"count":31},{"address":{"type":"absolute","value":1699267808},"count":31},{"address":{"type":"absolute","value":1699267984},"count":11},{"address":{"type":"absolute","value":1699268000},"count":30},{"address":{"type":"absolute","value":1699268112},"count":48},{"address":{"type":"absolute","value":1699268336},"count":29},{"address":{"type":"absolute","value":1699268384},"count":88},{"address":{"type":"absolute","value":1699268432},"count":47},{"address":{"type":"absolute","value":1699268480},"count":83},{"address":{"type":"absolute","value":1699268528},"count":42},{"address":{"type":"absolute","value":1699268576},"count":107},{"address":{"type":"absolute","value":1699268672},"count":46},{"address":{"type":"absolute","value":1699269168},"count":72},{"address":{"type":"absolute","value":1699269856},"count":143},{"address":{"type":"absolute","value":1699271296},"count":159},{"address":{"type":"absolute","value":1699272640},"count":49},{"address":{"type":"absolute","value":1699272848},"count":115},{"address":{"type":"absolute","value":1699275456},"count":55},{"address":{"type":"absolute","value":1699276464},"count":38},{"address":{"type":"absolute","value":1699276544},"count":5},{"address":{"type":"absolute","value":1699276560},"count":21},{"address":{"type":"absolute","value":1699276624},"count":22},{"address":{"type":"absolute","value":1699276719},"count":25},{"address":{"type":"absolute","value":1699276800},"count":24},{"address":{"type":"absolute","value":1699276880},"count":25},{"address":{"type":"absolute","value":1699276960},"count":32},{"address":{"type":"absolute","value":1699277072},"count":40},{"address":{"type":"absolute","value":1699277216},"count":8},{"address":{"type":"absolute","value":1699277232},"count":8},{"address":{"type":"absolute","value":1699277240},"count":8},{"address":{"type":"absolute","value":1699277248},"count":8},{"address":{"type":"absolute","value":1699277256},"count":8},{"address":{"type":"absolute","value":1699277272},"count":8},{"address":{"type":"absolute","value":1699277280},"count":8},{"address":{"type":"absolute","value":1699277288},"count":8},{"address":{"type":"absolute","value":1699277296},"count":8},{"address":{"type":"absolute","value":1699277304},"count":8},{"address":{"type":"absolute","value":1699277312},"count":8},{"address":{"type":"absolute","value":1699277328},"count":8},{"address":{"type":"absolute","value":1699277336},"count":8},{"address":{"type":"absolute","value":1699277344},"count":8},{"address":{"type":"absolute","value":1699277352},"count":8},{"address":{"type":"absolute","value":1699277360},"count":25},{"address":{"type":"absolute","value":1699277424},"count":78},{"address":{"type":"absolute","value":1699277536},"count":78},{"address":{"type":"absolute","value":1699277568},"count":49},{"address":{"type":"absolute","value":1699277792},"count":41},{"address":{"type":"absolute","value":1699278048},"count":23},{"address":{"type":"absolute","value":1699278096},"count":42},{"address":{"type":"absolute","value":1699278224},"count":6},{"address":{"type":"absolute","value":1699278240},"count":6},{"address":{"type":"absolute","value":1699278256},"count":6},{"address":{"type":"absolute","value":1699278272},"count":110},{"address":{"type":"absolute","value":1699278784},"count":111},{"address":{"type":"absolute","value":1699279488},"count":61},{"address":{"type":"absolute","value":1699279904},"count":57},{"address":{"type":"absolute","value":1699280144},"count":74},{"address":{"type":"absolute","value":1699280640},"count":37},{"address":{"type":"absolute","value":1699280752},"count":37},{"address":{"type":"absolute","value":1699280880},"count":31},{"address":{"type":"absolute","value":1699281040},"count":44},{"address":{"type":"absolute","value":1699281264},"count":23},{"address":{"type":"absolute","value":1699281296},"count":25},{"address":{"type":"absolute","value":1699281328},"count":43},{"address":{"type":"absolute","value":1699281408},"count":57},{"address":{"type":"absolute","value":1699281552},"count":53},{"address":{"type":"absolute","value":1699281680},"count":32},{"address":{"type":"absolute","value":1699281744},"count":52},{"address":{"type":"absolute","value":1699281856},"count":28},{"address":{"type":"absolute","value":1699281920},"count":58},{"address":{"type":"absolute","value":1699282080},"count":59},{"address":{"type":"absolute","value":1699282256},"count":7},{"address":{"type":"absolute","value":1699282272},"count":24},{"address":{"type":"absolute","value":1699282368},"count":42},{"address":{"type":"absolute","value":1699282592},"count":61},{"address":{"type":"absolute","value":1699282752},"count":41},{"address":{"type":"absolute","value":1699282832},"count":40},{"address":{"type":"absolute","value":1699282912},"count":76},{"address":{"type":"absolute","value":1699283232},"count":9},{"address":{"type":"absolute","value":1699283248},"count":8},{"address":{"type":"absolute","value":1699283256},"count":8},{"address":{"type":"absolute","value":1699283264},"count":8},{"address":{"type":"absolute","value":1699283272},"count":8},{"address":{"type":"absolute","value":1699283280},"count":8},{"address":{"type":"absolute","value":1699283288},"count":8},{"address":{"type":"absolute","value":1699283296},"count":8},{"address":{"type":"absolute","value":1699283304},"count":8},{"address":{"type":"absolute","value":1699283312},"count":8},{"address":{"type":"absolute","value":1699283320},"count":8},{"address":{"type":"absolute","value":1699283328},"count":8},{"address":{"type":"absolute","value":1699283336},"count":8},{"address":{"type":"absolute","value":1699283344},"count":8},{"address":{"type":"absolute","value":1699283352},"count":8},{"address":{"type":"absolute","value":1699283360},"count":8},{"address":{"type":"absolute","value":1699283368},"count":8},{"address":{"type":"absolute","value":1699283376},"count":8},{"address":{"type":"absolute","value":1699283384},"count":8},{"address":{"type":"absolute","value":1699283392},"count":8},{"address":{"type":"absolute","value":1699283400},"count":8},{"address":{"type":"absolute","value":1699283408},"count":8},{"address":{"type":"absolute","value":1699283416},"count":8},{"address":{"type":"absolute","value":1699283424},"count":8},{"address":{"type":"absolute","value":1699283432},"count":8},{"address":{"type":"absolute","value":1699283440},"count":8},{"address":{"type":"absolute","value":1699283448},"count":8},{"address":{"type":"absolute","value":1699283480},"count":8},{"address":{"type":"absolute","value":1699283488},"count":8},{"address":{"type":"absolute","value":1699283496},"count":8},{"address":{"type":"absolute","value":1699283504},"count":8},{"address":{"type":"absolute","value":1699283512},"count":8},{"address":{"type":"absolute","value":1699283528},"count":8},{"address":{"type":"absolute","value":1699283536},"count":8},{"address":{"type":"absolute","value":1699283544},"count":8},{"address":{"type":"absolute","value":1699283552},"count":8},{"address":{"type":"absolute","value":1699283560},"count":8},{"address":{"type":"absolute","value":1699283568},"count":8},{"address":{"type":"absolute","value":1699283576},"count":8},{"address":{"type":"absolute","value":1699283584},"count":8},{"address":{"type":"absolute","value":1699283592},"count":8},{"address":{"type":"absolute","value":1699283600},"count":8},{"address":{"type":"absolute","value":1699283608},"count":7},{"address":{"type":"absolute","value":1699283632},"count":8},{"address":{"type":"absolute","value":1699283640},"count":8},{"address":{"type":"absolute","value":1699283656},"count":7},{"address":{"type":"absolute","value":1699283672},"count":8},{"address":{"type":"absolute","value":1699283680},"count":21},{"address":{"type":"absolute","value":1699283728},"count":62},{"address":{"type":"absolute","value":1699283936},"count":41},{"address":{"type":"absolute","value":1699284048},"count":27},{"address":{"type":"absolute","value":1699284080},"count":8},{"address":{"type":"absolute","value":1699284088},"count":8},{"address":{"type":"absolute","value":1699284096},"count":8},{"address":{"type":"absolute","value":1699284592},"count":33},{"address":{"type":"absolute","value":1699284704},"count":62}]},"library_functions":[{"address":{"type":"absolute","value":1698465232},"name":"?CreateIndirect@CDialog@@UEAAHPEBUDLGTEMPLATE@@PEAVCWnd@@PEAX@Z"},{"address":{"type":"absolute","value":1698535904},"name":"?"},{"address":{"type":"absolute","value":1698536240},"name":"?"},{"address":{"type":"absolute","value":1698536256},"name":"?"},{"address":{"type":"absolute","value":1699057776},"name":"?"},{"address":{"type":"absolute","value":1699065824},"name":"?GetThreadProxyFactoryManager@ResourceManager@details@Concurrency@@QEAAPEAVThreadProxyFactoryManager@23@XZ"},{"address":{"type":"absolute","value":1699065840},"name":"?GetLocation@VirtualProcessor@details@Concurrency@@QEBAAEBVlocation@3@XZ"},{"address":{"type":"absolute","value":1699173728},"name":"?"},{"address":{"type":"absolute","value":1699178320},"name":"?"},{"address":{"type":"absolute","value":1699212960},"name":"__asan_should_detect_stack_use_after_return"},{"address":{"type":"absolute","value":1699282336},"name":"?"},{"address":{"type":"absolute","value":1699282352},"name":"?"}],"apicall_count":1407,"import_count":284}},"rules":{"calculate modulo 256 via x86 assembly":{"meta":{"name":"calculate modulo 256 via x86 assembly","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"instruction"},"attack":[],"mbc":[{"parts":["Data","Modulo"],"objective":"Data","behavior":"Modulo","method":"","id":"C0058"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4049A9"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: calculate modulo 256 via x86 assembly\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: instruction\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Data::Modulo [C0058]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9\n  features:\n    #  and ecx, 800000FFh\n    #  and ecx, 0FFh\n    - and:\n      - mnemonic: and\n      - or:\n        - number: 0x800000FF\n        - number: 0xFF\n","matches":[[{"type":"absolute","value":1698567325},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1698567325}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483903}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[{"type":"absolute","value":1698567325}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delay execution\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@ramen0x3f\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\n    examples:\n      - al-khaser_x86.exe_:0x449770\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.Sleep\n          - api: kernel32.SleepEx\n          - api: kernel32.WaitForSingleObject\n          - api: kernel32.SignalObjectAndWait\n          - api: kernel32.WaitForSingleObjectEx\n          - api: kernel32.WaitForMultipleObjects\n          - api: kernel32.WaitForMultipleObjectsEx\n          - api: kernel32.RegisterWaitForSingleObject\n          - api: WaitOnAddress\n          - api: user32.MsgWaitForMultipleObjects\n          - api: user32.MsgWaitForMultipleObjectsEx\n          - api: NtDelayExecution\n          - api: KeWaitForSingleObject\n          - api: KeDelayExecutionThread\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - or:\n          - api: sleep\n          - api: usleep\n","matches":[[{"type":"absolute","value":1698435154},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":1698435159}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698435289},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":1698435294}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open file\n    authors:\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Create File [C0016]\n    examples:\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\n  features:\n    - or:\n      - api: CreateFile\n      - api: CreateFileEx\n      - api: IoCreateFile\n      - api: IoCreateFileEx\n      - api: ZwOpenFile\n      - api: ZwCreateFile\n      - api: NtOpenFile\n      - api: NtCreateFile\n      - api: LZCreateFile\n      - api: LZOpenFile\n      - api: fopen\n      - api: fopen64\n      - api: fdopen\n      - api: freopen\n      - api: open\n      - api: openat\n","matches":[[{"type":"absolute","value":1698528533},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698528593}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698467136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698467150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698474628},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698474642}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698474800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698474814}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698477120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698477149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528533},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698528593}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528533},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698528593}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699208496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1699208532}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231793},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":1699231855}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using XOR":{"meta":{"name":"encode data using XOR","namespace":"data-manipulation/encoding/xor","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Standard Algorithm","id":"E1027.m02"},{"parts":["Data","Encode Data","XOR"],"objective":"Data","behavior":"Encode Data","method":"XOR","id":"C0026.002"}],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403D7E"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encode data using XOR\n    namespace: data-manipulation/encoding/xor\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires characteristic, Not features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]\n      - Data::Encode Data::XOR [C0026.002]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403D7E\n  features:\n    - and:\n      - characteristic: tight loop\n      - characteristic: nzxor\n      - not:\n        - description: filter for potential false positives\n        - or:\n          - or:\n            - description: unsigned bitwise negation operation (~i)\n            - number: 0xFFFFFFFF = bitwise negation for unsigned 32 bits\n            - number: 0xFFFFFFFFFFFFFFFF = bitwise negation for unsigned 64 bits\n          - or:\n            - description: signed bitwise negation operation (~i)\n            - number: 0x0FFFFFFF = bitwise negation for signed 32 bits\n            - number: 0x0FFFFFFFFFFFFFFF = bitwise negation for signed 64 bits\n          - or:\n            - description: Magic constants used in the implementation of strings functions.\n            # such as `strlen` and `strcat` in the Windows standard library:\n            # (((i - 0x81010101) ^ ~i) & 0x81010100)\n            ## 32 bits\n            - number: 0x7EFEFEFF = optimized string constant for 32 bits\n            - number: 0x81010101 = -0x81010101 = 0x7EFEFEFF\n            - number: 0x81010100 = 0x81010100 = ~0x7EFEFEFF\n            ## 64 bits\n            - number: 0x7EFEFEFEFEFEFEFF = optimized string constant for 64 bits\n            - number: 0x8101010101010101 = -0x8101010101010101 = 0x7EFEFEFEFEFEFEFF\n            - number: 0x8101010101010100 = 0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF\n","matches":[[{"type":"absolute","value":1698475264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698475296},{"type":"absolute","value":1698475321},{"type":"absolute","value":1698475290},{"type":"absolute","value":1698475323}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698476722},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698476729},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487644}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487680},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487797},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487797}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487801}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488032},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488032}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698488044}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489884}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490018},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490018}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490030}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490090}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490161},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490161}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490173}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490273},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490273}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490281}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490336},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490435},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490435}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490443}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490484},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490484}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490494}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491268}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491477},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491477}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491482}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491586},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491586}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491590}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491637}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491764},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491768}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491808},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491808}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491813}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492117}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492448},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492448}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492452}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698508720},{"type":"absolute","value":1698508723}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486705},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698486705}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698486724}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486930},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698486930}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698486934}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487644}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487680},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487797},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487797}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698487801}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488032},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488032}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698488044}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488912},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698488916}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489056},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489060}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489108},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489108}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489113}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489186},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489186}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489190}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489297},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489297}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489301}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489346},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489346}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489351}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489443},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489443}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489447}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489488},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489493}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698489884}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490018},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490018}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490030}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490090}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490161},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490161}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490173}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490273},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490273}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490281}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490336},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490435},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490435}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490443}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490484},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490484}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698490494}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491268}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491477},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491477}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491482}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491586},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491586}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491590}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491637}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491764},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491768}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491808},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491808}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698491813}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492117}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492448},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492448}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492452}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698493872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698493872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698493878},{"type":"absolute","value":1698493895}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492117}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492448},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492448}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492452}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698492501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496092}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496128},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496128}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496141}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496192},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496200}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496243},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496243}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496256}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698500020},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698500020}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698500081},{"type":"absolute","value":1698500075}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698500160},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698500160}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698500163},{"type":"absolute","value":1698500173}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698502896},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698502896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698502976},{"type":"absolute","value":1698503106},{"type":"absolute","value":1698502981},{"type":"absolute","value":1698503110},{"type":"absolute","value":1698503369},{"type":"absolute","value":1698503373},{"type":"absolute","value":1698503183},{"type":"absolute","value":1698503377},{"type":"absolute","value":1698503187},{"type":"absolute","value":1698503316},{"type":"absolute","value":1698503381},{"type":"absolute","value":1698502998},{"type":"absolute","value":1698503191},{"type":"absolute","value":1698503320},{"type":"absolute","value":1698503385},{"type":"absolute","value":1698503003},{"type":"absolute","value":1698503200},{"type":"absolute","value":1698502945},{"type":"absolute","value":1698503204},{"type":"absolute","value":1698503141},{"type":"absolute","value":1698503146},{"type":"absolute","value":1698503338},{"type":"absolute","value":1698503020},{"type":"absolute","value":1698503150},{"type":"absolute","value":1698503025},{"type":"absolute","value":1698503092},{"type":"absolute","value":1698503222},{"type":"absolute","value":1698503097},{"type":"absolute","value":1698503226},{"type":"absolute","value":1698503102}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505664},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698505664},{"type":"absolute","value":1698505674}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505824},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505824}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698505856},{"type":"absolute","value":1698505859}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698507069},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698507069}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698507074}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698508720},{"type":"absolute","value":1698508723}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698512080},{"type":"absolute","value":1698512129},{"type":"absolute","value":1698512145},{"type":"absolute","value":1698512084},{"type":"absolute","value":1698512200}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512800},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512800}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698512804}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698512853}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513156}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513200},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513200}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513205}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513856},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513856}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513860}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513906},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513906}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698513911}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698514212},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698514212}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698514217}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698514272},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698514272}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698514277}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698515312},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698515312}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698515316}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698515731},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698515731}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698515735}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496880},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496888}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496928},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698496941}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497136},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497148}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698497196}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698508720},{"type":"absolute","value":1698508723}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698554624},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698554624}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698554627}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698563761},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698563761}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698563766}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564464},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698564464}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698564473}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564544},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698564544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698564549}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698565632},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698565632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698565637}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698566402},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698566402}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698566420}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567776},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698567817}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568416},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568416}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698568457}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568819},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568819}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698568890}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568819},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568819}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698568890}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583376},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698583417}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698584016},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698584016}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698584057}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627520},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627520}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698627841},{"type":"absolute","value":1698627937},{"type":"absolute","value":1698627747},{"type":"absolute","value":1698627813},{"type":"absolute","value":1698627725},{"type":"absolute","value":1698627981},{"type":"absolute","value":1698627631},{"type":"absolute","value":1698627697},{"type":"absolute","value":1698627965},{"type":"absolute","value":1698627863},{"type":"absolute","value":1698627609},{"type":"absolute","value":1698627581}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631648},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698631675},{"type":"absolute","value":1698631695}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631984},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631984}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698632010},{"type":"absolute","value":1698632028}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644352},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698644368}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632544},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698632544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698632563},{"type":"absolute","value":1698632582}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643164}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643456},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643461}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633138},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633138}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698633184},{"type":"absolute","value":1698633202},{"type":"absolute","value":1698633234},{"type":"absolute","value":1698633237},{"type":"absolute","value":1698633288},{"type":"absolute","value":1698633227},{"type":"absolute","value":1698633276},{"type":"absolute","value":1698633247}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633473},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633473}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698633600},{"type":"absolute","value":1698633588},{"type":"absolute","value":1698633557},{"type":"absolute","value":1698633525},{"type":"absolute","value":1698633543},{"type":"absolute","value":1698633621},{"type":"absolute","value":1698633561},{"type":"absolute","value":1698633628}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633792},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633792}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698633842},{"type":"absolute","value":1698633906},{"type":"absolute","value":1698633878},{"type":"absolute","value":1698633862},{"type":"absolute","value":1698633882},{"type":"absolute","value":1698633919}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643164}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643456},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643461}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644352},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698644368}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644656},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644656}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698644672}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645024},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645024}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698645048},{"type":"absolute","value":1698645056},{"type":"absolute","value":1698645052},{"type":"absolute","value":1698645068}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698645384},{"type":"absolute","value":1698645404},{"type":"absolute","value":1698645388},{"type":"absolute","value":1698645400}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645616},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645616}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698645640},{"type":"absolute","value":1698645644},{"type":"absolute","value":1698645656}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698720848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698720848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698720896},{"type":"absolute","value":1698720878}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698722098},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698722098}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698722146},{"type":"absolute","value":1698722127}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698829728},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698829728}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698829787},{"type":"absolute","value":1698829765}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698830992},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698830992}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698831048},{"type":"absolute","value":1698831029}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698958816},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698958816}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698958821}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698959173},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698959173}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698959178}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698960840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698960840}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698961280},{"type":"absolute","value":1698961929},{"type":"absolute","value":1698961162},{"type":"absolute","value":1698961291},{"type":"absolute","value":1698960909},{"type":"absolute","value":1698961551},{"type":"absolute","value":1698961681},{"type":"absolute","value":1698961044},{"type":"absolute","value":1698961172},{"type":"absolute","value":1698961814},{"type":"absolute","value":1698960919},{"type":"absolute","value":1698961561},{"type":"absolute","value":1698961434},{"type":"absolute","value":1698961690},{"type":"absolute","value":1698961053},{"type":"absolute","value":1698961825},{"type":"absolute","value":1698961954},{"type":"absolute","value":1698961315},{"type":"absolute","value":1698961444},{"type":"absolute","value":1698961658},{"type":"absolute","value":1698961964},{"type":"absolute","value":1698961325},{"type":"absolute","value":1698960943},{"type":"absolute","value":1698961584},{"type":"absolute","value":1698961076},{"type":"absolute","value":1698961848},{"type":"absolute","value":1698960953},{"type":"absolute","value":1698961594},{"type":"absolute","value":1698961468},{"type":"absolute","value":1698961213},{"type":"absolute","value":1698961086},{"type":"absolute","value":1698961731},{"type":"absolute","value":1698961859},{"type":"absolute","value":1698961349},{"type":"absolute","value":1698961478},{"type":"absolute","value":1698961223},{"type":"absolute","value":1698961989},{"type":"absolute","value":1698961741},{"type":"absolute","value":1698961359},{"type":"absolute","value":1698960976},{"type":"absolute","value":1698961617},{"type":"absolute","value":1698961999},{"type":"absolute","value":1698960986},{"type":"absolute","value":1698961626},{"type":"absolute","value":1698961883},{"type":"absolute","value":1698961246},{"type":"absolute","value":1698961764},{"type":"absolute","value":1698961894},{"type":"absolute","value":1698961383},{"type":"absolute","value":1698962023},{"type":"absolute","value":1698961129},{"type":"absolute","value":1698961257},{"type":"absolute","value":1698960877},{"type":"absolute","value":1698961773},{"type":"absolute","value":1698961648},{"type":"absolute","value":1698961393},{"type":"absolute","value":1698961010},{"type":"absolute","value":1698961139},{"type":"absolute","value":1698961521},{"type":"absolute","value":1698962033},{"type":"absolute","value":1698960887},{"type":"absolute","value":1698961530},{"type":"absolute","value":1698961020},{"type":"absolute","value":1698961918}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698963474},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698963474}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698963840},{"type":"absolute","value":1698963905},{"type":"absolute","value":1698963526},{"type":"absolute","value":1698963975},{"type":"absolute","value":1698963596},{"type":"absolute","value":1698963661},{"type":"absolute","value":1698963535},{"type":"absolute","value":1698963731},{"type":"absolute","value":1698963796},{"type":"absolute","value":1698963605},{"type":"absolute","value":1698963670},{"type":"absolute","value":1698963866},{"type":"absolute","value":1698963931},{"type":"absolute","value":1698963740},{"type":"absolute","value":1698963805},{"type":"absolute","value":1698963875},{"type":"absolute","value":1698963940},{"type":"absolute","value":1698963496},{"type":"absolute","value":1698963561},{"type":"absolute","value":1698964009},{"type":"absolute","value":1698963500},{"type":"absolute","value":1698963631},{"type":"absolute","value":1698963696},{"type":"absolute","value":1698963570},{"type":"absolute","value":1698963635},{"type":"absolute","value":1698964018},{"type":"absolute","value":1698963766},{"type":"absolute","value":1698963831},{"type":"absolute","value":1698963705},{"type":"absolute","value":1698963770},{"type":"absolute","value":1698963901},{"type":"absolute","value":1698963966}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966560},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966565}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966853}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966896},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966902}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966560},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966565}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966853}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966896},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698966902}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698968773},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698968773}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698969218},{"type":"absolute","value":1698969478},{"type":"absolute","value":1698969223},{"type":"absolute","value":1698968974},{"type":"absolute","value":1698969748},{"type":"absolute","value":1698969621},{"type":"absolute","value":1698969499},{"type":"absolute","value":1698969244},{"type":"absolute","value":1698969117},{"type":"absolute","value":1698968995},{"type":"absolute","value":1698969769},{"type":"absolute","value":1698969642},{"type":"absolute","value":1698969519},{"type":"absolute","value":1698969265},{"type":"absolute","value":1698969138},{"type":"absolute","value":1698969394},{"type":"absolute","value":1698969524},{"type":"absolute","value":1698969399},{"type":"absolute","value":1698969015},{"type":"absolute","value":1698968890},{"type":"absolute","value":1698969020},{"type":"absolute","value":1698968895},{"type":"absolute","value":1698969664},{"type":"absolute","value":1698969285},{"type":"absolute","value":1698969669},{"type":"absolute","value":1698969543},{"type":"absolute","value":1698969160},{"type":"absolute","value":1698969290},{"type":"absolute","value":1698969548},{"type":"absolute","value":1698968781},{"type":"absolute","value":1698969165},{"type":"absolute","value":1698969039},{"type":"absolute","value":1698968786},{"type":"absolute","value":1698969426},{"type":"absolute","value":1698969044},{"type":"absolute","value":1698968922},{"type":"absolute","value":1698969309},{"type":"absolute","value":1698969696},{"type":"absolute","value":1698969569},{"type":"absolute","value":1698969314},{"type":"absolute","value":1698968805},{"type":"absolute","value":1698969447},{"type":"absolute","value":1698969192},{"type":"absolute","value":1698969065},{"type":"absolute","value":1698968810},{"type":"absolute","value":1698969452},{"type":"absolute","value":1698968943},{"type":"absolute","value":1698969457},{"type":"absolute","value":1698968948},{"type":"absolute","value":1698969717},{"type":"absolute","value":1698969590},{"type":"absolute","value":1698968953},{"type":"absolute","value":1698969722},{"type":"absolute","value":1698969213},{"type":"absolute","value":1698969086},{"type":"absolute","value":1698969727}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698971071},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698971071}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698971234},{"type":"absolute","value":1698971075},{"type":"absolute","value":1698971142},{"type":"absolute","value":1698971111},{"type":"absolute","value":1698971208},{"type":"absolute","value":1698971270},{"type":"absolute","value":1698971178},{"type":"absolute","value":1698971119},{"type":"absolute","value":1698971155},{"type":"absolute","value":1698971093},{"type":"absolute","value":1698971190},{"type":"absolute","value":1698971257},{"type":"absolute","value":1698971226},{"type":"absolute","value":1698971293}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698972233},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698972233}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698972676},{"type":"absolute","value":1698972427},{"type":"absolute","value":1698972560},{"type":"absolute","value":1698972818},{"type":"absolute","value":1698972946},{"type":"absolute","value":1698972951},{"type":"absolute","value":1698972447},{"type":"absolute","value":1698972452},{"type":"absolute","value":1698972581},{"type":"absolute","value":1698972839},{"type":"absolute","value":1698972328},{"type":"absolute","value":1698972586},{"type":"absolute","value":1698972972},{"type":"absolute","value":1698972333},{"type":"absolute","value":1698972591},{"type":"absolute","value":1698972465},{"type":"absolute","value":1698972470},{"type":"absolute","value":1698972859},{"type":"absolute","value":1698972864},{"type":"absolute","value":1698972993},{"type":"absolute","value":1698972354},{"type":"absolute","value":1698972612},{"type":"absolute","value":1698972740},{"type":"absolute","value":1698972998},{"type":"absolute","value":1698972745},{"type":"absolute","value":1698973003},{"type":"absolute","value":1698972877},{"type":"absolute","value":1698972241},{"type":"absolute","value":1698972882},{"type":"absolute","value":1698972246},{"type":"absolute","value":1698972375},{"type":"absolute","value":1698972633},{"type":"absolute","value":1698972380},{"type":"absolute","value":1698972766},{"type":"absolute","value":1698973024},{"type":"absolute","value":1698972385},{"type":"absolute","value":1698972259},{"type":"absolute","value":1698972264},{"type":"absolute","value":1698972653},{"type":"absolute","value":1698972658},{"type":"absolute","value":1698972787},{"type":"absolute","value":1698973045},{"type":"absolute","value":1698972406},{"type":"absolute","value":1698972534},{"type":"absolute","value":1698972792},{"type":"absolute","value":1698972539},{"type":"absolute","value":1698972797},{"type":"absolute","value":1698972671}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698974359},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698974359}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698974402},{"type":"absolute","value":1698974469},{"type":"absolute","value":1698974376},{"type":"absolute","value":1698974541},{"type":"absolute","value":1698974448},{"type":"absolute","value":1698974518},{"type":"absolute","value":1698974487},{"type":"absolute","value":1698974456},{"type":"absolute","value":1698974425},{"type":"absolute","value":1698974394},{"type":"absolute","value":1698974363},{"type":"absolute","value":1698974495}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058096},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058096}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058145},{"type":"absolute","value":1699058178},{"type":"absolute","value":1699058245},{"type":"absolute","value":1699058186},{"type":"absolute","value":1699058123},{"type":"absolute","value":1699058283},{"type":"absolute","value":1699058223},{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058129},{"type":"absolute","value":1699058194},{"type":"absolute","value":1699058287},{"type":"absolute","value":1699058229},{"type":"absolute","value":1699058295},{"type":"absolute","value":1699058137},{"type":"absolute","value":1699058237},{"type":"absolute","value":1699058175}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058337},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058337}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058337},{"type":"absolute","value":1699058379},{"type":"absolute","value":1699058395},{"type":"absolute","value":1699058375}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058414},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058414}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058433},{"type":"absolute","value":1699058423}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059072},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059096},{"type":"absolute","value":1699059092}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059472},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059583}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058560},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058560}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058596},{"type":"absolute","value":1699058660},{"type":"absolute","value":1699058758},{"type":"absolute","value":1699058683},{"type":"absolute","value":1699058715},{"type":"absolute","value":1699058570},{"type":"absolute","value":1699058668},{"type":"absolute","value":1699058638},{"type":"absolute","value":1699058606},{"type":"absolute","value":1699058608},{"type":"absolute","value":1699058640},{"type":"absolute","value":1699058703},{"type":"absolute","value":1699058742},{"type":"absolute","value":1699058750},{"type":"absolute","value":1699058619},{"type":"absolute","value":1699058686}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058801},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058801}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058808},{"type":"absolute","value":1699058844},{"type":"absolute","value":1699058852},{"type":"absolute","value":1699058836}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058877},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058877}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699058896},{"type":"absolute","value":1699058886}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060192},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060217},{"type":"absolute","value":1699060221}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060769},{"type":"absolute","value":1699060765},{"type":"absolute","value":1699060799},{"type":"absolute","value":1699060803},{"type":"absolute","value":1699060697},{"type":"absolute","value":1699060731},{"type":"absolute","value":1699060701},{"type":"absolute","value":1699060735}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059072},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059096},{"type":"absolute","value":1699059092}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699059472},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059583}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060192},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060217},{"type":"absolute","value":1699060221}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699060769},{"type":"absolute","value":1699060765},{"type":"absolute","value":1699060799},{"type":"absolute","value":1699060803},{"type":"absolute","value":1699060697},{"type":"absolute","value":1699060731},{"type":"absolute","value":1699060701},{"type":"absolute","value":1699060735}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699079344},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699079344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699086341},{"type":"absolute","value":1699086346},{"type":"absolute","value":1699088396},{"type":"absolute","value":1699086349},{"type":"absolute","value":1699080206},{"type":"absolute","value":1699088406},{"type":"absolute","value":1699080217},{"type":"absolute","value":1699082265},{"type":"absolute","value":1699084313},{"type":"absolute","value":1699084316},{"type":"absolute","value":1699084322},{"type":"absolute","value":1699082278},{"type":"absolute","value":1699080239},{"type":"absolute","value":1699088435},{"type":"absolute","value":1699086388},{"type":"absolute","value":1699080248},{"type":"absolute","value":1699082300},{"type":"absolute","value":1699086396},{"type":"absolute","value":1699080254},{"type":"absolute","value":1699088447},{"type":"absolute","value":1699084358},{"type":"absolute","value":1699082312},{"type":"absolute","value":1699088459},{"type":"absolute","value":1699084366},{"type":"absolute","value":1699082323},{"type":"absolute","value":1699086430},{"type":"absolute","value":1699080292},{"type":"absolute","value":1699088484},{"type":"absolute","value":1699084392},{"type":"absolute","value":1699086443},{"type":"absolute","value":1699086446},{"type":"absolute","value":1699084402},{"type":"absolute","value":1699082356},{"type":"absolute","value":1699080312},{"type":"absolute","value":1699084411},{"type":"absolute","value":1699088507},{"type":"absolute","value":1699082369},{"type":"absolute","value":1699088516},{"type":"absolute","value":1699082379},{"type":"absolute","value":1699080333},{"type":"absolute","value":1699080340},{"type":"absolute","value":1699086487},{"type":"absolute","value":1699086489},{"type":"absolute","value":1699088537},{"type":"absolute","value":1699082396},{"type":"absolute","value":1699084447},{"type":"absolute","value":1699080352},{"type":"absolute","value":1699088547},{"type":"absolute","value":1699080357},{"type":"absolute","value":1699082405},{"type":"absolute","value":1699084456},{"type":"absolute","value":1699088553},{"type":"absolute","value":1699080363},{"type":"absolute","value":1699082411},{"type":"absolute","value":1699084466},{"type":"absolute","value":1699086522},{"type":"absolute","value":1699086532},{"type":"absolute","value":1699088586},{"type":"absolute","value":1699080395},{"type":"absolute","value":1699082448},{"type":"absolute","value":1699086545},{"type":"absolute","value":1699080403},{"type":"absolute","value":1699084500},{"type":"absolute","value":1699088596},{"type":"absolute","value":1699084503},{"type":"absolute","value":1699082456},{"type":"absolute","value":1699084509},{"type":"absolute","value":1699086576},{"type":"absolute","value":1699088626},{"type":"absolute","value":1699082485},{"type":"absolute","value":1699086582},{"type":"absolute","value":1699080440},{"type":"absolute","value":1699088636},{"type":"absolute","value":1699082495},{"type":"absolute","value":1699080448},{"type":"absolute","value":1699084550},{"type":"absolute","value":1699088649},{"type":"absolute","value":1699080461},{"type":"absolute","value":1699082512},{"type":"absolute","value":1699084560},{"type":"absolute","value":1699086609},{"type":"absolute","value":1699086612},{"type":"absolute","value":1699080471},{"type":"absolute","value":1699080477},{"type":"absolute","value":1699088669},{"type":"absolute","value":1699086626},{"type":"absolute","value":1699082536},{"type":"absolute","value":1699088682},{"type":"absolute","value":1699084589},{"type":"absolute","value":1699088690},{"type":"absolute","value":1699082549},{"type":"absolute","value":1699084599},{"type":"absolute","value":1699084605},{"type":"absolute","value":1699082559},{"type":"absolute","value":1699086657},{"type":"absolute","value":1699088713},{"type":"absolute","value":1699086673},{"type":"absolute","value":1699080530},{"type":"absolute","value":1699088723},{"type":"absolute","value":1699082582},{"type":"absolute","value":1699084630},{"type":"absolute","value":1699088729},{"type":"absolute","value":1699086682},{"type":"absolute","value":1699082592},{"type":"absolute","value":1699080549},{"type":"absolute","value":1699082598},{"type":"absolute","value":1699084654},{"type":"absolute","value":1699080559},{"type":"absolute","value":1699086705},{"type":"absolute","value":1699084664},{"type":"absolute","value":1699088761},{"type":"absolute","value":1699080572},{"type":"absolute","value":1699086721},{"type":"absolute","value":1699082631},{"type":"absolute","value":1699086727},{"type":"absolute","value":1699088776},{"type":"absolute","value":1699082641},{"type":"absolute","value":1699084690},{"type":"absolute","value":1699084693},{"type":"absolute","value":1699080599},{"type":"absolute","value":1699080602},{"type":"absolute","value":1699084699},{"type":"absolute","value":1699086747},{"type":"absolute","value":1699080608},{"type":"absolute","value":1699088800},{"type":"absolute","value":1699086757},{"type":"absolute","value":1699082667},{"type":"absolute","value":1699088816},{"type":"absolute","value":1699082677},{"type":"absolute","value":1699088825},{"type":"absolute","value":1699082686},{"type":"absolute","value":1699086787},{"type":"absolute","value":1699088845},{"type":"absolute","value":1699080658},{"type":"absolute","value":1699086804},{"type":"absolute","value":1699082712},{"type":"absolute","value":1699084760},{"type":"absolute","value":1699088857},{"type":"absolute","value":1699084763},{"type":"absolute","value":1699086814},{"type":"absolute","value":1699088865},{"type":"absolute","value":1699080677},{"type":"absolute","value":1699082735},{"type":"absolute","value":1699084783},{"type":"absolute","value":1699080692},{"type":"absolute","value":1699088885},{"type":"absolute","value":1699086839},{"type":"absolute","value":1699082745},{"type":"absolute","value":1699084793},{"type":"absolute","value":1699080701},{"type":"absolute","value":1699084799},{"type":"absolute","value":1699088895},{"type":"absolute","value":1699088901},{"type":"absolute","value":1699086863},{"type":"absolute","value":1699082770},{"type":"absolute","value":1699080724},{"type":"absolute","value":1699086870},{"type":"absolute","value":1699082780},{"type":"absolute","value":1699080733},{"type":"absolute","value":1699084828},{"type":"absolute","value":1699080738},{"type":"absolute","value":1699082786},{"type":"absolute","value":1699088933},{"type":"absolute","value":1699084845},{"type":"absolute","value":1699084853},{"type":"absolute","value":1699088949},{"type":"absolute","value":1699086904},{"type":"absolute","value":1699086911},{"type":"absolute","value":1699082820},{"type":"absolute","value":1699080773},{"type":"absolute","value":1699086920},{"type":"absolute","value":1699084876},{"type":"absolute","value":1699088973},{"type":"absolute","value":1699082830},{"type":"absolute","value":1699084878},{"type":"absolute","value":1699084884},{"type":"absolute","value":1699088983},{"type":"absolute","value":1699080793},{"type":"absolute","value":1699088991},{"type":"absolute","value":1699080804},{"type":"absolute","value":1699082857},{"type":"absolute","value":1699080812},{"type":"absolute","value":1699086964},{"type":"absolute","value":1699082869},{"type":"absolute","value":1699089013},{"type":"absolute","value":1699082878},{"type":"absolute","value":1699086976},{"type":"absolute","value":1699089026},{"type":"absolute","value":1699084932},{"type":"absolute","value":1699086980},{"type":"absolute","value":1699080841},{"type":"absolute","value":1699089034},{"type":"absolute","value":1699080844},{"type":"absolute","value":1699084940},{"type":"absolute","value":1699080849},{"type":"absolute","value":1699086999},{"type":"absolute","value":1699082904},{"type":"absolute","value":1699087002},{"type":"absolute","value":1699089056},{"type":"absolute","value":1699089066},{"type":"absolute","value":1699084972},{"type":"absolute","value":1699082926},{"type":"absolute","value":1699087024},{"type":"absolute","value":1699089072},{"type":"absolute","value":1699084980},{"type":"absolute","value":1699082935},{"type":"absolute","value":1699084985},{"type":"absolute","value":1699080901},{"type":"absolute","value":1699085007},{"type":"absolute","value":1699082960},{"type":"absolute","value":1699087055},{"type":"absolute","value":1699089105},{"type":"absolute","value":1699087061},{"type":"absolute","value":1699080920},{"type":"absolute","value":1699082970},{"type":"absolute","value":1699089115},{"type":"absolute","value":1699082976},{"type":"absolute","value":1699080931},{"type":"absolute","value":1699085032},{"type":"absolute","value":1699080938},{"type":"absolute","value":1699085039},{"type":"absolute","value":1699087089},{"type":"absolute","value":1699087094},{"type":"absolute","value":1699089143},{"type":"absolute","value":1699087099},{"type":"absolute","value":1699089149},{"type":"absolute","value":1699083009},{"type":"absolute","value":1699085060},{"type":"absolute","value":1699080966},{"type":"absolute","value":1699085062},{"type":"absolute","value":1699089159},{"type":"absolute","value":1699083019},{"type":"absolute","value":1699085068},{"type":"absolute","value":1699080973},{"type":"absolute","value":1699080979},{"type":"absolute","value":1699089177},{"type":"absolute","value":1699087131},{"type":"absolute","value":1699087141},{"type":"absolute","value":1699083046},{"type":"absolute","value":1699089191},{"type":"absolute","value":1699089201},{"type":"absolute","value":1699083058},{"type":"absolute","value":1699085113},{"type":"absolute","value":1699085119},{"type":"absolute","value":1699087169},{"type":"absolute","value":1699083076},{"type":"absolute","value":1699089226},{"type":"absolute","value":1699081035},{"type":"absolute","value":1699087181},{"type":"absolute","value":1699089229},{"type":"absolute","value":1699087184},{"type":"absolute","value":1699089235},{"type":"absolute","value":1699085146},{"type":"absolute","value":1699081053},{"type":"absolute","value":1699083101},{"type":"absolute","value":1699085152},{"type":"absolute","value":1699083111},{"type":"absolute","value":1699081064},{"type":"absolute","value":1699081072},{"type":"absolute","value":1699083120},{"type":"absolute","value":1699087216},{"type":"absolute","value":1699085179},{"type":"absolute","value":1699089283},{"type":"absolute","value":1699083141},{"type":"absolute","value":1699087238},{"type":"absolute","value":1699089286},{"type":"absolute","value":1699081098},{"type":"absolute","value":1699087245},{"type":"absolute","value":1699083150},{"type":"absolute","value":1699085198},{"type":"absolute","value":1699083155},{"type":"absolute","value":1699081108},{"type":"absolute","value":1699081114},{"type":"absolute","value":1699085212},{"type":"absolute","value":1699085218},{"type":"absolute","value":1699089323},{"type":"absolute","value":1699087278},{"type":"absolute","value":1699089329},{"type":"absolute","value":1699083186},{"type":"absolute","value":1699087284},{"type":"absolute","value":1699089337},{"type":"absolute","value":1699083194},{"type":"absolute","value":1699087290},{"type":"absolute","value":1699081150},{"type":"absolute","value":1699085247},{"type":"absolute","value":1699085254},{"type":"absolute","value":1699085260},{"type":"absolute","value":1699089358},{"type":"absolute","value":1699083218},{"type":"absolute","value":1699081176},{"type":"absolute","value":1699089371},{"type":"absolute","value":1699083230},{"type":"absolute","value":1699089381},{"type":"absolute","value":1699081191},{"type":"absolute","value":1699087335},{"type":"absolute","value":1699083245},{"type":"absolute","value":1699081200},{"type":"absolute","value":1699085300},{"type":"absolute","value":1699087349},{"type":"absolute","value":1699089407},{"type":"absolute","value":1699085312},{"type":"absolute","value":1699083268},{"type":"absolute","value":1699089414},{"type":"absolute","value":1699087367},{"type":"absolute","value":1699081224},{"type":"absolute","value":1699083279},{"type":"absolute","value":1699089424},{"type":"absolute","value":1699081234},{"type":"absolute","value":1699081240},{"type":"absolute","value":1699083288},{"type":"absolute","value":1699085336},{"type":"absolute","value":1699087393},{"type":"absolute","value":1699085351},{"type":"absolute","value":1699083308},{"type":"absolute","value":1699087405},{"type":"absolute","value":1699085363},{"type":"absolute","value":1699083317},{"type":"absolute","value":1699081273},{"type":"absolute","value":1699087417},{"type":"absolute","value":1699083323},{"type":"absolute","value":1699089465},{"type":"absolute","value":1699089475},{"type":"absolute","value":1699085382},{"type":"absolute","value":1699085392},{"type":"absolute","value":1699081298},{"type":"absolute","value":1699083350},{"type":"absolute","value":1699087448},{"type":"absolute","value":1699085401},{"type":"absolute","value":1699089499},{"type":"absolute","value":1699083357},{"type":"absolute","value":1699087455},{"type":"absolute","value":1699081312},{"type":"absolute","value":1699089505},{"type":"absolute","value":1699089511},{"type":"absolute","value":1699081321},{"type":"absolute","value":1699085425},{"type":"absolute","value":1699083379},{"type":"absolute","value":1699087483},{"type":"absolute","value":1699083388},{"type":"absolute","value":1699085436},{"type":"absolute","value":1699089533},{"type":"absolute","value":1699085441},{"type":"absolute","value":1699087489},{"type":"absolute","value":1699083397},{"type":"absolute","value":1699081350},{"type":"absolute","value":1699087493},{"type":"absolute","value":1699089549},{"type":"absolute","value":1699081359},{"type":"absolute","value":1699081365},{"type":"absolute","value":1699089557},{"type":"absolute","value":1699083421},{"type":"absolute","value":1699085469},{"type":"absolute","value":1699085478},{"type":"absolute","value":1699087530},{"type":"absolute","value":1699083441},{"type":"absolute","value":1699087539},{"type":"absolute","value":1699089587},{"type":"absolute","value":1699081397},{"type":"absolute","value":1699089589},{"type":"absolute","value":1699083448},{"type":"absolute","value":1699089595},{"type":"absolute","value":1699081407},{"type":"absolute","value":1699085508},{"type":"absolute","value":1699085516},{"type":"absolute","value":1699087565},{"type":"absolute","value":1699083470},{"type":"absolute","value":1699083476},{"type":"absolute","value":1699085526},{"type":"absolute","value":1699081431},{"type":"absolute","value":1699087575},{"type":"absolute","value":1699083482},{"type":"absolute","value":1699079392},{"type":"absolute","value":1699081440},{"type":"absolute","value":1699087589},{"type":"absolute","value":1699085546},{"type":"absolute","value":1699089643},{"type":"absolute","value":1699089645},{"type":"absolute","value":1699081454},{"type":"absolute","value":1699087602},{"type":"absolute","value":1699079412},{"type":"absolute","value":1699085562},{"type":"absolute","value":1699081467},{"type":"absolute","value":1699087614},{"type":"absolute","value":1699085570},{"type":"absolute","value":1699079427},{"type":"absolute","value":1699081477},{"type":"absolute","value":1699083527},{"type":"absolute","value":1699087623},{"type":"absolute","value":1699079433},{"type":"absolute","value":1699081484},{"type":"absolute","value":1699083533},{"type":"absolute","value":1699089681},{"type":"absolute","value":1699089683},{"type":"absolute","value":1699089693},{"type":"absolute","value":1699085599},{"type":"absolute","value":1699087647},{"type":"absolute","value":1699085601},{"type":"absolute","value":1699083554},{"type":"absolute","value":1699081511},{"type":"absolute","value":1699085607},{"type":"absolute","value":1699089704},{"type":"absolute","value":1699087659},{"type":"absolute","value":1699083566},{"type":"absolute","value":1699081519},{"type":"absolute","value":1699079472},{"type":"absolute","value":1699087665},{"type":"absolute","value":1699081524},{"type":"absolute","value":1699089721},{"type":"absolute","value":1699079482},{"type":"absolute","value":1699083582},{"type":"absolute","value":1699079488},{"type":"absolute","value":1699089728},{"type":"absolute","value":1699081552},{"type":"absolute","value":1699085649},{"type":"absolute","value":1699083602},{"type":"absolute","value":1699087697},{"type":"absolute","value":1699081559},{"type":"absolute","value":1699085659},{"type":"absolute","value":1699083613},{"type":"absolute","value":1699079518},{"type":"absolute","value":1699087710},{"type":"absolute","value":1699089760},{"type":"absolute","value":1699083620},{"type":"absolute","value":1699089767},{"type":"absolute","value":1699081577},{"type":"absolute","value":1699089773},{"type":"absolute","value":1699079540},{"type":"absolute","value":1699081589},{"type":"absolute","value":1699085684},{"type":"absolute","value":1699083640},{"type":"absolute","value":1699087736},{"type":"absolute","value":1699085694},{"type":"absolute","value":1699087746},{"type":"absolute","value":1699081603},{"type":"absolute","value":1699083653},{"type":"absolute","value":1699085704},{"type":"absolute","value":1699079561},{"type":"absolute","value":1699087752},{"type":"absolute","value":1699083659},{"type":"absolute","value":1699079567},{"type":"absolute","value":1699081615},{"type":"absolute","value":1699089817},{"type":"absolute","value":1699081626},{"type":"absolute","value":1699087778},{"type":"absolute","value":1699081636},{"type":"absolute","value":1699083686},{"type":"absolute","value":1699079591},{"type":"absolute","value":1699089834},{"type":"absolute","value":1699085743},{"type":"absolute","value":1699083696},{"type":"absolute","value":1699087793},{"type":"absolute","value":1699079606},{"type":"absolute","value":1699079610},{"type":"absolute","value":1699081658},{"type":"absolute","value":1699087806},{"type":"absolute","value":1699089859},{"type":"absolute","value":1699081668},{"type":"absolute","value":1699089862},{"type":"absolute","value":1699085768},{"type":"absolute","value":1699081674},{"type":"absolute","value":1699083723},{"type":"absolute","value":1699085776},{"type":"absolute","value":1699079639},{"type":"absolute","value":1699083735},{"type":"absolute","value":1699087831},{"type":"absolute","value":1699089884},{"type":"absolute","value":1699079649},{"type":"absolute","value":1699087841},{"type":"absolute","value":1699083747},{"type":"absolute","value":1699085797},{"type":"absolute","value":1699087847},{"type":"absolute","value":1699081706},{"type":"absolute","value":1699085804},{"type":"absolute","value":1699089903},{"type":"absolute","value":1699085809},{"type":"absolute","value":1699089906},{"type":"absolute","value":1699081716},{"type":"absolute","value":1699083765},{"type":"absolute","value":1699089921},{"type":"absolute","value":1699079684},{"type":"absolute","value":1699085831},{"type":"absolute","value":1699079692},{"type":"absolute","value":1699083788},{"type":"absolute","value":1699081745},{"type":"absolute","value":1699085841},{"type":"absolute","value":1699087890},{"type":"absolute","value":1699083797},{"type":"absolute","value":1699081755},{"type":"absolute","value":1699087900},{"type":"absolute","value":1699079717},{"type":"absolute","value":1699081767},{"type":"absolute","value":1699079724},{"type":"absolute","value":1699083821},{"type":"absolute","value":1699089967},{"type":"absolute","value":1699079730},{"type":"absolute","value":1699087922},{"type":"absolute","value":1699085878},{"type":"absolute","value":1699083831},{"type":"absolute","value":1699089974},{"type":"absolute","value":1699081788},{"type":"absolute","value":1699083837},{"type":"absolute","value":1699087932},{"type":"absolute","value":1699089980},{"type":"absolute","value":1699085888},{"type":"absolute","value":1699087943},{"type":"absolute","value":1699081807},{"type":"absolute","value":1699085903},{"type":"absolute","value":1699087955},{"type":"absolute","value":1699081817},{"type":"absolute","value":1699079770},{"type":"absolute","value":1699083869},{"type":"absolute","value":1699079778},{"type":"absolute","value":1699087972},{"type":"absolute","value":1699085926},{"type":"absolute","value":1699083879},{"type":"absolute","value":1699087980},{"type":"absolute","value":1699081840},{"type":"absolute","value":1699081850},{"type":"absolute","value":1699085947},{"type":"absolute","value":1699083901},{"type":"absolute","value":1699081856},{"type":"absolute","value":1699088000},{"type":"absolute","value":1699085954},{"type":"absolute","value":1699079814},{"type":"absolute","value":1699083911},{"type":"absolute","value":1699088009},{"type":"absolute","value":1699088015},{"type":"absolute","value":1699083921},{"type":"absolute","value":1699079826},{"type":"absolute","value":1699085981},{"type":"absolute","value":1699081890},{"type":"absolute","value":1699085988},{"type":"absolute","value":1699085994},{"type":"absolute","value":1699083948},{"type":"absolute","value":1699079853},{"type":"absolute","value":1699088046},{"type":"absolute","value":1699079860},{"type":"absolute","value":1699081910},{"type":"absolute","value":1699083958},{"type":"absolute","value":1699088054},{"type":"absolute","value":1699079866},{"type":"absolute","value":1699083966},{"type":"absolute","value":1699081930},{"type":"absolute","value":1699088077},{"type":"absolute","value":1699081940},{"type":"absolute","value":1699083988},{"type":"absolute","value":1699086038},{"type":"absolute","value":1699088087},{"type":"absolute","value":1699083996},{"type":"absolute","value":1699086047},{"type":"absolute","value":1699081952},{"type":"absolute","value":1699084000},{"type":"absolute","value":1699088098},{"type":"absolute","value":1699079912},{"type":"absolute","value":1699079920},{"type":"absolute","value":1699086068},{"type":"absolute","value":1699081974},{"type":"absolute","value":1699086073},{"type":"absolute","value":1699088122},{"type":"absolute","value":1699084029},{"type":"absolute","value":1699084037},{"type":"absolute","value":1699088133},{"type":"absolute","value":1699088140},{"type":"absolute","value":1699081997},{"type":"absolute","value":1699086094},{"type":"absolute","value":1699079957},{"type":"absolute","value":1699082006},{"type":"absolute","value":1699084057},{"type":"absolute","value":1699079966},{"type":"absolute","value":1699088160},{"type":"absolute","value":1699084065},{"type":"absolute","value":1699086120},{"type":"absolute","value":1699088170},{"type":"absolute","value":1699084077},{"type":"absolute","value":1699082030},{"type":"absolute","value":1699088176},{"type":"absolute","value":1699086131},{"type":"absolute","value":1699079990},{"type":"absolute","value":1699082040},{"type":"absolute","value":1699084091},{"type":"absolute","value":1699086140},{"type":"absolute","value":1699082046},{"type":"absolute","value":1699080000},{"type":"absolute","value":1699080006},{"type":"absolute","value":1699086159},{"type":"absolute","value":1699088208},{"type":"absolute","value":1699084113},{"type":"absolute","value":1699084121},{"type":"absolute","value":1699086172},{"type":"absolute","value":1699082079},{"type":"absolute","value":1699088225},{"type":"absolute","value":1699084130},{"type":"absolute","value":1699086178},{"type":"absolute","value":1699084139},{"type":"absolute","value":1699080045},{"type":"absolute","value":1699084144},{"type":"absolute","value":1699082099},{"type":"absolute","value":1699088243},{"type":"absolute","value":1699080057},{"type":"absolute","value":1699088253},{"type":"absolute","value":1699088259},{"type":"absolute","value":1699086212},{"type":"absolute","value":1699082119},{"type":"absolute","value":1699086221},{"type":"absolute","value":1699084176},{"type":"absolute","value":1699082131},{"type":"absolute","value":1699080085},{"type":"absolute","value":1699084187},{"type":"absolute","value":1699080094},{"type":"absolute","value":1699082143},{"type":"absolute","value":1699088291},{"type":"absolute","value":1699086249},{"type":"absolute","value":1699084207},{"type":"absolute","value":1699086255},{"type":"absolute","value":1699080117},{"type":"absolute","value":1699088309},{"type":"absolute","value":1699086263},{"type":"absolute","value":1699082169},{"type":"absolute","value":1699084218},{"type":"absolute","value":1699084287},{"type":"absolute","value":1699088318},{"type":"absolute","value":1699080127},{"type":"absolute","value":1699080133},{"type":"absolute","value":1699084232},{"type":"absolute","value":1699082188},{"type":"absolute","value":1699082191},{"type":"absolute","value":1699086288},{"type":"absolute","value":1699088344},{"type":"absolute","value":1699084250},{"type":"absolute","value":1699088347},{"type":"absolute","value":1699086302},{"type":"absolute","value":1699088353},{"type":"absolute","value":1699080165},{"type":"absolute","value":1699086311},{"type":"absolute","value":1699082220},{"type":"absolute","value":1699080173},{"type":"absolute","value":1699082229},{"type":"absolute","value":1699084277},{"type":"absolute","value":1699082234},{"type":"absolute","value":1699086335}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699091184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699091184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699092226},{"type":"absolute","value":1699091716},{"type":"absolute","value":1699091972},{"type":"absolute","value":1699093001},{"type":"absolute","value":1699093259},{"type":"absolute","value":1699091982},{"type":"absolute","value":1699093008},{"type":"absolute","value":1699092241},{"type":"absolute","value":1699091986},{"type":"absolute","value":1699093267},{"type":"absolute","value":1699092244},{"type":"absolute","value":1699091989},{"type":"absolute","value":1699091226},{"type":"absolute","value":1699092252},{"type":"absolute","value":1699092515},{"type":"absolute","value":1699093283},{"type":"absolute","value":1699093286},{"type":"absolute","value":1699091240},{"type":"absolute","value":1699092010},{"type":"absolute","value":1699091243},{"type":"absolute","value":1699092267},{"type":"absolute","value":1699093293},{"type":"absolute","value":1699091502},{"type":"absolute","value":1699091250},{"type":"absolute","value":1699092274},{"type":"absolute","value":1699092530},{"type":"absolute","value":1699092277},{"type":"absolute","value":1699092023},{"type":"absolute","value":1699091512},{"type":"absolute","value":1699092537},{"type":"absolute","value":1699093309},{"type":"absolute","value":1699091266},{"type":"absolute","value":1699092803},{"type":"absolute","value":1699091524},{"type":"absolute","value":1699092293},{"type":"absolute","value":1699092549},{"type":"absolute","value":1699091273},{"type":"absolute","value":1699091532},{"type":"absolute","value":1699092559},{"type":"absolute","value":1699092818},{"type":"absolute","value":1699092563},{"type":"absolute","value":1699092821},{"type":"absolute","value":1699092566},{"type":"absolute","value":1699091803},{"type":"absolute","value":1699091548},{"type":"absolute","value":1699092829},{"type":"absolute","value":1699091551},{"type":"absolute","value":1699091558},{"type":"absolute","value":1699093096},{"type":"absolute","value":1699091817},{"type":"absolute","value":1699092587},{"type":"absolute","value":1699091820},{"type":"absolute","value":1699092844},{"type":"absolute","value":1699092079},{"type":"absolute","value":1699091827},{"type":"absolute","value":1699092851},{"type":"absolute","value":1699091574},{"type":"absolute","value":1699092854},{"type":"absolute","value":1699092600},{"type":"absolute","value":1699092089},{"type":"absolute","value":1699093111},{"type":"absolute","value":1699093118},{"type":"absolute","value":1699091843},{"type":"absolute","value":1699092101},{"type":"absolute","value":1699092870},{"type":"absolute","value":1699093384},{"type":"absolute","value":1699091850},{"type":"absolute","value":1699093130},{"type":"absolute","value":1699092109},{"type":"absolute","value":1699093140},{"type":"absolute","value":1699093399},{"type":"absolute","value":1699093144},{"type":"absolute","value":1699093402},{"type":"absolute","value":1699093147},{"type":"absolute","value":1699092380},{"type":"absolute","value":1699092125},{"type":"absolute","value":1699092128},{"type":"absolute","value":1699091361},{"type":"absolute","value":1699092728},{"type":"absolute","value":1699093410},{"type":"absolute","value":1699092135},{"type":"absolute","value":1699092394},{"type":"absolute","value":1699092397},{"type":"absolute","value":1699091376},{"type":"absolute","value":1699092656},{"type":"absolute","value":1699093168},{"type":"absolute","value":1699093425},{"type":"absolute","value":1699092404},{"type":"absolute","value":1699091383},{"type":"absolute","value":1699092151},{"type":"absolute","value":1699093432},{"type":"absolute","value":1699092666},{"type":"absolute","value":1699093435},{"type":"absolute","value":1699093181},{"type":"absolute","value":1699091649},{"type":"absolute","value":1699091395},{"type":"absolute","value":1699092420},{"type":"absolute","value":1699092678},{"type":"absolute","value":1699092427},{"type":"absolute","value":1699093451},{"type":"absolute","value":1699091405},{"type":"absolute","value":1699092686},{"type":"absolute","value":1699091664},{"type":"absolute","value":1699091409},{"type":"absolute","value":1699091667},{"type":"absolute","value":1699091412},{"type":"absolute","value":1699091675},{"type":"absolute","value":1699092702},{"type":"absolute","value":1699092705},{"type":"absolute","value":1699091938},{"type":"absolute","value":1699092961},{"type":"absolute","value":1699092712},{"type":"absolute","value":1699091433},{"type":"absolute","value":1699091690},{"type":"absolute","value":1699092975},{"type":"absolute","value":1699091697},{"type":"absolute","value":1699091953},{"type":"absolute","value":1699092978},{"type":"absolute","value":1699091700},{"type":"absolute","value":1699093237},{"type":"absolute","value":1699091446},{"type":"absolute","value":1699091960},{"type":"absolute","value":1699092985},{"type":"absolute","value":1699093247}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699093513},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699093513}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699094018},{"type":"absolute","value":1699094149},{"type":"absolute","value":1699093638},{"type":"absolute","value":1699094028},{"type":"absolute","value":1699093645},{"type":"absolute","value":1699093648},{"type":"absolute","value":1699094035},{"type":"absolute","value":1699094038},{"type":"absolute","value":1699093658},{"type":"absolute","value":1699093534},{"type":"absolute","value":1699094048},{"type":"absolute","value":1699093665},{"type":"absolute","value":1699093924},{"type":"absolute","value":1699094055},{"type":"absolute","value":1699093544},{"type":"absolute","value":1699093934},{"type":"absolute","value":1699093551},{"type":"absolute","value":1699093554},{"type":"absolute","value":1699093941},{"type":"absolute","value":1699093816},{"type":"absolute","value":1699093944},{"type":"absolute","value":1699093564},{"type":"absolute","value":1699094206},{"type":"absolute","value":1699093826},{"type":"absolute","value":1699093571},{"type":"absolute","value":1699093954},{"type":"absolute","value":1699094216},{"type":"absolute","value":1699093833},{"type":"absolute","value":1699093961},{"type":"absolute","value":1699093836},{"type":"absolute","value":1699094223},{"type":"absolute","value":1699094226},{"type":"absolute","value":1699093846},{"type":"absolute","value":1699093722},{"type":"absolute","value":1699094236},{"type":"absolute","value":1699093853},{"type":"absolute","value":1699094112},{"type":"absolute","value":1699094243},{"type":"absolute","value":1699093732},{"type":"absolute","value":1699094122},{"type":"absolute","value":1699093739},{"type":"absolute","value":1699093742},{"type":"absolute","value":1699094129},{"type":"absolute","value":1699094132},{"type":"absolute","value":1699093752},{"type":"absolute","value":1699093628},{"type":"absolute","value":1699094142},{"type":"absolute","value":1699093759}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699094912},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699094912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699096327},{"type":"absolute","value":1699096077},{"type":"absolute","value":1699096590},{"type":"absolute","value":1699096846},{"type":"absolute","value":1699096085},{"type":"absolute","value":1699096343},{"type":"absolute","value":1699095064},{"type":"absolute","value":1699096601},{"type":"absolute","value":1699096346},{"type":"absolute","value":1699096857},{"type":"absolute","value":1699096604},{"type":"absolute","value":1699096611},{"type":"absolute","value":1699096870},{"type":"absolute","value":1699095080},{"type":"absolute","value":1699096878},{"type":"absolute","value":1699095088},{"type":"absolute","value":1699095344},{"type":"absolute","value":1699096628},{"type":"absolute","value":1699095611},{"type":"absolute","value":1699096636},{"type":"absolute","value":1699095101},{"type":"absolute","value":1699096894},{"type":"absolute","value":1699095360},{"type":"absolute","value":1699096897},{"type":"absolute","value":1699095363},{"type":"absolute","value":1699095371},{"type":"absolute","value":1699095116},{"type":"absolute","value":1699095627},{"type":"absolute","value":1699095119},{"type":"absolute","value":1699095635},{"type":"absolute","value":1699095891},{"type":"absolute","value":1699095387},{"type":"absolute","value":1699096158},{"type":"absolute","value":1699095648},{"type":"absolute","value":1699095395},{"type":"absolute","value":1699095907},{"type":"absolute","value":1699095910},{"type":"absolute","value":1699095918},{"type":"absolute","value":1699095663},{"type":"absolute","value":1699096174},{"type":"absolute","value":1699095666},{"type":"absolute","value":1699096182},{"type":"absolute","value":1699096438},{"type":"absolute","value":1699095934},{"type":"absolute","value":1699096195},{"type":"absolute","value":1699096709},{"type":"absolute","value":1699095942},{"type":"absolute","value":1699096454},{"type":"absolute","value":1699096457},{"type":"absolute","value":1699096465},{"type":"absolute","value":1699096210},{"type":"absolute","value":1699096213},{"type":"absolute","value":1699096725},{"type":"absolute","value":1699096733},{"type":"absolute","value":1699096989},{"type":"absolute","value":1699094945},{"type":"absolute","value":1699095201},{"type":"absolute","value":1699096481},{"type":"absolute","value":1699096489},{"type":"absolute","value":1699096746},{"type":"absolute","value":1699094956},{"type":"absolute","value":1699095212},{"type":"absolute","value":1699097005},{"type":"absolute","value":1699094959},{"type":"absolute","value":1699097008},{"type":"absolute","value":1699094966},{"type":"absolute","value":1699097016},{"type":"absolute","value":1699095225},{"type":"absolute","value":1699096761},{"type":"absolute","value":1699096764},{"type":"absolute","value":1699095233},{"type":"absolute","value":1699095492},{"type":"absolute","value":1699095748},{"type":"absolute","value":1699094983},{"type":"absolute","value":1699097032},{"type":"absolute","value":1699094991},{"type":"absolute","value":1699095503},{"type":"absolute","value":1699095249},{"type":"absolute","value":1699095506},{"type":"absolute","value":1699095759},{"type":"absolute","value":1699095252},{"type":"absolute","value":1699097040},{"type":"absolute","value":1699095513},{"type":"absolute","value":1699095772},{"type":"absolute","value":1699095780},{"type":"absolute","value":1699096039},{"type":"absolute","value":1699096295},{"type":"absolute","value":1699095530},{"type":"absolute","value":1699095538},{"type":"absolute","value":1699096050},{"type":"absolute","value":1699095796},{"type":"absolute","value":1699096053},{"type":"absolute","value":1699096306},{"type":"absolute","value":1699095799},{"type":"absolute","value":1699096060},{"type":"absolute","value":1699096319}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699097121},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699097121}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699097857},{"type":"absolute","value":1699097476},{"type":"absolute","value":1699097354},{"type":"absolute","value":1699097484},{"type":"absolute","value":1699097868},{"type":"absolute","value":1699097362},{"type":"absolute","value":1699097876},{"type":"absolute","value":1699097365},{"type":"absolute","value":1699097879},{"type":"absolute","value":1699097243},{"type":"absolute","value":1699097757},{"type":"absolute","value":1699097376},{"type":"absolute","value":1699097890},{"type":"absolute","value":1699097254},{"type":"absolute","value":1699097384},{"type":"absolute","value":1699097768},{"type":"absolute","value":1699097898},{"type":"absolute","value":1699097262},{"type":"absolute","value":1699097776},{"type":"absolute","value":1699097265},{"type":"absolute","value":1699097779},{"type":"absolute","value":1699097143},{"type":"absolute","value":1699097657},{"type":"absolute","value":1699097276},{"type":"absolute","value":1699097790},{"type":"absolute","value":1699097154},{"type":"absolute","value":1699097284},{"type":"absolute","value":1699097668},{"type":"absolute","value":1699097798},{"type":"absolute","value":1699097162},{"type":"absolute","value":1699097676},{"type":"absolute","value":1699097165},{"type":"absolute","value":1699097679},{"type":"absolute","value":1699097557},{"type":"absolute","value":1699097176},{"type":"absolute","value":1699097690},{"type":"absolute","value":1699097184},{"type":"absolute","value":1699097568},{"type":"absolute","value":1699097698},{"type":"absolute","value":1699097443},{"type":"absolute","value":1699097576},{"type":"absolute","value":1699097579},{"type":"absolute","value":1699097454},{"type":"absolute","value":1699097462},{"type":"absolute","value":1699097590},{"type":"absolute","value":1699097465},{"type":"absolute","value":1699097598},{"type":"absolute","value":1699097343}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699098592},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699098592}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699099907},{"type":"absolute","value":1699100427},{"type":"absolute","value":1699098638},{"type":"absolute","value":1699100430},{"type":"absolute","value":1699099920},{"type":"absolute","value":1699098641},{"type":"absolute","value":1699100176},{"type":"absolute","value":1699100179},{"type":"absolute","value":1699099668},{"type":"absolute","value":1699099927},{"type":"absolute","value":1699100439},{"type":"absolute","value":1699098905},{"type":"absolute","value":1699100695},{"type":"absolute","value":1699100698},{"type":"absolute","value":1699098657},{"type":"absolute","value":1699098914},{"type":"absolute","value":1699100199},{"type":"absolute","value":1699100461},{"type":"absolute","value":1699100724},{"type":"absolute","value":1699098677},{"type":"absolute","value":1699099191},{"type":"absolute","value":1699100727},{"type":"absolute","value":1699099194},{"type":"absolute","value":1699100474},{"type":"absolute","value":1699100220},{"type":"absolute","value":1699098941},{"type":"absolute","value":1699098686},{"type":"absolute","value":1699099456},{"type":"absolute","value":1699100481},{"type":"absolute","value":1699098694},{"type":"absolute","value":1699099465},{"type":"absolute","value":1699098954},{"type":"absolute","value":1699099210},{"type":"absolute","value":1699100747},{"type":"absolute","value":1699098962},{"type":"absolute","value":1699099738},{"type":"absolute","value":1699099741},{"type":"absolute","value":1699099231},{"type":"absolute","value":1699098976},{"type":"absolute","value":1699100768},{"type":"absolute","value":1699099492},{"type":"absolute","value":1699100005},{"type":"absolute","value":1699099240},{"type":"absolute","value":1699099757},{"type":"absolute","value":1699100014},{"type":"absolute","value":1699099248},{"type":"absolute","value":1699099505},{"type":"absolute","value":1699099513},{"type":"absolute","value":1699099777},{"type":"absolute","value":1699100291},{"type":"absolute","value":1699100294},{"type":"absolute","value":1699099527},{"type":"absolute","value":1699100041},{"type":"absolute","value":1699099786},{"type":"absolute","value":1699100556},{"type":"absolute","value":1699099794},{"type":"absolute","value":1699098773},{"type":"absolute","value":1699100054},{"type":"absolute","value":1699100310},{"type":"absolute","value":1699098776},{"type":"absolute","value":1699100565},{"type":"absolute","value":1699100062},{"type":"absolute","value":1699098785},{"type":"absolute","value":1699099046},{"type":"absolute","value":1699099049},{"type":"absolute","value":1699100331},{"type":"absolute","value":1699100076},{"type":"absolute","value":1699100592},{"type":"absolute","value":1699100340},{"type":"absolute","value":1699098807},{"type":"absolute","value":1699100348},{"type":"absolute","value":1699100605},{"type":"absolute","value":1699099327},{"type":"absolute","value":1699099330},{"type":"absolute","value":1699098820},{"type":"absolute","value":1699099076},{"type":"absolute","value":1699100613},{"type":"absolute","value":1699099079},{"type":"absolute","value":1699098827},{"type":"absolute","value":1699099339},{"type":"absolute","value":1699099595},{"type":"absolute","value":1699099598},{"type":"absolute","value":1699100627},{"type":"absolute","value":1699099099},{"type":"absolute","value":1699099361},{"type":"absolute","value":1699099873},{"type":"absolute","value":1699099876},{"type":"absolute","value":1699099624},{"type":"absolute","value":1699099627},{"type":"absolute","value":1699099885},{"type":"absolute","value":1699099374},{"type":"absolute","value":1699099120},{"type":"absolute","value":1699100146},{"type":"absolute","value":1699099381},{"type":"absolute","value":1699100149},{"type":"absolute","value":1699099647}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699100810},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699100810}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699101056},{"type":"absolute","value":1699101184},{"type":"absolute","value":1699100930},{"type":"absolute","value":1699101440},{"type":"absolute","value":1699101443},{"type":"absolute","value":1699100933},{"type":"absolute","value":1699101574},{"type":"absolute","value":1699101068},{"type":"absolute","value":1699101457},{"type":"absolute","value":1699100948},{"type":"absolute","value":1699101590},{"type":"absolute","value":1699101466},{"type":"absolute","value":1699101084},{"type":"absolute","value":1699100957},{"type":"absolute","value":1699101341},{"type":"absolute","value":1699101344},{"type":"absolute","value":1699100836},{"type":"absolute","value":1699101477},{"type":"absolute","value":1699100839},{"type":"absolute","value":1699100969},{"type":"absolute","value":1699101359},{"type":"absolute","value":1699100851},{"type":"absolute","value":1699101492},{"type":"absolute","value":1699101368},{"type":"absolute","value":1699100985},{"type":"absolute","value":1699100860},{"type":"absolute","value":1699101244},{"type":"absolute","value":1699101247},{"type":"absolute","value":1699101380},{"type":"absolute","value":1699100871},{"type":"absolute","value":1699101129},{"type":"absolute","value":1699101259},{"type":"absolute","value":1699101132},{"type":"absolute","value":1699101268},{"type":"absolute","value":1699101396},{"type":"absolute","value":1699100886},{"type":"absolute","value":1699101147},{"type":"absolute","value":1699101279},{"type":"absolute","value":1699101537},{"type":"absolute","value":1699101156},{"type":"absolute","value":1699101029},{"type":"absolute","value":1699101540},{"type":"absolute","value":1699101032},{"type":"absolute","value":1699101168},{"type":"absolute","value":1699101296},{"type":"absolute","value":1699101554},{"type":"absolute","value":1699101047},{"type":"absolute","value":1699101563}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699101744},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699101744}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699102080},{"type":"absolute","value":1699101953},{"type":"absolute","value":1699102208},{"type":"absolute","value":1699102466},{"type":"absolute","value":1699101956},{"type":"absolute","value":1699102475},{"type":"absolute","value":1699102092},{"type":"absolute","value":1699102352},{"type":"absolute","value":1699101971},{"type":"absolute","value":1699102355},{"type":"absolute","value":1699102486},{"type":"absolute","value":1699101980},{"type":"absolute","value":1699102108},{"type":"absolute","value":1699101854},{"type":"absolute","value":1699101857},{"type":"absolute","value":1699102369},{"type":"absolute","value":1699102502},{"type":"absolute","value":1699101992},{"type":"absolute","value":1699102378},{"type":"absolute","value":1699102253},{"type":"absolute","value":1699101872},{"type":"absolute","value":1699102256},{"type":"absolute","value":1699102389},{"type":"absolute","value":1699102008},{"type":"absolute","value":1699101881},{"type":"absolute","value":1699102271},{"type":"absolute","value":1699101759},{"type":"absolute","value":1699101762},{"type":"absolute","value":1699102404},{"type":"absolute","value":1699101893},{"type":"absolute","value":1699102280},{"type":"absolute","value":1699102156},{"type":"absolute","value":1699101774},{"type":"absolute","value":1699102159},{"type":"absolute","value":1699102292},{"type":"absolute","value":1699101909},{"type":"absolute","value":1699101783},{"type":"absolute","value":1699102171},{"type":"absolute","value":1699101794},{"type":"absolute","value":1699102180},{"type":"absolute","value":1699102053},{"type":"absolute","value":1699102308},{"type":"absolute","value":1699102056},{"type":"absolute","value":1699102191},{"type":"absolute","value":1699102449},{"type":"absolute","value":1699101810},{"type":"absolute","value":1699102452},{"type":"absolute","value":1699102071}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699112075},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699112075}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699125248},{"type":"absolute","value":1699123201},{"type":"absolute","value":1699119109},{"type":"absolute","value":1699121162},{"type":"absolute","value":1699125258},{"type":"absolute","value":1699115020},{"type":"absolute","value":1699112974},{"type":"absolute","value":1699117071},{"type":"absolute","value":1699119121},{"type":"absolute","value":1699115026},{"type":"absolute","value":1699117081},{"type":"absolute","value":1699123229},{"type":"absolute","value":1699121182},{"type":"absolute","value":1699125278},{"type":"absolute","value":1699123232},{"type":"absolute","value":1699112993},{"type":"absolute","value":1699115042},{"type":"absolute","value":1699119139},{"type":"absolute","value":1699115045},{"type":"absolute","value":1699123240},{"type":"absolute","value":1699125288},{"type":"absolute","value":1699113002},{"type":"absolute","value":1699119146},{"type":"absolute","value":1699123243},{"type":"absolute","value":1699119149},{"type":"absolute","value":1699125291},{"type":"absolute","value":1699113012},{"type":"absolute","value":1699117109},{"type":"absolute","value":1699117112},{"type":"absolute","value":1699115066},{"type":"absolute","value":1699125306},{"type":"absolute","value":1699113022},{"type":"absolute","value":1699119167},{"type":"absolute","value":1699117120},{"type":"absolute","value":1699117123},{"type":"absolute","value":1699123270},{"type":"absolute","value":1699121228},{"type":"absolute","value":1699123276},{"type":"absolute","value":1699115086},{"type":"absolute","value":1699119182},{"type":"absolute","value":1699125325},{"type":"absolute","value":1699119186},{"type":"absolute","value":1699121238},{"type":"absolute","value":1699125334},{"type":"absolute","value":1699119193},{"type":"absolute","value":1699119197},{"type":"absolute","value":1699117150},{"type":"absolute","value":1699123295},{"type":"absolute","value":1699125344},{"type":"absolute","value":1699123298},{"type":"absolute","value":1699117156},{"type":"absolute","value":1699113061},{"type":"absolute","value":1699125354},{"type":"absolute","value":1699113071},{"type":"absolute","value":1699113074},{"type":"absolute","value":1699121269},{"type":"absolute","value":1699117175},{"type":"absolute","value":1699117178},{"type":"absolute","value":1699123322},{"type":"absolute","value":1699115132},{"type":"absolute","value":1699119231},{"type":"absolute","value":1699113089},{"type":"absolute","value":1699121281},{"type":"absolute","value":1699115142},{"type":"absolute","value":1699119241},{"type":"absolute","value":1699123342},{"type":"absolute","value":1699117202},{"type":"absolute","value":1699121299},{"type":"absolute","value":1699113108},{"type":"absolute","value":1699121306},{"type":"absolute","value":1699113117},{"type":"absolute","value":1699121309},{"type":"absolute","value":1699115170},{"type":"absolute","value":1699119269},{"type":"absolute","value":1699117222},{"type":"absolute","value":1699113127},{"type":"absolute","value":1699119272},{"type":"absolute","value":1699115182},{"type":"absolute","value":1699121327},{"type":"absolute","value":1699119280},{"type":"absolute","value":1699113137},{"type":"absolute","value":1699119283},{"type":"absolute","value":1699123388},{"type":"absolute","value":1699121342},{"type":"absolute","value":1699115200},{"type":"absolute","value":1699121346},{"type":"absolute","value":1699123398},{"type":"absolute","value":1699115207},{"type":"absolute","value":1699121353},{"type":"absolute","value":1699115210},{"type":"absolute","value":1699121357},{"type":"absolute","value":1699119310},{"type":"absolute","value":1699113171},{"type":"absolute","value":1699117268},{"type":"absolute","value":1699119316},{"type":"absolute","value":1699115228},{"type":"absolute","value":1699113181},{"type":"absolute","value":1699117278},{"type":"absolute","value":1699113184},{"type":"absolute","value":1699123429},{"type":"absolute","value":1699119335},{"type":"absolute","value":1699119338},{"type":"absolute","value":1699115243},{"type":"absolute","value":1699113199},{"type":"absolute","value":1699115247},{"type":"absolute","value":1699121391},{"type":"absolute","value":1699123441},{"type":"absolute","value":1699115254},{"type":"absolute","value":1699121401},{"type":"absolute","value":1699115258},{"type":"absolute","value":1699117309},{"type":"absolute","value":1699113218},{"type":"absolute","value":1699119362},{"type":"absolute","value":1699123459},{"type":"absolute","value":1699117321},{"type":"absolute","value":1699123466},{"type":"absolute","value":1699113227},{"type":"absolute","value":1699123469},{"type":"absolute","value":1699113237},{"type":"absolute","value":1699119382},{"type":"absolute","value":1699121429},{"type":"absolute","value":1699121432},{"type":"absolute","value":1699117339},{"type":"absolute","value":1699115292},{"type":"absolute","value":1699113247},{"type":"absolute","value":1699121440},{"type":"absolute","value":1699123487},{"type":"absolute","value":1699117346},{"type":"absolute","value":1699121443},{"type":"absolute","value":1699117349},{"type":"absolute","value":1699115302},{"type":"absolute","value":1699123502},{"type":"absolute","value":1699123506},{"type":"absolute","value":1699117367},{"type":"absolute","value":1699123513},{"type":"absolute","value":1699123517},{"type":"absolute","value":1699121470},{"type":"absolute","value":1699115330},{"type":"absolute","value":1699119428},{"type":"absolute","value":1699115333},{"type":"absolute","value":1699113286},{"type":"absolute","value":1699117382},{"type":"absolute","value":1699121476},{"type":"absolute","value":1699117386},{"type":"absolute","value":1699115341},{"type":"absolute","value":1699119438},{"type":"absolute","value":1699113296},{"type":"absolute","value":1699115344},{"type":"absolute","value":1699117393},{"type":"absolute","value":1699113299},{"type":"absolute","value":1699117397},{"type":"absolute","value":1699121495},{"type":"absolute","value":1699121498},{"type":"absolute","value":1699123551},{"type":"absolute","value":1699113314},{"type":"absolute","value":1699123561},{"type":"absolute","value":1699115371},{"type":"absolute","value":1699119469},{"type":"absolute","value":1699115377},{"type":"absolute","value":1699121522},{"type":"absolute","value":1699113333},{"type":"absolute","value":1699117431},{"type":"absolute","value":1699119481},{"type":"absolute","value":1699113342},{"type":"absolute","value":1699117441},{"type":"absolute","value":1699115396},{"type":"absolute","value":1699123589},{"type":"absolute","value":1699121542},{"type":"absolute","value":1699115399},{"type":"absolute","value":1699113352},{"type":"absolute","value":1699123592},{"type":"absolute","value":1699119499},{"type":"absolute","value":1699123600},{"type":"absolute","value":1699113362},{"type":"absolute","value":1699119506},{"type":"absolute","value":1699123603},{"type":"absolute","value":1699119509},{"type":"absolute","value":1699115420},{"type":"absolute","value":1699117469},{"type":"absolute","value":1699117472},{"type":"absolute","value":1699119527},{"type":"absolute","value":1699117480},{"type":"absolute","value":1699117483},{"type":"absolute","value":1699123630},{"type":"absolute","value":1699115440},{"type":"absolute","value":1699113396},{"type":"absolute","value":1699121588},{"type":"absolute","value":1699119542},{"type":"absolute","value":1699123636},{"type":"absolute","value":1699119546},{"type":"absolute","value":1699113406},{"type":"absolute","value":1699121598},{"type":"absolute","value":1699113409},{"type":"absolute","value":1699119553},{"type":"absolute","value":1699119557},{"type":"absolute","value":1699117510},{"type":"absolute","value":1699123655},{"type":"absolute","value":1699123658},{"type":"absolute","value":1699117516},{"type":"absolute","value":1699113424},{"type":"absolute","value":1699121629},{"type":"absolute","value":1699115486},{"type":"absolute","value":1699117535},{"type":"absolute","value":1699117538},{"type":"absolute","value":1699113443},{"type":"absolute","value":1699123682},{"type":"absolute","value":1699119591},{"type":"absolute","value":1699115496},{"type":"absolute","value":1699121641},{"type":"absolute","value":1699113452},{"type":"absolute","value":1699119601},{"type":"absolute","value":1699113462},{"type":"absolute","value":1699123702},{"type":"absolute","value":1699117562},{"type":"absolute","value":1699121659},{"type":"absolute","value":1699113472},{"type":"absolute","value":1699121666},{"type":"absolute","value":1699115524},{"type":"absolute","value":1699121669},{"type":"absolute","value":1699119629},{"type":"absolute","value":1699117582},{"type":"absolute","value":1699115536},{"type":"absolute","value":1699119632},{"type":"absolute","value":1699121687},{"type":"absolute","value":1699119640},{"type":"absolute","value":1699119643},{"type":"absolute","value":1699115554},{"type":"absolute","value":1699123748},{"type":"absolute","value":1699121702},{"type":"absolute","value":1699113511},{"type":"absolute","value":1699115561},{"type":"absolute","value":1699121706},{"type":"absolute","value":1699115564},{"type":"absolute","value":1699123758},{"type":"absolute","value":1699113521},{"type":"absolute","value":1699121713},{"type":"absolute","value":1699113524},{"type":"absolute","value":1699121717},{"type":"absolute","value":1699119670},{"type":"absolute","value":1699117628},{"type":"absolute","value":1699119676},{"type":"absolute","value":1699115582},{"type":"absolute","value":1699113539},{"type":"absolute","value":1699117638},{"type":"absolute","value":1699115597},{"type":"absolute","value":1699123789},{"type":"absolute","value":1699119695},{"type":"absolute","value":1699115601},{"type":"absolute","value":1699119698},{"type":"absolute","value":1699113558},{"type":"absolute","value":1699121751},{"type":"absolute","value":1699115608},{"type":"absolute","value":1699123801},{"type":"absolute","value":1699115612},{"type":"absolute","value":1699113567},{"type":"absolute","value":1699121761},{"type":"absolute","value":1699117669},{"type":"absolute","value":1699113577},{"type":"absolute","value":1699119722},{"type":"absolute","value":1699123819},{"type":"absolute","value":1699117681},{"type":"absolute","value":1699123826},{"type":"absolute","value":1699113587},{"type":"absolute","value":1699123829},{"type":"absolute","value":1699121789},{"type":"absolute","value":1699115646},{"type":"absolute","value":1699119742},{"type":"absolute","value":1699121792},{"type":"absolute","value":1699117699},{"type":"absolute","value":1699123847},{"type":"absolute","value":1699115656},{"type":"absolute","value":1699121800},{"type":"absolute","value":1699117706},{"type":"absolute","value":1699121803},{"type":"absolute","value":1699117709},{"type":"absolute","value":1699113621},{"type":"absolute","value":1699123862},{"type":"absolute","value":1699123866},{"type":"absolute","value":1699113631},{"type":"absolute","value":1699117727},{"type":"absolute","value":1699123873},{"type":"absolute","value":1699113634},{"type":"absolute","value":1699115684},{"type":"absolute","value":1699123877},{"type":"absolute","value":1699121830},{"type":"absolute","value":1699115687},{"type":"absolute","value":1699119788},{"type":"absolute","value":1699121836},{"type":"absolute","value":1699117742},{"type":"absolute","value":1699115695},{"type":"absolute","value":1699113649},{"type":"absolute","value":1699115698},{"type":"absolute","value":1699117746},{"type":"absolute","value":1699119798},{"type":"absolute","value":1699117753},{"type":"absolute","value":1699117757},{"type":"absolute","value":1699121855},{"type":"absolute","value":1699121858},{"type":"absolute","value":1699113668},{"type":"absolute","value":1699123911},{"type":"absolute","value":1699113677},{"type":"absolute","value":1699115725},{"type":"absolute","value":1699123921},{"type":"absolute","value":1699115731},{"type":"absolute","value":1699119829},{"type":"absolute","value":1699113687},{"type":"absolute","value":1699121882},{"type":"absolute","value":1699117791},{"type":"absolute","value":1699113697},{"type":"absolute","value":1699119841},{"type":"absolute","value":1699115750},{"type":"absolute","value":1699115753},{"type":"absolute","value":1699117801},{"type":"absolute","value":1699123949},{"type":"absolute","value":1699121902},{"type":"absolute","value":1699123952},{"type":"absolute","value":1699119859},{"type":"absolute","value":1699123960},{"type":"absolute","value":1699119866},{"type":"absolute","value":1699123963},{"type":"absolute","value":1699119869},{"type":"absolute","value":1699115774},{"type":"absolute","value":1699113729},{"type":"absolute","value":1699117829},{"type":"absolute","value":1699117832},{"type":"absolute","value":1699113739},{"type":"absolute","value":1699119887},{"type":"absolute","value":1699117840},{"type":"absolute","value":1699115794},{"type":"absolute","value":1699117843},{"type":"absolute","value":1699123990},{"type":"absolute","value":1699121948},{"type":"absolute","value":1699123996},{"type":"absolute","value":1699119902},{"type":"absolute","value":1699119906},{"type":"absolute","value":1699121958},{"type":"absolute","value":1699113767},{"type":"absolute","value":1699119913},{"type":"absolute","value":1699119917},{"type":"absolute","value":1699117870},{"type":"absolute","value":1699124015},{"type":"absolute","value":1699124018},{"type":"absolute","value":1699113779},{"type":"absolute","value":1699117876},{"type":"absolute","value":1699115840},{"type":"absolute","value":1699113797},{"type":"absolute","value":1699121989},{"type":"absolute","value":1699117895},{"type":"absolute","value":1699115850},{"type":"absolute","value":1699117898},{"type":"absolute","value":1699113804},{"type":"absolute","value":1699124042},{"type":"absolute","value":1699113807},{"type":"absolute","value":1699119951},{"type":"absolute","value":1699122001},{"type":"absolute","value":1699119961},{"type":"absolute","value":1699124062},{"type":"absolute","value":1699113825},{"type":"absolute","value":1699117922},{"type":"absolute","value":1699122019},{"type":"absolute","value":1699115878},{"type":"absolute","value":1699122026},{"type":"absolute","value":1699122029},{"type":"absolute","value":1699113840},{"type":"absolute","value":1699115890},{"type":"absolute","value":1699113844},{"type":"absolute","value":1699119989},{"type":"absolute","value":1699117942},{"type":"absolute","value":1699119992},{"type":"absolute","value":1699113851},{"type":"absolute","value":1699113855},{"type":"absolute","value":1699120000},{"type":"absolute","value":1699122047},{"type":"absolute","value":1699120003},{"type":"absolute","value":1699115908},{"type":"absolute","value":1699115915},{"type":"absolute","value":1699124108},{"type":"absolute","value":1699115918},{"type":"absolute","value":1699122062},{"type":"absolute","value":1699122066},{"type":"absolute","value":1699124118},{"type":"absolute","value":1699122073},{"type":"absolute","value":1699122077},{"type":"absolute","value":1699120030},{"type":"absolute","value":1699115936},{"type":"absolute","value":1699113889},{"type":"absolute","value":1699117988},{"type":"absolute","value":1699120036},{"type":"absolute","value":1699113899},{"type":"absolute","value":1699117998},{"type":"absolute","value":1699115951},{"type":"absolute","value":1699115955},{"type":"absolute","value":1699124149},{"type":"absolute","value":1699120055},{"type":"absolute","value":1699115962},{"type":"absolute","value":1699120058},{"type":"absolute","value":1699115966},{"type":"absolute","value":1699122111},{"type":"absolute","value":1699124161},{"type":"absolute","value":1699113927},{"type":"absolute","value":1699122121},{"type":"absolute","value":1699113930},{"type":"absolute","value":1699118029},{"type":"absolute","value":1699113938},{"type":"absolute","value":1699120082},{"type":"absolute","value":1699124179},{"type":"absolute","value":1699113941},{"type":"absolute","value":1699118041},{"type":"absolute","value":1699124186},{"type":"absolute","value":1699124189},{"type":"absolute","value":1699116000},{"type":"absolute","value":1699122149},{"type":"absolute","value":1699120102},{"type":"absolute","value":1699122152},{"type":"absolute","value":1699116010},{"type":"absolute","value":1699118059},{"type":"absolute","value":1699124207},{"type":"absolute","value":1699113968},{"type":"absolute","value":1699122160},{"type":"absolute","value":1699118066},{"type":"absolute","value":1699122163},{"type":"absolute","value":1699118069},{"type":"absolute","value":1699113974},{"type":"absolute","value":1699124222},{"type":"absolute","value":1699124226},{"type":"absolute","value":1699113990},{"type":"absolute","value":1699116038},{"type":"absolute","value":1699118087},{"type":"absolute","value":1699113993},{"type":"absolute","value":1699116041},{"type":"absolute","value":1699124233},{"type":"absolute","value":1699124237},{"type":"absolute","value":1699122190},{"type":"absolute","value":1699116049},{"type":"absolute","value":1699116052},{"type":"absolute","value":1699120148},{"type":"absolute","value":1699118102},{"type":"absolute","value":1699122196},{"type":"absolute","value":1699118106},{"type":"absolute","value":1699114013},{"type":"absolute","value":1699120158},{"type":"absolute","value":1699118113},{"type":"absolute","value":1699118117},{"type":"absolute","value":1699122215},{"type":"absolute","value":1699122218},{"type":"absolute","value":1699116079},{"type":"absolute","value":1699124271},{"type":"absolute","value":1699114033},{"type":"absolute","value":1699116085},{"type":"absolute","value":1699124281},{"type":"absolute","value":1699120189},{"type":"absolute","value":1699122242},{"type":"absolute","value":1699118151},{"type":"absolute","value":1699116104},{"type":"absolute","value":1699120201},{"type":"absolute","value":1699116107},{"type":"absolute","value":1699118161},{"type":"absolute","value":1699124309},{"type":"absolute","value":1699122262},{"type":"absolute","value":1699124312},{"type":"absolute","value":1699120219},{"type":"absolute","value":1699114079},{"type":"absolute","value":1699116128},{"type":"absolute","value":1699124320},{"type":"absolute","value":1699120226},{"type":"absolute","value":1699124323},{"type":"absolute","value":1699120229},{"type":"absolute","value":1699114089},{"type":"absolute","value":1699118189},{"type":"absolute","value":1699118192},{"type":"absolute","value":1699116148},{"type":"absolute","value":1699120247},{"type":"absolute","value":1699118200},{"type":"absolute","value":1699118203},{"type":"absolute","value":1699124350},{"type":"absolute","value":1699122308},{"type":"absolute","value":1699114117},{"type":"absolute","value":1699120262},{"type":"absolute","value":1699124356},{"type":"absolute","value":1699120266},{"type":"absolute","value":1699122318},{"type":"absolute","value":1699114129},{"type":"absolute","value":1699120273},{"type":"absolute","value":1699120277},{"type":"absolute","value":1699118230},{"type":"absolute","value":1699124375},{"type":"absolute","value":1699124378},{"type":"absolute","value":1699118236},{"type":"absolute","value":1699116194},{"type":"absolute","value":1699114147},{"type":"absolute","value":1699114154},{"type":"absolute","value":1699116204},{"type":"absolute","value":1699114157},{"type":"absolute","value":1699122349},{"type":"absolute","value":1699118255},{"type":"absolute","value":1699118258},{"type":"absolute","value":1699124402},{"type":"absolute","value":1699120311},{"type":"absolute","value":1699122361},{"type":"absolute","value":1699114175},{"type":"absolute","value":1699120321},{"type":"absolute","value":1699124422},{"type":"absolute","value":1699116232},{"type":"absolute","value":1699118282},{"type":"absolute","value":1699122379},{"type":"absolute","value":1699114190},{"type":"absolute","value":1699114194},{"type":"absolute","value":1699122386},{"type":"absolute","value":1699116244},{"type":"absolute","value":1699122389},{"type":"absolute","value":1699114201},{"type":"absolute","value":1699114205},{"type":"absolute","value":1699118302},{"type":"absolute","value":1699120349},{"type":"absolute","value":1699120352},{"type":"absolute","value":1699112161},{"type":"absolute","value":1699116262},{"type":"absolute","value":1699122407},{"type":"absolute","value":1699120360},{"type":"absolute","value":1699112171},{"type":"absolute","value":1699120363},{"type":"absolute","value":1699116269},{"type":"absolute","value":1699112174},{"type":"absolute","value":1699116272},{"type":"absolute","value":1699124468},{"type":"absolute","value":1699122422},{"type":"absolute","value":1699122426},{"type":"absolute","value":1699112189},{"type":"absolute","value":1699124478},{"type":"absolute","value":1699114239},{"type":"absolute","value":1699122433},{"type":"absolute","value":1699116290},{"type":"absolute","value":1699122437},{"type":"absolute","value":1699120390},{"type":"absolute","value":1699114249},{"type":"absolute","value":1699118348},{"type":"absolute","value":1699120396},{"type":"absolute","value":1699112208},{"type":"absolute","value":1699116305},{"type":"absolute","value":1699116309},{"type":"absolute","value":1699118358},{"type":"absolute","value":1699112217},{"type":"absolute","value":1699116316},{"type":"absolute","value":1699124509},{"type":"absolute","value":1699120415},{"type":"absolute","value":1699116320},{"type":"absolute","value":1699120418},{"type":"absolute","value":1699112227},{"type":"absolute","value":1699114277},{"type":"absolute","value":1699122471},{"type":"absolute","value":1699114280},{"type":"absolute","value":1699124521},{"type":"absolute","value":1699112237},{"type":"absolute","value":1699114288},{"type":"absolute","value":1699122481},{"type":"absolute","value":1699114291},{"type":"absolute","value":1699118389},{"type":"absolute","value":1699120442},{"type":"absolute","value":1699124539},{"type":"absolute","value":1699118401},{"type":"absolute","value":1699116354},{"type":"absolute","value":1699124546},{"type":"absolute","value":1699124549},{"type":"absolute","value":1699116364},{"type":"absolute","value":1699122509},{"type":"absolute","value":1699114318},{"type":"absolute","value":1699112271},{"type":"absolute","value":1699120462},{"type":"absolute","value":1699122512},{"type":"absolute","value":1699118419},{"type":"absolute","value":1699114324},{"type":"absolute","value":1699124567},{"type":"absolute","value":1699122520},{"type":"absolute","value":1699112281},{"type":"absolute","value":1699118426},{"type":"absolute","value":1699122523},{"type":"absolute","value":1699112284},{"type":"absolute","value":1699118429},{"type":"absolute","value":1699114340},{"type":"absolute","value":1699124582},{"type":"absolute","value":1699114343},{"type":"absolute","value":1699116392},{"type":"absolute","value":1699124586},{"type":"absolute","value":1699112299},{"type":"absolute","value":1699116395},{"type":"absolute","value":1699118447},{"type":"absolute","value":1699124593},{"type":"absolute","value":1699116403},{"type":"absolute","value":1699124597},{"type":"absolute","value":1699116406},{"type":"absolute","value":1699122550},{"type":"absolute","value":1699114364},{"type":"absolute","value":1699120508},{"type":"absolute","value":1699112318},{"type":"absolute","value":1699118462},{"type":"absolute","value":1699122556},{"type":"absolute","value":1699118466},{"type":"absolute","value":1699120518},{"type":"absolute","value":1699112327},{"type":"absolute","value":1699118473},{"type":"absolute","value":1699118477},{"type":"absolute","value":1699122575},{"type":"absolute","value":1699114384},{"type":"absolute","value":1699112337},{"type":"absolute","value":1699116433},{"type":"absolute","value":1699122578},{"type":"absolute","value":1699116439},{"type":"absolute","value":1699124631},{"type":"absolute","value":1699112347},{"type":"absolute","value":1699124641},{"type":"absolute","value":1699120549},{"type":"absolute","value":1699116458},{"type":"absolute","value":1699122602},{"type":"absolute","value":1699116461},{"type":"absolute","value":1699118511},{"type":"absolute","value":1699120561},{"type":"absolute","value":1699118521},{"type":"absolute","value":1699124669},{"type":"absolute","value":1699114430},{"type":"absolute","value":1699122622},{"type":"absolute","value":1699124672},{"type":"absolute","value":1699112386},{"type":"absolute","value":1699116482},{"type":"absolute","value":1699120579},{"type":"absolute","value":1699114440},{"type":"absolute","value":1699124680},{"type":"absolute","value":1699120586},{"type":"absolute","value":1699124683},{"type":"absolute","value":1699112396},{"type":"absolute","value":1699120589},{"type":"absolute","value":1699112399},{"type":"absolute","value":1699118549},{"type":"absolute","value":1699116502},{"type":"absolute","value":1699118552},{"type":"absolute","value":1699112414},{"type":"absolute","value":1699120607},{"type":"absolute","value":1699118560},{"type":"absolute","value":1699118563},{"type":"absolute","value":1699114468},{"type":"absolute","value":1699124710},{"type":"absolute","value":1699122668},{"type":"absolute","value":1699124716},{"type":"absolute","value":1699120622},{"type":"absolute","value":1699114480},{"type":"absolute","value":1699112433},{"type":"absolute","value":1699120626},{"type":"absolute","value":1699122678},{"type":"absolute","value":1699120633},{"type":"absolute","value":1699112442},{"type":"absolute","value":1699120637},{"type":"absolute","value":1699118590},{"type":"absolute","value":1699124735},{"type":"absolute","value":1699114498},{"type":"absolute","value":1699124738},{"type":"absolute","value":1699112452},{"type":"absolute","value":1699116548},{"type":"absolute","value":1699118596},{"type":"absolute","value":1699114505},{"type":"absolute","value":1699114508},{"type":"absolute","value":1699112462},{"type":"absolute","value":1699116558},{"type":"absolute","value":1699122709},{"type":"absolute","value":1699118615},{"type":"absolute","value":1699118618},{"type":"absolute","value":1699124762},{"type":"absolute","value":1699114526},{"type":"absolute","value":1699120671},{"type":"absolute","value":1699122721},{"type":"absolute","value":1699120681},{"type":"absolute","value":1699114541},{"type":"absolute","value":1699116589},{"type":"absolute","value":1699124782},{"type":"absolute","value":1699112496},{"type":"absolute","value":1699114545},{"type":"absolute","value":1699118642},{"type":"absolute","value":1699122739},{"type":"absolute","value":1699114552},{"type":"absolute","value":1699116601},{"type":"absolute","value":1699112506},{"type":"absolute","value":1699122746},{"type":"absolute","value":1699114556},{"type":"absolute","value":1699112509},{"type":"absolute","value":1699122749},{"type":"absolute","value":1699120709},{"type":"absolute","value":1699118662},{"type":"absolute","value":1699120712},{"type":"absolute","value":1699116619},{"type":"absolute","value":1699112524},{"type":"absolute","value":1699122767},{"type":"absolute","value":1699120720},{"type":"absolute","value":1699116626},{"type":"absolute","value":1699120723},{"type":"absolute","value":1699116629},{"type":"absolute","value":1699124828},{"type":"absolute","value":1699114590},{"type":"absolute","value":1699112543},{"type":"absolute","value":1699122782},{"type":"absolute","value":1699122786},{"type":"absolute","value":1699124838},{"type":"absolute","value":1699116647},{"type":"absolute","value":1699112552},{"type":"absolute","value":1699114600},{"type":"absolute","value":1699122793},{"type":"absolute","value":1699122797},{"type":"absolute","value":1699120750},{"type":"absolute","value":1699112562},{"type":"absolute","value":1699118708},{"type":"absolute","value":1699120756},{"type":"absolute","value":1699116662},{"type":"absolute","value":1699116666},{"type":"absolute","value":1699112572},{"type":"absolute","value":1699118718},{"type":"absolute","value":1699116673},{"type":"absolute","value":1699114628},{"type":"absolute","value":1699116677},{"type":"absolute","value":1699124869},{"type":"absolute","value":1699114631},{"type":"absolute","value":1699120775},{"type":"absolute","value":1699120778},{"type":"absolute","value":1699114639},{"type":"absolute","value":1699122831},{"type":"absolute","value":1699124881},{"type":"absolute","value":1699114642},{"type":"absolute","value":1699122841},{"type":"absolute","value":1699118749},{"type":"absolute","value":1699120802},{"type":"absolute","value":1699112611},{"type":"absolute","value":1699124899},{"type":"absolute","value":1699116711},{"type":"absolute","value":1699118761},{"type":"absolute","value":1699124906},{"type":"absolute","value":1699112621},{"type":"absolute","value":1699114669},{"type":"absolute","value":1699124909},{"type":"absolute","value":1699112624},{"type":"absolute","value":1699116721},{"type":"absolute","value":1699114675},{"type":"absolute","value":1699122869},{"type":"absolute","value":1699120822},{"type":"absolute","value":1699122872},{"type":"absolute","value":1699118779},{"type":"absolute","value":1699112639},{"type":"absolute","value":1699122880},{"type":"absolute","value":1699124927},{"type":"absolute","value":1699118786},{"type":"absolute","value":1699114691},{"type":"absolute","value":1699122883},{"type":"absolute","value":1699118789},{"type":"absolute","value":1699114694},{"type":"absolute","value":1699116749},{"type":"absolute","value":1699124942},{"type":"absolute","value":1699116752},{"type":"absolute","value":1699112658},{"type":"absolute","value":1699124946},{"type":"absolute","value":1699118807},{"type":"absolute","value":1699116760},{"type":"absolute","value":1699124953},{"type":"absolute","value":1699112667},{"type":"absolute","value":1699114715},{"type":"absolute","value":1699116763},{"type":"absolute","value":1699122910},{"type":"absolute","value":1699124957},{"type":"absolute","value":1699120868},{"type":"absolute","value":1699112677},{"type":"absolute","value":1699118822},{"type":"absolute","value":1699122916},{"type":"absolute","value":1699118826},{"type":"absolute","value":1699120878},{"type":"absolute","value":1699112687},{"type":"absolute","value":1699114735},{"type":"absolute","value":1699118833},{"type":"absolute","value":1699118837},{"type":"absolute","value":1699116790},{"type":"absolute","value":1699122935},{"type":"absolute","value":1699122938},{"type":"absolute","value":1699116796},{"type":"absolute","value":1699124991},{"type":"absolute","value":1699125001},{"type":"absolute","value":1699120909},{"type":"absolute","value":1699116815},{"type":"absolute","value":1699112721},{"type":"absolute","value":1699116818},{"type":"absolute","value":1699122962},{"type":"absolute","value":1699118871},{"type":"absolute","value":1699120921},{"type":"absolute","value":1699112731},{"type":"absolute","value":1699114781},{"type":"absolute","value":1699112734},{"type":"absolute","value":1699118881},{"type":"absolute","value":1699125029},{"type":"absolute","value":1699122982},{"type":"absolute","value":1699114791},{"type":"absolute","value":1699125032},{"type":"absolute","value":1699116842},{"type":"absolute","value":1699120939},{"type":"absolute","value":1699112749},{"type":"absolute","value":1699125040},{"type":"absolute","value":1699120946},{"type":"absolute","value":1699125043},{"type":"absolute","value":1699120949},{"type":"absolute","value":1699118909},{"type":"absolute","value":1699116862},{"type":"absolute","value":1699112768},{"type":"absolute","value":1699118912},{"type":"absolute","value":1699114819},{"type":"absolute","value":1699120967},{"type":"absolute","value":1699118920},{"type":"absolute","value":1699112777},{"type":"absolute","value":1699118923},{"type":"absolute","value":1699125070},{"type":"absolute","value":1699114831},{"type":"absolute","value":1699112787},{"type":"absolute","value":1699123028},{"type":"absolute","value":1699125076},{"type":"absolute","value":1699120982},{"type":"absolute","value":1699120986},{"type":"absolute","value":1699112797},{"type":"absolute","value":1699123038},{"type":"absolute","value":1699114849},{"type":"absolute","value":1699120993},{"type":"absolute","value":1699120997},{"type":"absolute","value":1699118950},{"type":"absolute","value":1699125095},{"type":"absolute","value":1699114856},{"type":"absolute","value":1699125098},{"type":"absolute","value":1699114859},{"type":"absolute","value":1699116908},{"type":"absolute","value":1699118956},{"type":"absolute","value":1699116918},{"type":"absolute","value":1699114877},{"type":"absolute","value":1699123069},{"type":"absolute","value":1699118975},{"type":"absolute","value":1699118978},{"type":"absolute","value":1699125122},{"type":"absolute","value":1699112836},{"type":"absolute","value":1699121031},{"type":"absolute","value":1699123081},{"type":"absolute","value":1699114892},{"type":"absolute","value":1699112846},{"type":"absolute","value":1699114896},{"type":"absolute","value":1699112849},{"type":"absolute","value":1699121041},{"type":"absolute","value":1699116949},{"type":"absolute","value":1699125142},{"type":"absolute","value":1699114903},{"type":"absolute","value":1699119002},{"type":"absolute","value":1699114907},{"type":"absolute","value":1699123099},{"type":"absolute","value":1699112864},{"type":"absolute","value":1699116961},{"type":"absolute","value":1699123106},{"type":"absolute","value":1699123109},{"type":"absolute","value":1699121069},{"type":"absolute","value":1699119022},{"type":"absolute","value":1699121072},{"type":"absolute","value":1699112883},{"type":"absolute","value":1699116979},{"type":"absolute","value":1699123127},{"type":"absolute","value":1699121080},{"type":"absolute","value":1699116986},{"type":"absolute","value":1699121083},{"type":"absolute","value":1699112892},{"type":"absolute","value":1699114941},{"type":"absolute","value":1699116989},{"type":"absolute","value":1699125182},{"type":"absolute","value":1699112902},{"type":"absolute","value":1699114951},{"type":"absolute","value":1699123142},{"type":"absolute","value":1699125192},{"type":"absolute","value":1699123146},{"type":"absolute","value":1699125195},{"type":"absolute","value":1699117007},{"type":"absolute","value":1699112912},{"type":"absolute","value":1699123153},{"type":"absolute","value":1699123157},{"type":"absolute","value":1699121110},{"type":"absolute","value":1699125210},{"type":"absolute","value":1699119068},{"type":"absolute","value":1699121116},{"type":"absolute","value":1699117022},{"type":"absolute","value":1699117026},{"type":"absolute","value":1699114979},{"type":"absolute","value":1699114982},{"type":"absolute","value":1699119078},{"type":"absolute","value":1699117033},{"type":"absolute","value":1699117037},{"type":"absolute","value":1699114990},{"type":"absolute","value":1699121135},{"type":"absolute","value":1699125229},{"type":"absolute","value":1699114993},{"type":"absolute","value":1699112946},{"type":"absolute","value":1699121138},{"type":"absolute","value":1699125238},{"type":"absolute","value":1699123191},{"type":"absolute","value":1699112956},{"type":"absolute","value":1699112959}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699126222},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699126222}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699135488},{"type":"absolute","value":1699137538},{"type":"absolute","value":1699127306},{"type":"absolute","value":1699133458},{"type":"absolute","value":1699127315},{"type":"absolute","value":1699131421},{"type":"absolute","value":1699127326},{"type":"absolute","value":1699129374},{"type":"absolute","value":1699135517},{"type":"absolute","value":1699131430},{"type":"absolute","value":1699127337},{"type":"absolute","value":1699129390},{"type":"absolute","value":1699133487},{"type":"absolute","value":1699135535},{"type":"absolute","value":1699131441},{"type":"absolute","value":1699133490},{"type":"absolute","value":1699137587},{"type":"absolute","value":1699129397},{"type":"absolute","value":1699131452},{"type":"absolute","value":1699137603},{"type":"absolute","value":1699135556},{"type":"absolute","value":1699137610},{"type":"absolute","value":1699127372},{"type":"absolute","value":1699129423},{"type":"absolute","value":1699133519},{"type":"absolute","value":1699135567},{"type":"absolute","value":1699127383},{"type":"absolute","value":1699127386},{"type":"absolute","value":1699137636},{"type":"absolute","value":1699127402},{"type":"absolute","value":1699129452},{"type":"absolute","value":1699131501},{"type":"absolute","value":1699135606},{"type":"absolute","value":1699131517},{"type":"absolute","value":1699127422},{"type":"absolute","value":1699129470},{"type":"absolute","value":1699133569},{"type":"absolute","value":1699137665},{"type":"absolute","value":1699131524},{"type":"absolute","value":1699127431},{"type":"absolute","value":1699133578},{"type":"absolute","value":1699127442},{"type":"absolute","value":1699129491},{"type":"absolute","value":1699135635},{"type":"absolute","value":1699133589},{"type":"absolute","value":1699135638},{"type":"absolute","value":1699137683},{"type":"absolute","value":1699127453},{"type":"absolute","value":1699129502},{"type":"absolute","value":1699131550},{"type":"absolute","value":1699133600},{"type":"absolute","value":1699137704},{"type":"absolute","value":1699135667},{"type":"absolute","value":1699137715},{"type":"absolute","value":1699131579},{"type":"absolute","value":1699127493},{"type":"absolute","value":1699129541},{"type":"absolute","value":1699131597},{"type":"absolute","value":1699127504},{"type":"absolute","value":1699133649},{"type":"absolute","value":1699127507},{"type":"absolute","value":1699137754},{"type":"absolute","value":1699129567},{"type":"absolute","value":1699133665},{"type":"absolute","value":1699129570},{"type":"absolute","value":1699127523},{"type":"absolute","value":1699131618},{"type":"absolute","value":1699135717},{"type":"absolute","value":1699133672},{"type":"absolute","value":1699131629},{"type":"absolute","value":1699135726},{"type":"absolute","value":1699127543},{"type":"absolute","value":1699137783},{"type":"absolute","value":1699135737},{"type":"absolute","value":1699137786},{"type":"absolute","value":1699129599},{"type":"absolute","value":1699127552},{"type":"absolute","value":1699133698},{"type":"absolute","value":1699135748},{"type":"absolute","value":1699127563},{"type":"absolute","value":1699131668},{"type":"absolute","value":1699127574},{"type":"absolute","value":1699137815},{"type":"absolute","value":1699133727},{"type":"absolute","value":1699129649},{"type":"absolute","value":1699131697},{"type":"absolute","value":1699133745},{"type":"absolute","value":1699131700},{"type":"absolute","value":1699135797},{"type":"absolute","value":1699127609},{"type":"absolute","value":1699129658},{"type":"absolute","value":1699127620},{"type":"absolute","value":1699129669},{"type":"absolute","value":1699133766},{"type":"absolute","value":1699127623},{"type":"absolute","value":1699135813},{"type":"absolute","value":1699137865},{"type":"absolute","value":1699135820},{"type":"absolute","value":1699129680},{"type":"absolute","value":1699131729},{"type":"absolute","value":1699133777},{"type":"absolute","value":1699137874},{"type":"absolute","value":1699127639},{"type":"absolute","value":1699137885},{"type":"absolute","value":1699135846},{"type":"absolute","value":1699137896},{"type":"absolute","value":1699127659},{"type":"absolute","value":1699127668},{"type":"absolute","value":1699133816},{"type":"absolute","value":1699129726},{"type":"absolute","value":1699127679},{"type":"absolute","value":1699131779},{"type":"absolute","value":1699135875},{"type":"absolute","value":1699127690},{"type":"absolute","value":1699131788},{"type":"absolute","value":1699129742},{"type":"absolute","value":1699129749},{"type":"absolute","value":1699133845},{"type":"absolute","value":1699131799},{"type":"absolute","value":1699133848},{"type":"absolute","value":1699135893},{"type":"absolute","value":1699137945},{"type":"absolute","value":1699131810},{"type":"absolute","value":1699137961},{"type":"absolute","value":1699135914},{"type":"absolute","value":1699129775},{"type":"absolute","value":1699137968},{"type":"absolute","value":1699127730},{"type":"absolute","value":1699133877},{"type":"absolute","value":1699135925},{"type":"absolute","value":1699127741},{"type":"absolute","value":1699127744},{"type":"absolute","value":1699137994},{"type":"absolute","value":1699129804},{"type":"absolute","value":1699127760},{"type":"absolute","value":1699131859},{"type":"absolute","value":1699135964},{"type":"absolute","value":1699129822},{"type":"absolute","value":1699131875},{"type":"absolute","value":1699127780},{"type":"absolute","value":1699133927},{"type":"absolute","value":1699138023},{"type":"absolute","value":1699131882},{"type":"absolute","value":1699127789},{"type":"absolute","value":1699133936},{"type":"absolute","value":1699129843},{"type":"absolute","value":1699127800},{"type":"absolute","value":1699135993},{"type":"absolute","value":1699138041},{"type":"absolute","value":1699133947},{"type":"absolute","value":1699135996},{"type":"absolute","value":1699129854},{"type":"absolute","value":1699127811},{"type":"absolute","value":1699131908},{"type":"absolute","value":1699133958},{"type":"absolute","value":1699138062},{"type":"absolute","value":1699136025},{"type":"absolute","value":1699138073},{"type":"absolute","value":1699131937},{"type":"absolute","value":1699129893},{"type":"absolute","value":1699127846},{"type":"absolute","value":1699127857},{"type":"absolute","value":1699131955},{"type":"absolute","value":1699127860},{"type":"absolute","value":1699134007},{"type":"absolute","value":1699129919},{"type":"absolute","value":1699138112},{"type":"absolute","value":1699129922},{"type":"absolute","value":1699127876},{"type":"absolute","value":1699134023},{"type":"absolute","value":1699131976},{"type":"absolute","value":1699136075},{"type":"absolute","value":1699134030},{"type":"absolute","value":1699131987},{"type":"absolute","value":1699136084},{"type":"absolute","value":1699127896},{"type":"absolute","value":1699138141},{"type":"absolute","value":1699129951},{"type":"absolute","value":1699136095},{"type":"absolute","value":1699127905},{"type":"absolute","value":1699138144},{"type":"absolute","value":1699134056},{"type":"absolute","value":1699136106},{"type":"absolute","value":1699127916},{"type":"absolute","value":1699127927},{"type":"absolute","value":1699132026},{"type":"absolute","value":1699138173},{"type":"absolute","value":1699134085},{"type":"absolute","value":1699130001},{"type":"absolute","value":1699132055},{"type":"absolute","value":1699134103},{"type":"absolute","value":1699130010},{"type":"absolute","value":1699132058},{"type":"absolute","value":1699136155},{"type":"absolute","value":1699130021},{"type":"absolute","value":1699127979},{"type":"absolute","value":1699134124},{"type":"absolute","value":1699136171},{"type":"absolute","value":1699138223},{"type":"absolute","value":1699130032},{"type":"absolute","value":1699136178},{"type":"absolute","value":1699132087},{"type":"absolute","value":1699134135},{"type":"absolute","value":1699138232},{"type":"absolute","value":1699127995},{"type":"absolute","value":1699128002},{"type":"absolute","value":1699138243},{"type":"absolute","value":1699136204},{"type":"absolute","value":1699138254},{"type":"absolute","value":1699128028},{"type":"absolute","value":1699130078},{"type":"absolute","value":1699134174},{"type":"absolute","value":1699132137},{"type":"absolute","value":1699136233},{"type":"absolute","value":1699130094},{"type":"absolute","value":1699132146},{"type":"absolute","value":1699130101},{"type":"absolute","value":1699128057},{"type":"absolute","value":1699134203},{"type":"absolute","value":1699136251},{"type":"absolute","value":1699132157},{"type":"absolute","value":1699134206},{"type":"absolute","value":1699138303},{"type":"absolute","value":1699132168},{"type":"absolute","value":1699128075},{"type":"absolute","value":1699130127},{"type":"absolute","value":1699136272},{"type":"absolute","value":1699138319},{"type":"absolute","value":1699138326},{"type":"absolute","value":1699134235},{"type":"absolute","value":1699136283},{"type":"absolute","value":1699128096},{"type":"absolute","value":1699128107},{"type":"absolute","value":1699130156},{"type":"absolute","value":1699138352},{"type":"absolute","value":1699132217},{"type":"absolute","value":1699130174},{"type":"absolute","value":1699136322},{"type":"absolute","value":1699132233},{"type":"absolute","value":1699134285},{"type":"absolute","value":1699138381},{"type":"absolute","value":1699132240},{"type":"absolute","value":1699128146},{"type":"absolute","value":1699130195},{"type":"absolute","value":1699134294},{"type":"absolute","value":1699130206},{"type":"absolute","value":1699136351},{"type":"absolute","value":1699138399},{"type":"absolute","value":1699134305},{"type":"absolute","value":1699136354},{"type":"absolute","value":1699128168},{"type":"absolute","value":1699132266},{"type":"absolute","value":1699128171},{"type":"absolute","value":1699134316},{"type":"absolute","value":1699138420},{"type":"absolute","value":1699136383},{"type":"absolute","value":1699138431},{"type":"absolute","value":1699130245},{"type":"absolute","value":1699132295},{"type":"absolute","value":1699128200},{"type":"absolute","value":1699132313},{"type":"absolute","value":1699134365},{"type":"absolute","value":1699130271},{"type":"absolute","value":1699130274},{"type":"absolute","value":1699138470},{"type":"absolute","value":1699134381},{"type":"absolute","value":1699132334},{"type":"absolute","value":1699136433},{"type":"absolute","value":1699134388},{"type":"absolute","value":1699132345},{"type":"absolute","value":1699128250},{"type":"absolute","value":1699136442},{"type":"absolute","value":1699130303},{"type":"absolute","value":1699128259},{"type":"absolute","value":1699138499},{"type":"absolute","value":1699136453},{"type":"absolute","value":1699138502},{"type":"absolute","value":1699128270},{"type":"absolute","value":1699134414},{"type":"absolute","value":1699136464},{"type":"absolute","value":1699128281},{"type":"absolute","value":1699132384},{"type":"absolute","value":1699138531},{"type":"absolute","value":1699134443},{"type":"absolute","value":1699130353},{"type":"absolute","value":1699130362},{"type":"absolute","value":1699134461},{"type":"absolute","value":1699132413},{"type":"absolute","value":1699132416},{"type":"absolute","value":1699136513},{"type":"absolute","value":1699130373},{"type":"absolute","value":1699128327},{"type":"absolute","value":1699130384},{"type":"absolute","value":1699136529},{"type":"absolute","value":1699134482},{"type":"absolute","value":1699138581},{"type":"absolute","value":1699128343},{"type":"absolute","value":1699136536},{"type":"absolute","value":1699132445},{"type":"absolute","value":1699128350},{"type":"absolute","value":1699134493},{"type":"absolute","value":1699138590},{"type":"absolute","value":1699126308},{"type":"absolute","value":1699138601},{"type":"absolute","value":1699126319},{"type":"absolute","value":1699126322},{"type":"absolute","value":1699136562},{"type":"absolute","value":1699138612},{"type":"absolute","value":1699128376},{"type":"absolute","value":1699130430},{"type":"absolute","value":1699126338},{"type":"absolute","value":1699134532},{"type":"absolute","value":1699130446},{"type":"absolute","value":1699132495},{"type":"absolute","value":1699136591},{"type":"absolute","value":1699128405},{"type":"absolute","value":1699126358},{"type":"absolute","value":1699130453},{"type":"absolute","value":1699132504},{"type":"absolute","value":1699126367},{"type":"absolute","value":1699134561},{"type":"absolute","value":1699136609},{"type":"absolute","value":1699132515},{"type":"absolute","value":1699134564},{"type":"absolute","value":1699138661},{"type":"absolute","value":1699128423},{"type":"absolute","value":1699126378},{"type":"absolute","value":1699132526},{"type":"absolute","value":1699130479},{"type":"absolute","value":1699126389},{"type":"absolute","value":1699136630},{"type":"absolute","value":1699138677},{"type":"absolute","value":1699128444},{"type":"absolute","value":1699138684},{"type":"absolute","value":1699134593},{"type":"absolute","value":1699136641},{"type":"absolute","value":1699128455},{"type":"absolute","value":1699130508},{"type":"absolute","value":1699138710},{"type":"absolute","value":1699126424},{"type":"absolute","value":1699130526},{"type":"absolute","value":1699132575},{"type":"absolute","value":1699126435},{"type":"absolute","value":1699126438},{"type":"absolute","value":1699136680},{"type":"absolute","value":1699128494},{"type":"absolute","value":1699132591},{"type":"absolute","value":1699130547},{"type":"absolute","value":1699134643},{"type":"absolute","value":1699138739},{"type":"absolute","value":1699126454},{"type":"absolute","value":1699132598},{"type":"absolute","value":1699134652},{"type":"absolute","value":1699130558},{"type":"absolute","value":1699128517},{"type":"absolute","value":1699136709},{"type":"absolute","value":1699134663},{"type":"absolute","value":1699128520},{"type":"absolute","value":1699136712},{"type":"absolute","value":1699126474},{"type":"absolute","value":1699138757},{"type":"absolute","value":1699132624},{"type":"absolute","value":1699134674},{"type":"absolute","value":1699126483},{"type":"absolute","value":1699138778},{"type":"absolute","value":1699126494},{"type":"absolute","value":1699128549},{"type":"absolute","value":1699130597},{"type":"absolute","value":1699136741},{"type":"absolute","value":1699138789},{"type":"absolute","value":1699126505},{"type":"absolute","value":1699132653},{"type":"absolute","value":1699130623},{"type":"absolute","value":1699132671},{"type":"absolute","value":1699130626},{"type":"absolute","value":1699134723},{"type":"absolute","value":1699138828},{"type":"absolute","value":1699126545},{"type":"absolute","value":1699134739},{"type":"absolute","value":1699132692},{"type":"absolute","value":1699128599},{"type":"absolute","value":1699136791},{"type":"absolute","value":1699134746},{"type":"absolute","value":1699126556},{"type":"absolute","value":1699126559},{"type":"absolute","value":1699128608},{"type":"absolute","value":1699130655},{"type":"absolute","value":1699132703},{"type":"absolute","value":1699136800},{"type":"absolute","value":1699138857},{"type":"absolute","value":1699128619},{"type":"absolute","value":1699136811},{"type":"absolute","value":1699138860},{"type":"absolute","value":1699126575},{"type":"absolute","value":1699134772},{"type":"absolute","value":1699128630},{"type":"absolute","value":1699136822},{"type":"absolute","value":1699126595},{"type":"absolute","value":1699132742},{"type":"absolute","value":1699138889},{"type":"absolute","value":1699126604},{"type":"absolute","value":1699130705},{"type":"absolute","value":1699134801},{"type":"absolute","value":1699126615},{"type":"absolute","value":1699130714},{"type":"absolute","value":1699126626},{"type":"absolute","value":1699132771},{"type":"absolute","value":1699128676},{"type":"absolute","value":1699130725},{"type":"absolute","value":1699132774},{"type":"absolute","value":1699134819},{"type":"absolute","value":1699136871},{"type":"absolute","value":1699130736},{"type":"absolute","value":1699128692},{"type":"absolute","value":1699136887},{"type":"absolute","value":1699134840},{"type":"absolute","value":1699128699},{"type":"absolute","value":1699138939},{"type":"absolute","value":1699136894},{"type":"absolute","value":1699132803},{"type":"absolute","value":1699134851},{"type":"absolute","value":1699126661},{"type":"absolute","value":1699138948},{"type":"absolute","value":1699138959},{"type":"absolute","value":1699126672},{"type":"absolute","value":1699126675},{"type":"absolute","value":1699128725},{"type":"absolute","value":1699136920},{"type":"absolute","value":1699138970},{"type":"absolute","value":1699130785},{"type":"absolute","value":1699126691},{"type":"absolute","value":1699134890},{"type":"absolute","value":1699130801},{"type":"absolute","value":1699128754},{"type":"absolute","value":1699132853},{"type":"absolute","value":1699136949},{"type":"absolute","value":1699126711},{"type":"absolute","value":1699130808},{"type":"absolute","value":1699132862},{"type":"absolute","value":1699126720},{"type":"absolute","value":1699128772},{"type":"absolute","value":1699134919},{"type":"absolute","value":1699136967},{"type":"absolute","value":1699132873},{"type":"absolute","value":1699134922},{"type":"absolute","value":1699126731},{"type":"absolute","value":1699139019},{"type":"absolute","value":1699130834},{"type":"absolute","value":1699132884},{"type":"absolute","value":1699126742},{"type":"absolute","value":1699128793},{"type":"absolute","value":1699139035},{"type":"absolute","value":1699136988},{"type":"absolute","value":1699139042},{"type":"absolute","value":1699128804},{"type":"absolute","value":1699134951},{"type":"absolute","value":1699136999},{"type":"absolute","value":1699130863},{"type":"absolute","value":1699139068},{"type":"absolute","value":1699126782},{"type":"absolute","value":1699130881},{"type":"absolute","value":1699132933},{"type":"absolute","value":1699126793},{"type":"absolute","value":1699128843},{"type":"absolute","value":1699126796},{"type":"absolute","value":1699137038},{"type":"absolute","value":1699132949},{"type":"absolute","value":1699130902},{"type":"absolute","value":1699135001},{"type":"absolute","value":1699139097},{"type":"absolute","value":1699126812},{"type":"absolute","value":1699132956},{"type":"absolute","value":1699130913},{"type":"absolute","value":1699128866},{"type":"absolute","value":1699135010},{"type":"absolute","value":1699128869},{"type":"absolute","value":1699137067},{"type":"absolute","value":1699139115},{"type":"absolute","value":1699135021},{"type":"absolute","value":1699137070},{"type":"absolute","value":1699126832},{"type":"absolute","value":1699132982},{"type":"absolute","value":1699135032},{"type":"absolute","value":1699126841},{"type":"absolute","value":1699139136},{"type":"absolute","value":1699128898},{"type":"absolute","value":1699126852},{"type":"absolute","value":1699130952},{"type":"absolute","value":1699137099},{"type":"absolute","value":1699139147},{"type":"absolute","value":1699126863},{"type":"absolute","value":1699133011},{"type":"absolute","value":1699130981},{"type":"absolute","value":1699133029},{"type":"absolute","value":1699130984},{"type":"absolute","value":1699135081},{"type":"absolute","value":1699126898},{"type":"absolute","value":1699139186},{"type":"absolute","value":1699128948},{"type":"absolute","value":1699135097},{"type":"absolute","value":1699133050},{"type":"absolute","value":1699126909},{"type":"absolute","value":1699128957},{"type":"absolute","value":1699137149},{"type":"absolute","value":1699126912},{"type":"absolute","value":1699135104},{"type":"absolute","value":1699131013},{"type":"absolute","value":1699133061},{"type":"absolute","value":1699137158},{"type":"absolute","value":1699128968},{"type":"absolute","value":1699139215},{"type":"absolute","value":1699126928},{"type":"absolute","value":1699137169},{"type":"absolute","value":1699139218},{"type":"absolute","value":1699128979},{"type":"absolute","value":1699135130},{"type":"absolute","value":1699137180},{"type":"absolute","value":1699126948},{"type":"absolute","value":1699133100},{"type":"absolute","value":1699126957},{"type":"absolute","value":1699139247},{"type":"absolute","value":1699131063},{"type":"absolute","value":1699126968},{"type":"absolute","value":1699135159},{"type":"absolute","value":1699131072},{"type":"absolute","value":1699129025},{"type":"absolute","value":1699126979},{"type":"absolute","value":1699133129},{"type":"absolute","value":1699135177},{"type":"absolute","value":1699131083},{"type":"absolute","value":1699133132},{"type":"absolute","value":1699137229},{"type":"absolute","value":1699129041},{"type":"absolute","value":1699131094},{"type":"absolute","value":1699129048},{"type":"absolute","value":1699137245},{"type":"absolute","value":1699135198},{"type":"absolute","value":1699139297},{"type":"absolute","value":1699137252},{"type":"absolute","value":1699133161},{"type":"absolute","value":1699135209},{"type":"absolute","value":1699127019},{"type":"absolute","value":1699139306},{"type":"absolute","value":1699129074},{"type":"absolute","value":1699139317},{"type":"absolute","value":1699127030},{"type":"absolute","value":1699127033},{"type":"absolute","value":1699137278},{"type":"absolute","value":1699139328},{"type":"absolute","value":1699131143},{"type":"absolute","value":1699127049},{"type":"absolute","value":1699129103},{"type":"absolute","value":1699135248},{"type":"absolute","value":1699139349},{"type":"absolute","value":1699131159},{"type":"absolute","value":1699133211},{"type":"absolute","value":1699137307},{"type":"absolute","value":1699127069},{"type":"absolute","value":1699131166},{"type":"absolute","value":1699139360},{"type":"absolute","value":1699129121},{"type":"absolute","value":1699139363},{"type":"absolute","value":1699133220},{"type":"absolute","value":1699127078},{"type":"absolute","value":1699135277},{"type":"absolute","value":1699137325},{"type":"absolute","value":1699133231},{"type":"absolute","value":1699135280},{"type":"absolute","value":1699127089},{"type":"absolute","value":1699139379},{"type":"absolute","value":1699129142},{"type":"absolute","value":1699131192},{"type":"absolute","value":1699133242},{"type":"absolute","value":1699127100},{"type":"absolute","value":1699129153},{"type":"absolute","value":1699137346},{"type":"absolute","value":1699139399},{"type":"absolute","value":1699135309},{"type":"absolute","value":1699137357},{"type":"absolute","value":1699139408},{"type":"absolute","value":1699131221},{"type":"absolute","value":1699139419},{"type":"absolute","value":1699127135},{"type":"absolute","value":1699139430},{"type":"absolute","value":1699131239},{"type":"absolute","value":1699129192},{"type":"absolute","value":1699127146},{"type":"absolute","value":1699133291},{"type":"absolute","value":1699127149},{"type":"absolute","value":1699137396},{"type":"absolute","value":1699133307},{"type":"absolute","value":1699131260},{"type":"absolute","value":1699127165},{"type":"absolute","value":1699139451},{"type":"absolute","value":1699129215},{"type":"absolute","value":1699135359},{"type":"absolute","value":1699129218},{"type":"absolute","value":1699133314},{"type":"absolute","value":1699139462},{"type":"absolute","value":1699131271},{"type":"absolute","value":1699135368},{"type":"absolute","value":1699139465},{"type":"absolute","value":1699127185},{"type":"absolute","value":1699137425},{"type":"absolute","value":1699135379},{"type":"absolute","value":1699137428},{"type":"absolute","value":1699139481},{"type":"absolute","value":1699127194},{"type":"absolute","value":1699133340},{"type":"absolute","value":1699135390},{"type":"absolute","value":1699129247},{"type":"absolute","value":1699127205},{"type":"absolute","value":1699139501},{"type":"absolute","value":1699131310},{"type":"absolute","value":1699127216},{"type":"absolute","value":1699137457},{"type":"absolute","value":1699139510},{"type":"absolute","value":1699133369},{"type":"absolute","value":1699139521},{"type":"absolute","value":1699131339},{"type":"absolute","value":1699133387},{"type":"absolute","value":1699139532},{"type":"absolute","value":1699131342},{"type":"absolute","value":1699135439},{"type":"absolute","value":1699129297},{"type":"absolute","value":1699127256},{"type":"absolute","value":1699129306},{"type":"absolute","value":1699135455},{"type":"absolute","value":1699133408},{"type":"absolute","value":1699127267},{"type":"absolute","value":1699137507},{"type":"absolute","value":1699129317},{"type":"absolute","value":1699127270},{"type":"absolute","value":1699135462},{"type":"absolute","value":1699131371},{"type":"absolute","value":1699133419},{"type":"absolute","value":1699137516},{"type":"absolute","value":1699129328},{"type":"absolute","value":1699127286},{"type":"absolute","value":1699137527}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699140544},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699140544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699142145},{"type":"absolute","value":1699141128},{"type":"absolute","value":1699142923},{"type":"absolute","value":1699141390},{"type":"absolute","value":1699142926},{"type":"absolute","value":1699141393},{"type":"absolute","value":1699142163},{"type":"absolute","value":1699140632},{"type":"absolute","value":1699141402},{"type":"absolute","value":1699140635},{"type":"absolute","value":1699142172},{"type":"absolute","value":1699142938},{"type":"absolute","value":1699142175},{"type":"absolute","value":1699142950},{"type":"absolute","value":1699140647},{"type":"absolute","value":1699142184},{"type":"absolute","value":1699141420},{"type":"absolute","value":1699141429},{"type":"absolute","value":1699140662},{"type":"absolute","value":1699141685},{"type":"absolute","value":1699141432},{"type":"absolute","value":1699141688},{"type":"absolute","value":1699142457},{"type":"absolute","value":1699142454},{"type":"absolute","value":1699140926},{"type":"absolute","value":1699140671},{"type":"absolute","value":1699140674},{"type":"absolute","value":1699142469},{"type":"absolute","value":1699140935},{"type":"absolute","value":1699141706},{"type":"absolute","value":1699141709},{"type":"absolute","value":1699142484},{"type":"absolute","value":1699140953},{"type":"absolute","value":1699141721},{"type":"absolute","value":1699142748},{"type":"absolute","value":1699142493},{"type":"absolute","value":1699142496},{"type":"absolute","value":1699140962},{"type":"absolute","value":1699140965},{"type":"absolute","value":1699141733},{"type":"absolute","value":1699142757},{"type":"absolute","value":1699141995},{"type":"absolute","value":1699140974},{"type":"absolute","value":1699141998},{"type":"absolute","value":1699141237},{"type":"absolute","value":1699142007},{"type":"absolute","value":1699141240},{"type":"absolute","value":1699142775},{"type":"absolute","value":1699142784},{"type":"absolute","value":1699142787},{"type":"absolute","value":1699141252},{"type":"absolute","value":1699142025},{"type":"absolute","value":1699142796},{"type":"absolute","value":1699142034},{"type":"absolute","value":1699141267},{"type":"absolute","value":1699142290},{"type":"absolute","value":1699142037},{"type":"absolute","value":1699142293},{"type":"absolute","value":1699141531},{"type":"absolute","value":1699141276},{"type":"absolute","value":1699141116},{"type":"absolute","value":1699141279},{"type":"absolute","value":1699141540},{"type":"absolute","value":1699142311},{"type":"absolute","value":1699142314},{"type":"absolute","value":1699140785},{"type":"absolute","value":1699140788},{"type":"absolute","value":1699141558},{"type":"absolute","value":1699142326},{"type":"absolute","value":1699140797},{"type":"absolute","value":1699142649},{"type":"absolute","value":1699141567},{"type":"absolute","value":1699141570},{"type":"absolute","value":1699142338},{"type":"absolute","value":1699142905},{"type":"absolute","value":1699141579},{"type":"absolute","value":1699140815},{"type":"absolute","value":1699142607},{"type":"absolute","value":1699141842},{"type":"absolute","value":1699142610},{"type":"absolute","value":1699141845},{"type":"absolute","value":1699140824},{"type":"absolute","value":1699141080},{"type":"absolute","value":1699140827},{"type":"absolute","value":1699141083},{"type":"absolute","value":1699142619},{"type":"absolute","value":1699141857},{"type":"absolute","value":1699141101},{"type":"absolute","value":1699142637},{"type":"absolute","value":1699141104},{"type":"absolute","value":1699141872},{"type":"absolute","value":1699142646},{"type":"absolute","value":1699142902},{"type":"absolute","value":1699142136},{"type":"absolute","value":1699141881},{"type":"absolute","value":1699141884}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699142992},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699142992}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699143041},{"type":"absolute","value":1699143170},{"type":"absolute","value":1699143558},{"type":"absolute","value":1699143688},{"type":"absolute","value":1699143434},{"type":"absolute","value":1699143053},{"type":"absolute","value":1699143437},{"type":"absolute","value":1699143570},{"type":"absolute","value":1699143316},{"type":"absolute","value":1699143319},{"type":"absolute","value":1699143449},{"type":"absolute","value":1699143069},{"type":"absolute","value":1699143458},{"type":"absolute","value":1699143587},{"type":"absolute","value":1699143334},{"type":"absolute","value":1699143470},{"type":"absolute","value":1699143215},{"type":"absolute","value":1699143343},{"type":"absolute","value":1699143218},{"type":"absolute","value":1699143733},{"type":"absolute","value":1699143736},{"type":"absolute","value":1699143355},{"type":"absolute","value":1699143486},{"type":"absolute","value":1699143233},{"type":"absolute","value":1699143751},{"type":"absolute","value":1699143114},{"type":"absolute","value":1699143242},{"type":"absolute","value":1699143372},{"type":"absolute","value":1699143117},{"type":"absolute","value":1699143632},{"type":"absolute","value":1699143760},{"type":"absolute","value":1699143635},{"type":"absolute","value":1699143254},{"type":"absolute","value":1699143132},{"type":"absolute","value":1699143772},{"type":"absolute","value":1699143650},{"type":"absolute","value":1699143141},{"type":"absolute","value":1699143271},{"type":"absolute","value":1699143017},{"type":"absolute","value":1699143531},{"type":"absolute","value":1699143020},{"type":"absolute","value":1699143659},{"type":"absolute","value":1699143534},{"type":"absolute","value":1699143789},{"type":"absolute","value":1699143153},{"type":"absolute","value":1699143671},{"type":"absolute","value":1699143032},{"type":"absolute","value":1699143549}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699188240},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699188240}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699188745},{"type":"absolute","value":1699191819},{"type":"absolute","value":1699189772},{"type":"absolute","value":1699189778},{"type":"absolute","value":1699188755},{"type":"absolute","value":1699190820},{"type":"absolute","value":1699189797},{"type":"absolute","value":1699191845},{"type":"absolute","value":1699190823},{"type":"absolute","value":1699191848},{"type":"absolute","value":1699189801},{"type":"absolute","value":1699190826},{"type":"absolute","value":1699188780},{"type":"absolute","value":1699189804},{"type":"absolute","value":1699191855},{"type":"absolute","value":1699191858},{"type":"absolute","value":1699191862},{"type":"absolute","value":1699189815},{"type":"absolute","value":1699189825},{"type":"absolute","value":1699188804},{"type":"absolute","value":1699191891},{"type":"absolute","value":1699191893},{"type":"absolute","value":1699189848},{"type":"absolute","value":1699189851},{"type":"absolute","value":1699191900},{"type":"absolute","value":1699188829},{"type":"absolute","value":1699189854},{"type":"absolute","value":1699190877},{"type":"absolute","value":1699190886},{"type":"absolute","value":1699190888},{"type":"absolute","value":1699191912},{"type":"absolute","value":1699189866},{"type":"absolute","value":1699191914},{"type":"absolute","value":1699191918},{"type":"absolute","value":1699191922},{"type":"absolute","value":1699188851},{"type":"absolute","value":1699189877},{"type":"absolute","value":1699191927},{"type":"absolute","value":1699189900},{"type":"absolute","value":1699191948},{"type":"absolute","value":1699188878},{"type":"absolute","value":1699189904},{"type":"absolute","value":1699189906},{"type":"absolute","value":1699188893},{"type":"absolute","value":1699189918},{"type":"absolute","value":1699191974},{"type":"absolute","value":1699190953},{"type":"absolute","value":1699190956},{"type":"absolute","value":1699189933},{"type":"absolute","value":1699190959},{"type":"absolute","value":1699188916},{"type":"absolute","value":1699188919},{"type":"absolute","value":1699189952},{"type":"absolute","value":1699189955},{"type":"absolute","value":1699188935},{"type":"absolute","value":1699192007},{"type":"absolute","value":1699190985},{"type":"absolute","value":1699189962},{"type":"absolute","value":1699192010},{"type":"absolute","value":1699189965},{"type":"absolute","value":1699190990},{"type":"absolute","value":1699189970},{"type":"absolute","value":1699190995},{"type":"absolute","value":1699192021},{"type":"absolute","value":1699192024},{"type":"absolute","value":1699192034},{"type":"absolute","value":1699188965},{"type":"absolute","value":1699192037},{"type":"absolute","value":1699188974},{"type":"absolute","value":1699189999},{"type":"absolute","value":1699190007},{"type":"absolute","value":1699190014},{"type":"absolute","value":1699188995},{"type":"absolute","value":1699188998},{"type":"absolute","value":1699190025},{"type":"absolute","value":1699191051},{"type":"absolute","value":1699190028},{"type":"absolute","value":1699192076},{"type":"absolute","value":1699189007},{"type":"absolute","value":1699192082},{"type":"absolute","value":1699192093},{"type":"absolute","value":1699189028},{"type":"absolute","value":1699190055},{"type":"absolute","value":1699190058},{"type":"absolute","value":1699192109},{"type":"absolute","value":1699190062},{"type":"absolute","value":1699191086},{"type":"absolute","value":1699191089},{"type":"absolute","value":1699189047},{"type":"absolute","value":1699190073},{"type":"absolute","value":1699189050},{"type":"absolute","value":1699192123},{"type":"absolute","value":1699189052},{"type":"absolute","value":1699192126},{"type":"absolute","value":1699189060},{"type":"absolute","value":1699192132},{"type":"absolute","value":1699192137},{"type":"absolute","value":1699190093},{"type":"absolute","value":1699192150},{"type":"absolute","value":1699190104},{"type":"absolute","value":1699190107},{"type":"absolute","value":1699189086},{"type":"absolute","value":1699190115},{"type":"absolute","value":1699189101},{"type":"absolute","value":1699192174},{"type":"absolute","value":1699189104},{"type":"absolute","value":1699192177},{"type":"absolute","value":1699190130},{"type":"absolute","value":1699190133},{"type":"absolute","value":1699189110},{"type":"absolute","value":1699190136},{"type":"absolute","value":1699190141},{"type":"absolute","value":1699192191},{"type":"absolute","value":1699190144},{"type":"absolute","value":1699191169},{"type":"absolute","value":1699189122},{"type":"absolute","value":1699191172},{"type":"absolute","value":1699190150},{"type":"absolute","value":1699192203},{"type":"absolute","value":1699191183},{"type":"absolute","value":1699190164},{"type":"absolute","value":1699189143},{"type":"absolute","value":1699190167},{"type":"absolute","value":1699192218},{"type":"absolute","value":1699189158},{"type":"absolute","value":1699192230},{"type":"absolute","value":1699189161},{"type":"absolute","value":1699189163},{"type":"absolute","value":1699192236},{"type":"absolute","value":1699189169},{"type":"absolute","value":1699192243},{"type":"absolute","value":1699192246},{"type":"absolute","value":1699191225},{"type":"absolute","value":1699189184},{"type":"absolute","value":1699191234},{"type":"absolute","value":1699191242},{"type":"absolute","value":1699192267},{"type":"absolute","value":1699190225},{"type":"absolute","value":1699190228},{"type":"absolute","value":1699190230},{"type":"absolute","value":1699192278},{"type":"absolute","value":1699190233},{"type":"absolute","value":1699192281},{"type":"absolute","value":1699192284},{"type":"absolute","value":1699189216},{"type":"absolute","value":1699189219},{"type":"absolute","value":1699192291},{"type":"absolute","value":1699190245},{"type":"absolute","value":1699192294},{"type":"absolute","value":1699189224},{"type":"absolute","value":1699190263},{"type":"absolute","value":1699189241},{"type":"absolute","value":1699190269},{"type":"absolute","value":1699191304},{"type":"absolute","value":1699192328},{"type":"absolute","value":1699191307},{"type":"absolute","value":1699192331},{"type":"absolute","value":1699191311},{"type":"absolute","value":1699189265},{"type":"absolute","value":1699192342},{"type":"absolute","value":1699192345},{"type":"absolute","value":1699189276},{"type":"absolute","value":1699192350},{"type":"absolute","value":1699192353},{"type":"absolute","value":1699190307},{"type":"absolute","value":1699192356},{"type":"absolute","value":1699190310},{"type":"absolute","value":1699190316},{"type":"absolute","value":1699190318},{"type":"absolute","value":1699189297},{"type":"absolute","value":1699190322},{"type":"absolute","value":1699192371},{"type":"absolute","value":1699189304},{"type":"absolute","value":1699189312},{"type":"absolute","value":1699189315},{"type":"absolute","value":1699189318},{"type":"absolute","value":1699189321},{"type":"absolute","value":1699190349},{"type":"absolute","value":1699191373},{"type":"absolute","value":1699192397},{"type":"absolute","value":1699191376},{"type":"absolute","value":1699188306},{"type":"absolute","value":1699192403},{"type":"absolute","value":1699188308},{"type":"absolute","value":1699191380},{"type":"absolute","value":1699190359},{"type":"absolute","value":1699190362},{"type":"absolute","value":1699189351},{"type":"absolute","value":1699192428},{"type":"absolute","value":1699188333},{"type":"absolute","value":1699188335},{"type":"absolute","value":1699192433},{"type":"absolute","value":1699189362},{"type":"absolute","value":1699192439},{"type":"absolute","value":1699192441},{"type":"absolute","value":1699189371},{"type":"absolute","value":1699189374},{"type":"absolute","value":1699192446},{"type":"absolute","value":1699189377},{"type":"absolute","value":1699191434},{"type":"absolute","value":1699191436},{"type":"absolute","value":1699191440},{"type":"absolute","value":1699190420},{"type":"absolute","value":1699188377},{"type":"absolute","value":1699192475},{"type":"absolute","value":1699190429},{"type":"absolute","value":1699192479},{"type":"absolute","value":1699190432},{"type":"absolute","value":1699192485},{"type":"absolute","value":1699189415},{"type":"absolute","value":1699192488},{"type":"absolute","value":1699188394},{"type":"absolute","value":1699189418},{"type":"absolute","value":1699189421},{"type":"absolute","value":1699192494},{"type":"absolute","value":1699189440},{"type":"absolute","value":1699188421},{"type":"absolute","value":1699189451},{"type":"absolute","value":1699192527},{"type":"absolute","value":1699191505},{"type":"absolute","value":1699188434},{"type":"absolute","value":1699192531},{"type":"absolute","value":1699191508},{"type":"absolute","value":1699191510},{"type":"absolute","value":1699189463},{"type":"absolute","value":1699192534},{"type":"absolute","value":1699189467},{"type":"absolute","value":1699189470},{"type":"absolute","value":1699192542},{"type":"absolute","value":1699192545},{"type":"absolute","value":1699189475},{"type":"absolute","value":1699188453},{"type":"absolute","value":1699188469},{"type":"absolute","value":1699192578},{"type":"absolute","value":1699189508},{"type":"absolute","value":1699190533},{"type":"absolute","value":1699190535},{"type":"absolute","value":1699192583},{"type":"absolute","value":1699189514},{"type":"absolute","value":1699190539},{"type":"absolute","value":1699189517},{"type":"absolute","value":1699192589},{"type":"absolute","value":1699188496},{"type":"absolute","value":1699190552},{"type":"absolute","value":1699192601},{"type":"absolute","value":1699191578},{"type":"absolute","value":1699191581},{"type":"absolute","value":1699191583},{"type":"absolute","value":1699189536},{"type":"absolute","value":1699192612},{"type":"absolute","value":1699188523},{"type":"absolute","value":1699192637},{"type":"absolute","value":1699189566},{"type":"absolute","value":1699192640},{"type":"absolute","value":1699188546},{"type":"absolute","value":1699189570},{"type":"absolute","value":1699189574},{"type":"absolute","value":1699192646},{"type":"absolute","value":1699191624},{"type":"absolute","value":1699189584},{"type":"absolute","value":1699191635},{"type":"absolute","value":1699192660},{"type":"absolute","value":1699190613},{"type":"absolute","value":1699188568},{"type":"absolute","value":1699190616},{"type":"absolute","value":1699190621},{"type":"absolute","value":1699192671},{"type":"absolute","value":1699189605},{"type":"absolute","value":1699191657},{"type":"absolute","value":1699191660},{"type":"absolute","value":1699192689},{"type":"absolute","value":1699188597},{"type":"absolute","value":1699192698},{"type":"absolute","value":1699189627},{"type":"absolute","value":1699189634},{"type":"absolute","value":1699189637},{"type":"absolute","value":1699192709},{"type":"absolute","value":1699189640},{"type":"absolute","value":1699189643},{"type":"absolute","value":1699192715},{"type":"absolute","value":1699188621},{"type":"absolute","value":1699192720},{"type":"absolute","value":1699189653},{"type":"absolute","value":1699192733},{"type":"absolute","value":1699192735},{"type":"absolute","value":1699191714},{"type":"absolute","value":1699192740},{"type":"absolute","value":1699189669},{"type":"absolute","value":1699190693},{"type":"absolute","value":1699190696},{"type":"absolute","value":1699191720},{"type":"absolute","value":1699191725},{"type":"absolute","value":1699188659},{"type":"absolute","value":1699188668},{"type":"absolute","value":1699189694},{"type":"absolute","value":1699189697},{"type":"absolute","value":1699189702},{"type":"absolute","value":1699191750},{"type":"absolute","value":1699192775},{"type":"absolute","value":1699189710},{"type":"absolute","value":1699192787},{"type":"absolute","value":1699188697},{"type":"absolute","value":1699189722},{"type":"absolute","value":1699191777},{"type":"absolute","value":1699190754},{"type":"absolute","value":1699191780},{"type":"absolute","value":1699190759},{"type":"absolute","value":1699191783},{"type":"absolute","value":1699190761},{"type":"absolute","value":1699188719},{"type":"absolute","value":1699189745},{"type":"absolute","value":1699191797}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699206320},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699206320}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699206324}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699206496},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699206496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699206784},{"type":"absolute","value":1699206657},{"type":"absolute","value":1699206852},{"type":"absolute","value":1699206599},{"type":"absolute","value":1699206536},{"type":"absolute","value":1699206795},{"type":"absolute","value":1699206668},{"type":"absolute","value":1699206733},{"type":"absolute","value":1699206864},{"type":"absolute","value":1699206609},{"type":"absolute","value":1699206548},{"type":"absolute","value":1699206678},{"type":"absolute","value":1699206806},{"type":"absolute","value":1699206744},{"type":"absolute","value":1699206874},{"type":"absolute","value":1699206621},{"type":"absolute","value":1699206716},{"type":"absolute","value":1699206559},{"type":"absolute","value":1699206689},{"type":"absolute","value":1699206817},{"type":"absolute","value":1699206755},{"type":"absolute","value":1699206503},{"type":"absolute","value":1699206633},{"type":"absolute","value":1699206700},{"type":"absolute","value":1699206828},{"type":"absolute","value":1699206511},{"type":"absolute","value":1699206577},{"type":"absolute","value":1699206644},{"type":"absolute","value":1699206773},{"type":"absolute","value":1699206839},{"type":"absolute","value":1699206521},{"type":"absolute","value":1699206588}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699207939},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699207939}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699207951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699207971},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699207971}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699207983}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211223},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699211223}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699211227}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not","description":"filter for potential false positives"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"unsigned bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"bitwise negation for unsigned 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18446744073709551615,"description":"bitwise negation for unsigned 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"signed bitwise negation operation (~i)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":268435455,"description":"bitwise negation for signed 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1152921504606846975,"description":"bitwise negation for signed 64 bits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"Magic constants used in the implementation of strings functions."}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2130640639,"description":"optimized string constant for 32 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326657,"description":"-0x81010101 = 0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2164326656,"description":"0x81010100 = ~0x7EFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9151031864016699135,"description":"optimized string constant for 64 bits"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852481,"description":"-0x8101010101010101 = 0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9295712209692852480,"description":"0x8101010101010100 = ~0x7EFEFEFEFEFEFEFF"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using blowfish":{"meta":{"name":"encrypt data using blowfish","namespace":"data-manipulation/encryption/blowfish","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","Blowfish"],"objective":"Cryptography","behavior":"Encrypt Data","method":"Blowfish","id":"C0027.002"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x653E19E5"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using blowfish\n    namespace: data-manipulation/encryption/blowfish\n    authors:\n      - \"@_re_fox\"\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires bytes features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\n      - Cryptography::Encrypt Data::Blowfish [C0027.002]\n    examples:\n      - 0761142efbda6c4b1e801223de723578:0x653E19E5\n  features:\n    - or:\n      - and:\n        - number: 0x3a39ce37 = u32 ks3 sbox4\n        - number: 0xe93d5a68 = u32 ks2 sbox3\n        - number: 0x4b7a70e9 = u32 ks1 sbox2\n        - number: 0xd1310ba6 = u32 ks0 sbox1\n      - or:\n        - bytes: 88 6a 3f 24 d3 08 a3 85 2e 8a 19 13 44 73 70 03 22 38 09 a4 d0 31 9f 29 98 fa 2e 08 89 6c 4e ec e6 21 28 45 77 13 d0 38 cf 66 54 be 6c 0c e9 34 b7 29 ac c0 dd 50 7c c9 b5 d5 84 3f 17 09 47 b5 d9 d5 16 92 1b fb 79 89 = ps\n        - bytes: a6 0b 31 d1 ac b5 df 98 db 72 fd 2f b7 df 1a d0 ed af e1 b8 96 7e 26 6a 45 90 7c ba 99 7f 2c f1 47 99 a1 24 f7 6c 91 b3 e2 f2 01 08 16 fc 8e 85 d8 20 69 63 69 4e 57 71 a3 fe 58 a4 7e 3d 93 f4 8f 74 95 0d 58 b6 8e 72 58 cd 8b 71 ee 4a 15 82 1d a4 54 7b b5 59 5a c2 39 d5 30 9c 13 60 f2 2a 23 b0 d1 c5 f0 85 60 28 18 79 41 ca ef 38 db b8 b0 dc 79 8e 0e 18 3a 60 8b 0e 9e 6c 3e 8a 1e b0 c1 77 15 d7 27 4b 31 bd da 2f af 78 60 5c 60 55 f3 25 55 e6 94 ab 55 aa 62 98 48 57 40 14 e8 63 6a 39 ca 55 b6 10 ab 2a 34 5c cc = ks0 sbox1\n        - bytes: e9 70 7a 4b 44 29 b3 b5 2e 09 75 db 23 26 19 c4 b0 a6 6e ad 7d df a7 49 b8 60 ee 9c 66 b2 ed 8f 71 8c aa ec ff 17 9a 69 6c 52 64 56 e1 9e b1 c2 a5 02 36 19 29 4c 09 75 40 13 59 a0 3e 3a 18 e4 9a 98 54 3f 65 9d 42 5b d6 e4 8f 6b d6 3f f7 99 07 9c d2 a1 f5 30 e8 ef e6 38 2d 4d c1 5d 25 f0 86 20 dd 4c 26 eb 70 84 c6 e9 82 63 5e cc 1e 02 3f 6b 68 09 c9 ef ba 3e 14 18 97 3c a1 70 6a 6b 84 35 7f 68 86 e2 a0 52 05 53 9c b7 37 07 50 aa 1c 84 07 3e 5c ae de 7f ec 44 7d 8e b8 f2 16 57 37 da 3a b0 0d 0c 50 f0 04 1f 1c  = ks1 sbox2\n        - bytes: 68 5a 3d e9 f7 40 81 94 1c 26 4c f6 34 29 69 94 f7 20 15 41 f7 d4 02 76 2e 6b f4 bc 68 00 a2 d4 71 24 08 d4 6a f4 20 33 b7 d4 b7 43 af 61 00 50 2e f6 39 1e 46 45 24 97 74 4f 21 14 40 88 8b bf 1d fc 95 4d af 91 b5 96 d3 dd f4 70 45 2f a0 66 ec 09 bc bf 85 97 bd 03 d0 6d ac 7f 04 85 cb 31 b3 27 eb 96 41 39 fd 55 e6 47 25 da 9a 0a ca ab 25 78 50 28 f4 29 04 53 da 86 2c 0a fb 6d b6 e9 62 14 dc 68 00 69 48 d7 a4 c0 0e 68 ee 8d a1 27 a2 fe 3f 4f 8c ad 87 e8 06 e0 8c b5 b6 d6 f4 7a 7c 1e ce aa ec 5f 37 d3 99 a3 78 = ks2 sbox3\n        - bytes: 37 ce 39 3a cf f5 fa d3 37 77 c2 ab 1b 2d c5 5a 9e 67 b0 5c 42 37 a3 4f 40 27 82 d3 be 9b bc 99 9d 8e 11 d5 15 73 0f bf 7e 1c 2d d6 7b c4 00 c7 6b 1b 8c b7 45 90 a1 21 be b1 6e b2 b4 6e 36 6a 2f ab 48 57 79 6e 94 bc d2 76 a3 c6 c8 c2 49 65 ee f8 0f 53 7d de 8d 46 1d 0a 73 d5 c6 4d d0 4c db bb 39 29 50 46 ba a9 e8 26 95 ac 04 e3 5e be f0 d5 fa a1 9a 51 2d 6a e2 8c ef 63 22 ee 86 9a b8 c2 89 c0 f6 2e 24 43 aa 03 1e a5 a4 d0 f2 9c ba 61 c0 83 4d 6a e9 9b 50 15 e5 8f d6 5b 64 ba f9 a2 26 28 e1 3a 3a a7 86 95 a9 = ks3 sbox4\n","matches":[[{"type":"absolute","value":1698568626},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[{"type":"absolute","value":1698568646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568677},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568679}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568691}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568696}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568701}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568708}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568715}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568722}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568595},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[{"type":"absolute","value":1698568646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568677},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":976866871,"description":"u32 ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568679}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3913112168,"description":"u32 ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1266315497,"description":"u32 ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568691}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3509652390,"description":"u32 ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568696}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"886a3f24d308a3852e8a191344737003223809a4d0319f2998fa2e08896c4eece62128457713d038cf6654be6c0ce934b729acc0dd507cc9b5d5843f170947b5d9d516921bfb7989","description":"ps"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a60b31d1acb5df98db72fd2fb7df1ad0edafe1b8967e266a45907cba997f2cf14799a124f76c91b3e2f2010816fc8e85d8206963694e5771a3fe58a47e3d93f48f74950d58b68e7258cd8b71ee4a15821da4547bb5595ac239d5309c1360f22a23b0d1c5f0856028187941caef38dbb8b0dc798e0e183a608b0e9e6c3e8a1eb0c17715d7274b31bdda2faf78605c6055f32555e694ab55aa629848574014e8636a39ca55b610ab2a345ccc","description":"ks0 sbox1"}},"children":[],"locations":[{"type":"absolute","value":1698568701}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e9707a4b4429b3b52e0975db232619c4b0a66ead7ddfa749b860ee9c66b2ed8f718caaecff179a696c526456e19eb1c2a5023619294c0975401359a03e3a18e49a98543f659d425bd6e48f6bd63ff799079cd2a1f530e8efe6382d4dc15d25f08620dd4c26eb7084c6e982635ecc1e023f6b6809c9efba3e1418973ca1706a6b84357f6886e2a05205539cb7370750aa1c84073e5caede7fec447d8eb8f2165737da3ab00d0c50f0041f1c","description":"ks1 sbox2"}},"children":[],"locations":[{"type":"absolute","value":1698568708}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"685a3de9f74081941c264cf634296994f7201541f7d402762e6bf4bc6800a2d4712408d46af42033b7d4b743af6100502ef6391e46452497744f211440888bbf1dfc954daf91b596d3ddf470452fa066ec09bcbf8597bd03d06dac7f0485cb31b327eb964139fd55e64725da9a0acaab25785028f4290453da862c0afb6db6e96214dc68006948d7a4c00e68ee8da127a2fe3f4f8cad87e806e08cb5b6d6f47a7c1eceaaec5f37d399a378","description":"ks2 sbox3"}},"children":[],"locations":[{"type":"absolute","value":1698568715}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"37ce393acff5fad33777c2ab1b2dc55a9e67b05c4237a34f402782d3be9bbc999d8e11d515730fbf7e1c2dd67bc400c76b1b8cb74590a121beb16eb2b46e366a2fab4857796e94bcd276a3c6c8c24965eef80f537dde8d461d0a73d5c64dd04cdbbb39295046baa9e82695ac04e35ebef0d5faa19a512d6ae28cef6322ee869ab8c289c0f62e2443aa031ea5a4d0f29cba61c0834d6ae99b5015e58fd65b64baf9a22628e13a3aa78695a9","description":"ks3 sbox4"}},"children":[],"locations":[{"type":"absolute","value":1698568722}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using DES":{"meta":{"name":"encrypt data using DES","namespace":"data-manipulation/encryption/des","authors":["@_re_fox","william.ballenthin@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","3DES"],"objective":"Cryptography","behavior":"Encrypt Data","method":"3DES","id":"C0027.004"}],"references":[],"examples":["91a12a4cf437589ba70b1687f5acad19:0x47F5E8"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using DES\n    namespace: data-manipulation/encryption/des\n    authors:\n      - \"@_re_fox\"\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires characteristic, bytes, mnemonic features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\n      - Cryptography::Encrypt Data::3DES [C0027.004]\n    examples:\n      - 91a12a4cf437589ba70b1687f5acad19:0x47F5E8\n  features:\n    - or:\n      - bytes: 0e 04 0d 01 02 0f 0b 08 03 0a 06 0c 05 09 00 07 00 0f 07 04 0e 02 0d 01 0a 06 0c 0b 09 05 03 08 04 01 0e 08 0d 06 02 0b 0f 0c 09 07 03 0a 05 00 0f 0c 08 02 04 09 01 07 05 0b 03 0e 0a 00 06 0d = SBOX S1\n      - bytes: 0f 01 08 0e 06 0b 03 04 09 07 02 0d 0c 00 05 0a 03 0d 04 07 0f 02 08 0e 0c 00 01 0a 06 09 0b 05 00 0e 07 0b 0a 04 0d 01 05 08 0c 06 09 03 02 0f 0d 08 0a 01 03 0f 04 02 0b 06 07 0c 00 05 0e 09 = SBOX S2\n      - bytes: 0a 00 09 0e 06 03 0f 05 01 0d 0c 07 0b 04 02 08 0d 07 00 09 03 04 06 0a 02 08 05 0e 0c 0b 0f 01 0d 06 04 09 08 0f 03 00 0b 01 02 0c 05 0a 0e 07 01 0a 0d 00 06 09 08 07 04 0f 0e 03 0b 05 02 0c = SBOX S3\n      - bytes: 07 0d 0e 03 00 06 09 0a 01 02 08 05 0b 0c 04 0f 0d 08 0b 05 06 0f 00 03 04 07 02 0c 01 0a 0e 09 0a 06 09 00 0c 0b 07 0d 0f 01 03 0e 05 02 08 04 03 0f 00 06 0a 01 0d 08 09 04 05 0b 0c 07 02 0e = SBOX S4\n      - bytes: 02 0c 04 01 07 0a 0b 06 08 05 03 0f 0d 00 0e 09 0e 0b 02 0c 04 07 0d 01 05 00 0f 0a 03 09 08 06 04 02 01 0b 0a 0d 07 08 0f 09 0c 05 06 03 00 0e 0b 08 0c 07 01 0e 02 0d 06 0f 00 09 0a 04 05 03 = SBOX S5\n      - bytes: 0c 01 0a 0f 09 02 06 08 00 0d 03 04 0e 07 05 0b 0a 0f 04 02 07 0c 09 05 06 01 0d 0e 00 0b 03 08 09 0e 0f 05 02 08 0c 03 07 00 04 0a 01 0d 0b 06 04 03 02 0c 09 05 0f 0a 0b 0e 01 07 06 00 08 0d = SBOX S6\n      - bytes: 04 0b 02 0e 0f 00 08 0d 03 0c 09 07 05 0a 06 01 0d 00 0b 07 04 09 01 0a 0e 03 05 0c 02 0f 08 06 01 04 0b 0d 0c 03 07 0e 0a 0f 06 08 00 05 09 02 06 0b 0d 08 01 04 0a 07 09 05 00 0f 0e 02 03 0c = SBOX S7\n      - bytes: 0d 02 08 04 06 0f 0b 01 0a 09 03 0e 05 00 0c 07 01 0f 0d 08 0a 03 07 04 0c 05 06 0b 00 0e 09 02 07 0b 04 01 09 0c 0e 02 00 06 0a 0d 0f 03 05 08 02 01 0e 07 04 0a 08 0d 0f 0c 09 00 03 05 06 0b = SBOX S8\n      - bytes: 39 31 29 21 19 11 09 01 3a 32 2a 22 1a 12 0a 02 3b 33 2b 23 1b 13 0b 03 3c 34 2c 24 3f 37 2f 27 1f 17 0f 07 3e 36 2e 26 1e 16 0e 06 3d 35 2d 25 1d 15 0d 05 1c 14 0c 04  = PC1\n      - bytes: 0e 11 0b 18 01 05 03 1c 0f 06 15 0a 17 13 0c 04 1a 08 10 07 1b 14 0d 02 29 34 1f 25 2f 37 1e 28 33 2d 21 30 2c 31 27 38 22 35 2e 2a 32 24 1d 20  = PC2\n      - bytes: 3a 32 2a 22 1a 12 0a 02 3c 34 2c 24 1c 14 0c 04 3e 36 2e 26 1e 16 0e 06 40 38 30 28 20 18 10 08 39 31 29 21 19 11 09 01 3b 33 2b 23 1b 13 0b 03 3d 35 2d 25 1d 15 0d 05 3f 37 2f 27 1f 17 0f 07 = Initial Permutation\n      - bytes: 28 08 30 10 38 18 40 20 27 07 2f 0f 37 17 3f 1f 26 06 2e 0e 36 16 3e 1e 25 05 2d 0d 35 15 3d 1d 24 04 2c 0c 34 14 3c 1c 23 03 2b 0b 33 13 3b 1b 22 02 2a 0a 32 12 3a 1a 21 01 29 09 31 11 39 19 = Final Permutation\n      - bytes: 20 01 02 03 04 05 04 05 06 07 08 09 08 09 0a 0b 0c 0d 0c 0d 0e 0f 10 11 10 11 12 13 14 15 14 15 16 17 18 19 18 19 1a 1b 1c 1d 1c 1d 1e 1f 20 01 = DES Expansion\n      - bytes: 10 07 14 15 1d 0c 1c 11 01 0f 17 1a 05 12 1f 0a 02 08 18 0e 20 1b 03 09 13 0d 1e 06 16 0b 04 19 = PBOX\n      - and:\n        - description: DES RawProcessBlock\n        - number: 0x18\n        - number: 0x10\n        - number: 0x8\n        - number: 0x3f\n        - characteristic: nzxor\n        - count(mnemonic(shr)): 8 or more\n        - mnemonic: ror\n      - or:\n        - description: libtomcrypt implementation\n        - bytes: 38 30 28 20 18 10 08 00 39 31 29 21 19 11 09 01 3A 32 2A 22 1A 12 0A 02 3B 33 2B 23 3E 36 2E 26 1E 16 0E 06 3D 35 2D 25 1D 15 0D 05 3C 34 2C 24 1C 14 0C 04 1B 13 0B 03 = pc1\n        - bytes: 0D 10 0A 17 00 04 02 1B 0E 05 14 09 16 12 0B 03 19 07 0F 06 1A 13 0C 01 28 33 1E 24 2E 36 1D 27 32 2C 20 2F 2B 30 26 37 21 34 2D 29 31 23 1C 1F 00 00 00 00 00 00 00 00 = pc2\n        - bytes: 00 04 01 01 00 00 00 00 00 00 01 00 04 04 01 01 04 00 01 01 04 04 01 00 04 00 00 00 00 00 01 00 00 04 00 00 00 04 01 01 04 04 01 01 00 04 00 00 04 04 00 01 04 00 01 01 00 00 00 01 04 00 00 00 04 04 00 00 00 04 00 01 00 04 00 01 00 04 01 00 00 04 01 00 00 00 01 01 00 00 01 01 04 04 00 01 04 00 01 00 04 00 00 01 04 00 00 01 04 00 01 00 00 00 00 00 04 04 00 00 04 04 01 00 00 00 00 01 00 00 01 00 04 04 01 01 04 00 00 00 00 00 01 01 00 04 01 01 00 00 00 01 00 00 00 01 00 04 00 00 04 00 01 01 00 00 01 00 00 04 01 00 04 00 00 01 00 04 00 00 04 00 00 00 04 04 00 01 04 04 01 00 04 04 01 01 04 00 01 00 00 00 01 01 04 04 00 01 04 00 00 01 04 04 00 00 04 04 01 00 00 04 01 01 04 04 00 00 00 04 00 01 00 04 00 01 00 00 00 00 04 00 01 00 00 04 01 00 00 00 00 00 04 00 01 01 = SP1\n        - bytes: 20 80 10 80 00 80 00 80 00 80 00 00 20 80 10 00 00 00 10 00 20 00 00 00 20 00 10 80 20 80 00 80 20 00 00 80 20 80 10 80 00 80 10 80 00 00 00 80 00 80 00 80 00 00 10 00 20 00 00 00 20 00 10 80 00 80 10 00 20 00 10 00 20 80 00 80 00 00 00 00 00 00 00 80 00 80 00 00 20 80 10 00 00 00 10 80 20 00 10 00 20 00 00 80 00 00 00 00 00 80 10 00 20 80 00 00 00 80 10 80 00 00 10 80 20 80 00 00 00 00 00 00 20 80 10 00 20 00 10 80 00 00 10 00 20 80 00 80 00 00 10 80 00 80 10 80 00 80 00 00 00 00 10 80 00 80 00 80 20 00 00 00 20 80 10 80 20 80 10 00 20 00 00 00 00 80 00 00 00 00 00 80 20 80 00 00 00 80 10 80 00 00 10 00 20 00 00 80 20 00 10 00 20 80 00 80 20 00 00 80 20 00 10 00 00 80 10 00 00 00 00 00 00 80 00 80 20 80 00 00 00 00 00 80 20 00 10 80 20 80 10 80 00 80 10 00 = SP2\n        - bytes: 08 02 00 00 00 02 02 08 00 00 00 00 08 00 02 08 00 02 00 08 00 00 00 00 08 02 02 00 00 02 00 08 08 00 02 00 08 00 00 08 08 00 00 08 00 00 02 00 08 02 02 08 08 00 02 00 00 00 02 08 08 02 00 00 00 00 00 08 08 00 00 00 00 02 02 08 00 02 00 00 00 02 02 00 00 00 02 08 08 00 02 08 08 02 02 00 08 02 00 08 00 02 02 00 00 00 02 00 08 02 00 08 08 00 00 00 08 02 02 08 00 02 00 00 00 00 00 08 00 02 02 08 00 00 00 08 08 00 02 00 08 02 00 00 00 00 02 00 00 02 02 08 00 02 00 08 00 00 00 00 00 02 00 00 08 00 02 00 08 02 02 08 00 02 00 08 08 00 00 08 00 02 00 00 00 00 00 00 08 00 02 08 08 02 00 08 00 00 02 00 00 00 00 08 08 02 02 08 08 00 00 00 08 02 02 00 00 02 02 00 08 00 00 08 00 00 02 08 08 02 00 08 08 02 00 00 00 00 02 08 08 02 02 00 08 00 00 00 08 00 02 08 00 02 02 00 = SP3\n        - bytes: 01 20 80 00 81 20 00 00 81 20 00 00 80 00 00 00 80 20 80 00 81 00 80 00 01 00 80 00 01 20 00 00 00 00 00 00 00 20 80 00 00 20 80 00 81 20 80 00 81 00 00 00 00 00 00 00 80 00 80 00 01 00 80 00 01 00 00 00 00 20 00 00 00 00 80 00 01 20 80 00 80 00 00 00 00 00 80 00 01 20 00 00 80 20 00 00 81 00 80 00 01 00 00 00 80 20 00 00 80 00 80 00 00 20 00 00 80 20 80 00 81 20 80 00 81 00 00 00 80 00 80 00 01 00 80 00 00 20 80 00 81 20 80 00 81 00 00 00 00 00 00 00 00 00 00 00 00 20 80 00 80 20 00 00 80 00 80 00 81 00 80 00 01 00 00 00 01 20 80 00 81 20 00 00 81 20 00 00 80 00 00 00 81 20 80 00 81 00 00 00 01 00 00 00 00 20 00 00 01 00 80 00 01 20 00 00 80 20 80 00 81 00 80 00 01 20 00 00 80 20 00 00 00 00 80 00 01 20 80 00 80 00 00 00 00 00 80 00 00 20 00 00 80 20 80 00 = SP4\n        - bytes: 00 01 00 00 00 01 08 02 00 00 08 02 00 01 00 42 00 00 08 00 00 01 00 00 00 00 00 40 00 00 08 02 00 01 08 40 00 00 08 00 00 01 00 02 00 01 08 40 00 01 00 42 00 00 08 42 00 01 08 00 00 00 00 40 00 00 00 02 00 00 08 40 00 00 08 40 00 00 00 00 00 01 00 40 00 01 08 42 00 01 08 42 00 01 00 02 00 00 08 42 00 01 00 40 00 00 00 00 00 00 00 42 00 01 08 02 00 00 00 02 00 00 00 42 00 01 08 00 00 00 08 00 00 01 00 42 00 01 00 00 00 00 00 02 00 00 00 40 00 00 08 02 00 01 00 42 00 01 08 40 00 01 00 02 00 00 00 40 00 00 08 42 00 01 08 02 00 01 08 40 00 01 00 00 00 00 00 02 00 00 08 42 00 01 08 42 00 01 08 00 00 00 00 42 00 01 08 42 00 00 08 02 00 00 00 00 00 00 08 40 00 00 00 42 00 01 08 00 00 01 00 02 00 01 00 40 00 00 08 00 00 00 00 00 00 00 08 40 00 01 08 02 00 01 00 40 = SP5\n        - bytes: 10 00 00 20 00 00 40 20 00 40 00 00 10 40 40 20 00 00 40 20 10 00 00 00 10 40 40 20 00 00 40 00 00 40 00 20 10 40 40 00 00 00 40 00 10 00 00 20 10 00 40 00 00 40 00 20 00 00 00 20 10 40 00 00 00 00 00 00 10 00 40 00 10 40 00 20 00 40 00 00 00 40 40 00 10 40 00 20 10 00 00 00 10 00 40 20 10 00 40 20 00 00 00 00 10 40 40 00 00 40 40 20 10 40 00 00 00 40 40 00 00 40 40 20 00 00 00 20 00 40 00 20 10 00 00 00 10 00 40 20 00 40 40 00 10 40 40 20 00 00 40 00 10 40 00 00 10 00 00 20 00 00 40 00 00 40 00 20 00 00 00 20 10 40 00 00 10 00 00 20 10 40 40 20 00 40 40 00 00 00 40 20 10 40 40 00 00 40 40 20 00 00 00 00 10 00 40 20 10 00 00 00 00 40 00 00 00 00 40 20 10 40 40 00 00 40 00 00 10 00 40 00 10 40 00 20 00 00 00 00 00 40 40 20 00 00 00 20 10 00 40 00 10 40 00 20 = SP6\n        - bytes: 00 00 20 00 02 00 20 04 02 08 00 04 00 00 00 00 00 08 00 00 02 08 00 04 02 08 20 00 00 08 20 04 02 08 20 04 00 00 20 00 00 00 00 00 02 00 00 04 02 00 00 00 00 00 00 04 02 00 20 04 02 08 00 00 00 08 00 04 02 08 20 00 02 00 20 00 00 08 00 04 02 00 00 04 00 00 20 04 00 08 20 04 02 00 20 00 00 00 20 04 00 08 00 00 02 08 00 00 02 08 20 04 00 08 20 00 02 00 00 00 00 00 00 04 00 08 20 00 00 00 00 04 00 08 20 00 00 00 20 00 02 08 00 04 02 08 00 04 02 00 20 04 02 00 20 04 02 00 00 00 02 00 20 00 00 00 00 04 00 08 00 04 00 00 20 00 00 08 20 04 02 08 00 00 02 08 20 00 00 08 20 04 02 08 00 00 02 00 00 04 02 08 20 04 00 00 20 04 00 08 20 00 00 00 00 00 02 00 00 00 02 08 20 04 00 00 00 00 02 08 20 00 00 00 20 04 00 08 00 00 02 00 00 04 00 08 00 04 00 08 00 00 02 00 20 00 = SP7\n        - bytes: 40 10 00 10 00 10 00 00 00 00 04 00 40 10 04 10 00 00 00 10 40 10 00 10 40 00 00 00 00 00 00 10 40 00 04 00 00 00 04 10 40 10 04 10 00 10 04 00 00 10 04 10 40 10 04 00 00 10 00 00 40 00 00 00 00 00 04 10 40 00 00 10 00 10 00 10 40 10 00 00 00 10 04 00 40 00 04 00 40 00 04 10 00 10 04 10 40 10 00 00 00 00 00 00 00 00 00 00 40 00 04 10 40 00 00 10 00 10 00 10 40 10 04 00 00 00 04 00 40 10 04 00 00 00 04 00 00 10 04 10 00 10 00 00 40 00 00 00 40 00 04 10 00 10 00 00 40 10 04 00 00 10 00 10 40 00 00 00 40 00 00 10 00 00 04 10 40 00 04 10 00 00 00 10 00 00 04 00 40 10 00 10 00 00 00 00 40 10 04 10 40 00 04 00 40 00 00 10 00 00 04 10 00 10 00 10 40 10 00 10 00 00 00 00 40 10 04 10 00 10 04 00 00 10 04 00 40 10 00 00 40 10 00 00 40 00 04 00 00 00 00 10 00 10 04 10 = SP8\n","matches":[[{"type":"absolute","value":1698595729},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0e040d01020f0b08030a060c05090007000f07040e020d010a060c0b0905030804010e080d06020b0f0c0907030a05000f0c080204090107050b030e0a00060d","description":"SBOX S1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0f01080e060b03040907020d0c00050a030d04070f02080e0c00010a06090b05000e070b0a040d0105080c060903020f0d080a01030f04020b06070c00050e09","description":"SBOX S2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0a00090e06030f05010d0c070b0402080d0700090304060a0208050e0c0b0f010d060409080f03000b01020c050a0e07010a0d0006090807040f0e030b05020c","description":"SBOX S3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"070d0e030006090a010208050b0c040f0d080b05060f00030407020c010a0e090a0609000c0b070d0f01030e05020804030f00060a010d080904050b0c07020e","description":"SBOX S4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"020c0401070a0b060805030f0d000e090e0b020c04070d0105000f0a030908060402010b0a0d07080f090c050603000e0b080c07010e020d060f00090a040503","description":"SBOX S5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0c010a0f09020608000d03040e07050b0a0f0402070c090506010d0e000b0308090e0f0502080c030700040a010d0b060403020c09050f0a0b0e01070600080d","description":"SBOX S6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"040b020e0f00080d030c0907050a06010d000b070409010a0e03050c020f080601040b0d0c03070e0a0f060800050902060b0d0801040a070905000f0e02030c","description":"SBOX S7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0d020804060f0b010a09030e05000c07010f0d080a0307040c05060b000e0902070b0401090c0e0200060a0d0f03050802010e07040a080d0f0c09000305060b","description":"SBOX S8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"39312921191109013a322a221a120a023b332b231b130b033c342c243f372f271f170f073e362e261e160e063d352d251d150d051c140c04","description":"PC1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0e110b180105031c0f06150a17130c041a0810071b140d0229341f252f371e28332d21302c31273822352e2a32241d20","description":"PC2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3a322a221a120a023c342c241c140c043e362e261e160e06403830282018100839312921191109013b332b231b130b033d352d251d150d053f372f271f170f07","description":"Initial Permutation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"280830103818402027072f0f37173f1f26062e0e36163e1e25052d0d35153d1d24042c0c34143c1c23032b0b33133b1b22022a0a32123a1a2101290931113919","description":"Final Permutation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"20010203040504050607080908090a0b0c0d0c0d0e0f101110111213141514151617181918191a1b1c1d1c1d1e1f2001","description":"DES Expansion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"100714151d0c1c11010f171a05121f0a0208180e201b0309130d1e06160b0419","description":"PBOX"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"DES RawProcessBlock"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24}},"children":[],"locations":[{"type":"absolute","value":1698596930},{"type":"absolute","value":1698596994},{"type":"absolute","value":1698597119},{"type":"absolute","value":1698596805},{"type":"absolute","value":1698596680},{"type":"absolute","value":1698596744},{"type":"absolute","value":1698596619},{"type":"absolute","value":1698596430},{"type":"absolute","value":1698596494},{"type":"absolute","value":1698596305},{"type":"absolute","value":1698596369},{"type":"absolute","value":1698596563},{"type":"absolute","value":1698596180},{"type":"absolute","value":1698596244},{"type":"absolute","value":1698596881},{"type":"absolute","value":1698596119},{"type":"absolute","value":1698596060},{"type":"absolute","value":1698595997},{"type":"absolute","value":1698595942},{"type":"absolute","value":1698597369},{"type":"absolute","value":1698597744},{"type":"absolute","value":1698597810},{"type":"absolute","value":1698597555},{"type":"absolute","value":1698597619},{"type":"absolute","value":1698597684},{"type":"absolute","value":1698597430},{"type":"absolute","value":1698597494},{"type":"absolute","value":1698597244},{"type":"absolute","value":1698597305},{"type":"absolute","value":1698597876},{"type":"absolute","value":1698597180},{"type":"absolute","value":1698597055}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":16}},"children":[],"locations":[{"type":"absolute","value":1698597184},{"type":"absolute","value":1698597248},{"type":"absolute","value":1698597373},{"type":"absolute","value":1698597059},{"type":"absolute","value":1698597123},{"type":"absolute","value":1698596869},{"type":"absolute","value":1698596934},{"type":"absolute","value":1698596998},{"type":"absolute","value":1698596809},{"type":"absolute","value":1698596555},{"type":"absolute","value":1698596684},{"type":"absolute","value":1698595789},{"type":"absolute","value":1698596748},{"type":"absolute","value":1698596623},{"type":"absolute","value":1698596434},{"type":"absolute","value":1698596498},{"type":"absolute","value":1698596309},{"type":"absolute","value":1698596373},{"type":"absolute","value":1698596184},{"type":"absolute","value":1698596248},{"type":"absolute","value":1698595801},{"type":"absolute","value":1698596123},{"type":"absolute","value":1698597980},{"type":"absolute","value":1698596064},{"type":"absolute","value":1698596001},{"type":"absolute","value":1698597990},{"type":"absolute","value":1698595946},{"type":"absolute","value":1698597623},{"type":"absolute","value":1698597680},{"type":"absolute","value":1698597879},{"type":"absolute","value":1698597748},{"type":"absolute","value":1698597498},{"type":"absolute","value":1698597559},{"type":"absolute","value":1698597814},{"type":"absolute","value":1698597434},{"type":"absolute","value":1698597309}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8}},"children":[],"locations":[{"type":"absolute","value":1698595842},{"type":"absolute","value":1698596290},{"type":"absolute","value":1698596354},{"type":"absolute","value":1698596165},{"type":"absolute","value":1698596229},{"type":"absolute","value":1698596106},{"type":"absolute","value":1698596047},{"type":"absolute","value":1698595984},{"type":"absolute","value":1698595921},{"type":"absolute","value":1698596665},{"type":"absolute","value":1698595864},{"type":"absolute","value":1698597945},{"type":"absolute","value":1698597665},{"type":"absolute","value":1698596540},{"type":"absolute","value":1698597729},{"type":"absolute","value":1698597540},{"type":"absolute","value":1698597604},{"type":"absolute","value":1698597793},{"type":"absolute","value":1698597415},{"type":"absolute","value":1698597479},{"type":"absolute","value":1698597858},{"type":"absolute","value":1698597290},{"type":"absolute","value":1698597354},{"type":"absolute","value":1698597928},{"type":"absolute","value":1698596415},{"type":"absolute","value":1698597165},{"type":"absolute","value":1698597229},{"type":"absolute","value":1698597040},{"type":"absolute","value":1698597104},{"type":"absolute","value":1698596915},{"type":"absolute","value":1698596979},{"type":"absolute","value":1698596790},{"type":"absolute","value":1698596854},{"type":"absolute","value":1698596729},{"type":"absolute","value":1698596604},{"type":"absolute","value":1698596479}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63}},"children":[],"locations":[{"type":"absolute","value":1698596096},{"type":"absolute","value":1698596608},{"type":"absolute","value":1698597377},{"type":"absolute","value":1698597381},{"type":"absolute","value":1698596358},{"type":"absolute","value":1698597127},{"type":"absolute","value":1698596873},{"type":"absolute","value":1698597131},{"type":"absolute","value":1698596109},{"type":"absolute","value":1698596627},{"type":"absolute","value":1698596885},{"type":"absolute","value":1698597653},{"type":"absolute","value":1698596631},{"type":"absolute","value":1698596377},{"type":"absolute","value":1698597403},{"type":"absolute","value":1698596381},{"type":"absolute","value":1698596126},{"type":"absolute","value":1698597153},{"type":"absolute","value":1698596130},{"type":"absolute","value":1698597669},{"type":"absolute","value":1698596903},{"type":"absolute","value":1698597419},{"type":"absolute","value":1698596653},{"type":"absolute","value":1698597169},{"type":"absolute","value":1698596403},{"type":"absolute","value":1698596151},{"type":"absolute","value":1698596919},{"type":"absolute","value":1698597688},{"type":"absolute","value":1698597692},{"type":"absolute","value":1698596669},{"type":"absolute","value":1698597438},{"type":"absolute","value":1698597442},{"type":"absolute","value":1698596419},{"type":"absolute","value":1698597188},{"type":"absolute","value":1698595910},{"type":"absolute","value":1698597883},{"type":"absolute","value":1698596169},{"type":"absolute","value":1698596938},{"type":"absolute","value":1698597196},{"type":"absolute","value":1698596942},{"type":"absolute","value":1698596688},{"type":"absolute","value":1698595924},{"type":"absolute","value":1698596692},{"type":"absolute","value":1698596438},{"type":"absolute","value":1698597718},{"type":"absolute","value":1698596442},{"type":"absolute","value":1698596188},{"type":"absolute","value":1698597468},{"type":"absolute","value":1698596192},{"type":"absolute","value":1698597218},{"type":"absolute","value":1698597733},{"type":"absolute","value":1698596968},{"type":"absolute","value":1698597483},{"type":"absolute","value":1698595949},{"type":"absolute","value":1698596718},{"type":"absolute","value":1698595953},{"type":"absolute","value":1698597233},{"type":"absolute","value":1698596468},{"type":"absolute","value":1698596983},{"type":"absolute","value":1698597752},{"type":"absolute","value":1698596218},{"type":"absolute","value":1698597756},{"type":"absolute","value":1698596733},{"type":"absolute","value":1698597502},{"type":"absolute","value":1698595967},{"type":"absolute","value":1698597506},{"type":"absolute","value":1698596483},{"type":"absolute","value":1698597252},{"type":"absolute","value":1698597256},{"type":"absolute","value":1698596233},{"type":"absolute","value":1698597002},{"type":"absolute","value":1698597006},{"type":"absolute","value":1698596752},{"type":"absolute","value":1698597778},{"type":"absolute","value":1698595987},{"type":"absolute","value":1698596756},{"type":"absolute","value":1698596502},{"type":"absolute","value":1698597528},{"type":"absolute","value":1698596506},{"type":"absolute","value":1698596252},{"type":"absolute","value":1698597278},{"type":"absolute","value":1698596256},{"type":"absolute","value":1698596004},{"type":"absolute","value":1698597028},{"type":"absolute","value":1698597797},{"type":"absolute","value":1698596008},{"type":"absolute","value":1698597544},{"type":"absolute","value":1698596778},{"type":"absolute","value":1698597294},{"type":"absolute","value":1698596528},{"type":"absolute","value":1698597044},{"type":"absolute","value":1698596278},{"type":"absolute","value":1698597817},{"type":"absolute","value":1698596794},{"type":"absolute","value":1698597563},{"type":"absolute","value":1698597821},{"type":"absolute","value":1698597567},{"type":"absolute","value":1698596032},{"type":"absolute","value":1698596544},{"type":"absolute","value":1698597313},{"type":"absolute","value":1698597317},{"type":"absolute","value":1698596294},{"type":"absolute","value":1698597063},{"type":"absolute","value":1698597067},{"type":"absolute","value":1698596813},{"type":"absolute","value":1698596559},{"type":"absolute","value":1698596817},{"type":"absolute","value":1698596050},{"type":"absolute","value":1698596567},{"type":"absolute","value":1698597847},{"type":"absolute","value":1698596313},{"type":"absolute","value":1698597593},{"type":"absolute","value":1698596317},{"type":"absolute","value":1698597343},{"type":"absolute","value":1698596067},{"type":"absolute","value":1698597093},{"type":"absolute","value":1698596071},{"type":"absolute","value":1698597608},{"type":"absolute","value":1698597865},{"type":"absolute","value":1698596843},{"type":"absolute","value":1698597358},{"type":"absolute","value":1698596593},{"type":"absolute","value":1698597108},{"type":"absolute","value":1698596343},{"type":"absolute","value":1698596858},{"type":"absolute","value":1698597627},{"type":"absolute","value":1698597886},{"type":"absolute","value":1698597631}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698597890},{"type":"absolute","value":1698595845},{"type":"absolute","value":1698597385},{"type":"absolute","value":1698596362},{"type":"absolute","value":1698597897},{"type":"absolute","value":1698596877},{"type":"absolute","value":1698597389},{"type":"absolute","value":1698595855},{"type":"absolute","value":1698597907},{"type":"absolute","value":1698597397},{"type":"absolute","value":1698596889},{"type":"absolute","value":1698597917},{"type":"absolute","value":1698595870},{"type":"absolute","value":1698597407},{"type":"absolute","value":1698597920},{"type":"absolute","value":1698596385},{"type":"absolute","value":1698596897},{"type":"absolute","value":1698596389},{"type":"absolute","value":1698595882},{"type":"absolute","value":1698596907},{"type":"absolute","value":1698597932},{"type":"absolute","value":1698596397},{"type":"absolute","value":1698597423},{"type":"absolute","value":1698595892},{"type":"absolute","value":1698597942},{"type":"absolute","value":1698595895},{"type":"absolute","value":1698596407},{"type":"absolute","value":1698595898},{"type":"absolute","value":1698596923},{"type":"absolute","value":1698597949},{"type":"absolute","value":1698597446},{"type":"absolute","value":1698596423},{"type":"absolute","value":1698597958},{"type":"absolute","value":1698595913},{"type":"absolute","value":1698597450},{"type":"absolute","value":1698597966},{"type":"absolute","value":1698596946},{"type":"absolute","value":1698597461},{"type":"absolute","value":1698596950},{"type":"absolute","value":1698597977},{"type":"absolute","value":1698595931},{"type":"absolute","value":1698596446},{"type":"absolute","value":1698595935},{"type":"absolute","value":1698597472},{"type":"absolute","value":1698596961},{"type":"absolute","value":1698596450},{"type":"absolute","value":1698597983},{"type":"absolute","value":1698597988},{"type":"absolute","value":1698597993},{"type":"absolute","value":1698596972},{"type":"absolute","value":1698596461},{"type":"absolute","value":1698597487},{"type":"absolute","value":1698598000},{"type":"absolute","value":1698595956},{"type":"absolute","value":1698596472},{"type":"absolute","value":1698595963},{"type":"absolute","value":1698596987},{"type":"absolute","value":1698598011},{"type":"absolute","value":1698597510},{"type":"absolute","value":1698596487},{"type":"absolute","value":1698595977},{"type":"absolute","value":1698597514},{"type":"absolute","value":1698598025},{"type":"absolute","value":1698597010},{"type":"absolute","value":1698597522},{"type":"absolute","value":1698595990},{"type":"absolute","value":1698597014},{"type":"absolute","value":1698597532},{"type":"absolute","value":1698596510},{"type":"absolute","value":1698597022},{"type":"absolute","value":1698596514},{"type":"absolute","value":1698597032},{"type":"absolute","value":1698596522},{"type":"absolute","value":1698596011},{"type":"absolute","value":1698597548},{"type":"absolute","value":1698596532},{"type":"absolute","value":1698596022},{"type":"absolute","value":1698597048},{"type":"absolute","value":1698596026},{"type":"absolute","value":1698597571},{"type":"absolute","value":1698596036},{"type":"absolute","value":1698596548},{"type":"absolute","value":1698597575},{"type":"absolute","value":1698597071},{"type":"absolute","value":1698597586},{"type":"absolute","value":1698597075},{"type":"absolute","value":1698596053},{"type":"absolute","value":1698596571},{"type":"absolute","value":1698597597},{"type":"absolute","value":1698597086},{"type":"absolute","value":1698596575},{"type":"absolute","value":1698597097},{"type":"absolute","value":1698596074},{"type":"absolute","value":1698596586},{"type":"absolute","value":1698597612},{"type":"absolute","value":1698596078},{"type":"absolute","value":1698596597},{"type":"absolute","value":1698597112},{"type":"absolute","value":1698596089},{"type":"absolute","value":1698596099},{"type":"absolute","value":1698596612},{"type":"absolute","value":1698597635},{"type":"absolute","value":1698597639},{"type":"absolute","value":1698597135},{"type":"absolute","value":1698596112},{"type":"absolute","value":1698597647},{"type":"absolute","value":1698597139},{"type":"absolute","value":1698597657},{"type":"absolute","value":1698596635},{"type":"absolute","value":1698597147},{"type":"absolute","value":1698596639},{"type":"absolute","value":1698596133},{"type":"absolute","value":1698597157},{"type":"absolute","value":1698596647},{"type":"absolute","value":1698596137},{"type":"absolute","value":1698597673},{"type":"absolute","value":1698596145},{"type":"absolute","value":1698596657},{"type":"absolute","value":1698597173},{"type":"absolute","value":1698596154},{"type":"absolute","value":1698597696},{"type":"absolute","value":1698596673},{"type":"absolute","value":1698597700},{"type":"absolute","value":1698597192},{"type":"absolute","value":1698596173},{"type":"absolute","value":1698597711},{"type":"absolute","value":1698597200},{"type":"absolute","value":1698596696},{"type":"absolute","value":1698597722},{"type":"absolute","value":1698597211},{"type":"absolute","value":1698596700},{"type":"absolute","value":1698596196},{"type":"absolute","value":1698597222},{"type":"absolute","value":1698596711},{"type":"absolute","value":1698596200},{"type":"absolute","value":1698597737},{"type":"absolute","value":1698596722},{"type":"absolute","value":1698596211},{"type":"absolute","value":1698597237},{"type":"absolute","value":1698596222},{"type":"absolute","value":1698597760},{"type":"absolute","value":1698596737},{"type":"absolute","value":1698597764},{"type":"absolute","value":1698597260},{"type":"absolute","value":1698596237},{"type":"absolute","value":1698597772},{"type":"absolute","value":1698597264},{"type":"absolute","value":1698597782},{"type":"absolute","value":1698596760},{"type":"absolute","value":1698597272},{"type":"absolute","value":1698596764},{"type":"absolute","value":1698597282},{"type":"absolute","value":1698596260},{"type":"absolute","value":1698596772},{"type":"absolute","value":1698597801},{"type":"absolute","value":1698596268},{"type":"absolute","value":1698596782},{"type":"absolute","value":1698596272},{"type":"absolute","value":1698597298},{"type":"absolute","value":1698595770},{"type":"absolute","value":1698596282},{"type":"absolute","value":1698596798},{"type":"absolute","value":1698597824},{"type":"absolute","value":1698595779},{"type":"absolute","value":1698597829},{"type":"absolute","value":1698595785},{"type":"absolute","value":1698596298},{"type":"absolute","value":1698597321},{"type":"absolute","value":1698597325},{"type":"absolute","value":1698595792},{"type":"absolute","value":1698597840},{"type":"absolute","value":1698596821},{"type":"absolute","value":1698595798},{"type":"absolute","value":1698597336},{"type":"absolute","value":1698596825},{"type":"absolute","value":1698597851},{"type":"absolute","value":1698595804},{"type":"absolute","value":1698596321},{"type":"absolute","value":1698597347},{"type":"absolute","value":1698595812},{"type":"absolute","value":1698596325},{"type":"absolute","value":1698596836},{"type":"absolute","value":1698597869},{"type":"absolute","value":1698596847},{"type":"absolute","value":1698596336},{"type":"absolute","value":1698597362},{"type":"absolute","value":1698595827},{"type":"absolute","value":1698596347},{"type":"absolute","value":1698595836},{"type":"absolute","value":1698596862}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":8,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shr"}}},"children":[],"locations":[{"type":"absolute","value":1698595842},{"type":"absolute","value":1698596354},{"type":"absolute","value":1698597123},{"type":"absolute","value":1698596869},{"type":"absolute","value":1698596106},{"type":"absolute","value":1698596619},{"type":"absolute","value":1698596623},{"type":"absolute","value":1698596369},{"type":"absolute","value":1698596881},{"type":"absolute","value":1698596373},{"type":"absolute","value":1698596119},{"type":"absolute","value":1698596123},{"type":"absolute","value":1698597665},{"type":"absolute","value":1698597415},{"type":"absolute","value":1698597928},{"type":"absolute","value":1698597165},{"type":"absolute","value":1698597680},{"type":"absolute","value":1698596915},{"type":"absolute","value":1698597684},{"type":"absolute","value":1698597879},{"type":"absolute","value":1698597430},{"type":"absolute","value":1698596665},{"type":"absolute","value":1698597434},{"type":"absolute","value":1698597180},{"type":"absolute","value":1698596415},{"type":"absolute","value":1698597184},{"type":"absolute","value":1698596930},{"type":"absolute","value":1698597955},{"type":"absolute","value":1698596165},{"type":"absolute","value":1698596934},{"type":"absolute","value":1698596680},{"type":"absolute","value":1698596684},{"type":"absolute","value":1698596430},{"type":"absolute","value":1698595921},{"type":"absolute","value":1698596434},{"type":"absolute","value":1698596180},{"type":"absolute","value":1698596184},{"type":"absolute","value":1698597980},{"type":"absolute","value":1698597729},{"type":"absolute","value":1698595942},{"type":"absolute","value":1698597479},{"type":"absolute","value":1698595946},{"type":"absolute","value":1698597229},{"type":"absolute","value":1698597997},{"type":"absolute","value":1698597744},{"type":"absolute","value":1698596979},{"type":"absolute","value":1698597748},{"type":"absolute","value":1698597494},{"type":"absolute","value":1698596729},{"type":"absolute","value":1698597498},{"type":"absolute","value":1698597244},{"type":"absolute","value":1698596479},{"type":"absolute","value":1698597248},{"type":"absolute","value":1698596994},{"type":"absolute","value":1698596229},{"type":"absolute","value":1698596998},{"type":"absolute","value":1698596744},{"type":"absolute","value":1698596748},{"type":"absolute","value":1698596494},{"type":"absolute","value":1698595984},{"type":"absolute","value":1698596498},{"type":"absolute","value":1698596244},{"type":"absolute","value":1698596248},{"type":"absolute","value":1698595997},{"type":"absolute","value":1698596001},{"type":"absolute","value":1698597793},{"type":"absolute","value":1698597540},{"type":"absolute","value":1698597290},{"type":"absolute","value":1698597040},{"type":"absolute","value":1698597810},{"type":"absolute","value":1698597555},{"type":"absolute","value":1698596790},{"type":"absolute","value":1698595767},{"type":"absolute","value":1698597559},{"type":"absolute","value":1698597305},{"type":"absolute","value":1698597814},{"type":"absolute","value":1698596540},{"type":"absolute","value":1698597309},{"type":"absolute","value":1698597055},{"type":"absolute","value":1698596290},{"type":"absolute","value":1698597059},{"type":"absolute","value":1698596805},{"type":"absolute","value":1698596809},{"type":"absolute","value":1698596555},{"type":"absolute","value":1698595789},{"type":"absolute","value":1698596047},{"type":"absolute","value":1698596305},{"type":"absolute","value":1698596563},{"type":"absolute","value":1698596309},{"type":"absolute","value":1698596060},{"type":"absolute","value":1698596064},{"type":"absolute","value":1698595809},{"type":"absolute","value":1698597858},{"type":"absolute","value":1698597604},{"type":"absolute","value":1698597354},{"type":"absolute","value":1698597104},{"type":"absolute","value":1698597619},{"type":"absolute","value":1698597876},{"type":"absolute","value":1698596854},{"type":"absolute","value":1698597623},{"type":"absolute","value":1698597369},{"type":"absolute","value":1698596604},{"type":"absolute","value":1698597373},{"type":"absolute","value":1698597119}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"ror"}},"children":[],"locations":[{"type":"absolute","value":1698596832},{"type":"absolute","value":1698596707},{"type":"absolute","value":1698597923},{"type":"absolute","value":1698596582},{"type":"absolute","value":1698596457},{"type":"absolute","value":1698597707},{"type":"absolute","value":1698596332},{"type":"absolute","value":1698597837},{"type":"absolute","value":1698597582},{"type":"absolute","value":1698596207},{"type":"absolute","value":1698597457},{"type":"absolute","value":1698597905},{"type":"absolute","value":1698597332},{"type":"absolute","value":1698596085},{"type":"absolute","value":1698595927},{"type":"absolute","value":1698597082},{"type":"absolute","value":1698596957},{"type":"absolute","value":1698597207}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"libtomcrypt implementation"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"383028201810080039312921191109013a322a221a120a023b332b233e362e261e160e063d352d251d150d053c342c241c140c041b130b03","description":"pc1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0d100a170004021b0e05140916120b0319070f061a130c0128331e242e361d27322c202f2b30263721342d2931231c1f0000000000000000","description":"pc2"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00040101000000000000010004040101040001010404010004000000000001000004000000040101040401010004000004040001040001010000000104000000040400000004000100040001000401000004010000000101000001010404000104000100040000010400000104000100000000000404000004040100000000010000010004040101040000000000010100040101000000010000000100040000040001010000010000040100040000010004000004000000040400010404010004040101040001000000010104040001040000010404000004040100000401010404000000040001000400010000000004000100000401000000000004000101","description":"SP1"}},"children":[],"locations":[{"type":"absolute","value":1698596015}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"20801080008000800080000020801000000010002000000020001080208000802000008020801080008010800000008000800080000010002000000020001080008010002000100020800080000000000000008000800000208010000000108020001000200000800000000000801000208000000080108000001080208000000000000020801000200010800000100020800080000010800080108000800000000010800080008020000000208010802080100020000000008000000000008020800000008010800000100020000080200010002080008020000080200010000080100000000000008000802080000000000080200010802080108000801000","description":"SP2"}},"children":[],"locations":[{"type":"absolute","value":1698595829}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08020000000202080000000008000208000200080000000008020200000200080800020008000008080000080000020008020208080002000000020808020000000000080800000000020208000200000002020000000208080002080802020008020008000202000000020008020008080000000802020800020000000000080002020800000008080002000802000000000200000202080002000800000000000200000800020008020208000200080800000800020000000000000800020808020008000002000000000808020208080000000802020000020200080000080000020808020008080200000000020808020200080000000800020800020200","description":"SP3"}},"children":[],"locations":[{"type":"absolute","value":1698595857}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01208000812000008120000080000000802080008100800001008000012000000000000000208000002080008120800081000000000000008000800001008000010000000020000000008000012080008000000000008000012000008020000081008000010000008020000080008000002000008020800081208000810000008000800001008000002080008120800081000000000000000000000000208000802000008000800081008000010000000120800081200000812000008000000081208000810000000100000000200000010080000120000080208000810080000120000080200000000080000120800080000000000080000020000080208000","description":"SP4"}},"children":[],"locations":[{"type":"absolute","value":1698595749}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00010000000108020000080200010042000008000001000000000040000008020001084000000800000100020001084000010042000008420001080000000040000000020000084000000840000000000001004000010842000108420001000200000842000100400000000000000042000108020000000200000042000108000000080000010042000100000000000200000040000008020001004200010840000100020000004000000842000108020001084000010000000000020000084200010842000108000000004200010842000008020000000000000840000000420001080000010002000100400000080000000000000008400001080200010040","description":"SP5"}},"children":[],"locations":[{"type":"absolute","value":1698595970}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"10000020000040200040000010404020000040201000000010404020000040000040002010404000000040001000002010004000004000200000002010400000000000001000400010400020004000000040400010400020100000001000402010004020000000001040400000404020104000000040400000404020000000200040002010000000100040200040400010404020000040001040000010000020000040000040002000000020104000001000002010404020004040000000402010404000004040200000000010004020100000000040000000004020104040000040000010004000104000200000000000404020000000201000400010400020","description":"SP6"}},"children":[],"locations":[{"type":"absolute","value":1698595742}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00002000020020040208000400000000000800000208000402082000000820040208200400002000000000000200000402000000000000040200200402080000000800040208200002002000000800040200000400002004000820040200200000002004000800000208000002082004000820000200000000000004000820000000000400082000000020000208000402080004020020040200200402000000020020000000000400080004000020000008200402080000020820000008200402080000020000040208200400002004000820000000000002000000020820040000000002082000000020040008000002000004000800040008000002002000","description":"SP7"}},"children":[],"locations":[{"type":"absolute","value":1698595873}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"40100010001000000000040040100410000000104010001040000000000000104000040000000410401004100010040000100410401004000010000040000000000004104000001000100010401000000010040040000400400004100010041040100000000000000000000040000410400000100010001040100400000004004010040000000400001004100010000040000000400004100010000040100400001000104000000040000010000004104000041000000010000004004010001000000000401004104000040040000010000004100010001040100010000000004010041000100400001004004010000040100000400004000000001000100410","description":"SP8"}},"children":[],"locations":[{"type":"absolute","value":1698595735}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using twofish":{"meta":{"name":"encrypt data using twofish","namespace":"data-manipulation/encryption/twofish","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","Twofish"],"objective":"Cryptography","behavior":"Encrypt Data","method":"Twofish","id":"C0027.005"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x653F801C"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using twofish\n    namespace: data-manipulation/encryption/twofish\n    authors:\n      - \"@_re_fox\"\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires bytes features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\n      - Cryptography::Encrypt Data::Twofish [C0027.005]\n    examples:\n      - 0761142efbda6c4b1e801223de723578:0x653F801C\n  features:\n    - or:\n      - bytes: A9 67 B3 E8 04 FD A3 76 9A 92 80 78 E4 DD D1 38 0D C6 35 98 18 F7 EC 6C 43 75 37 26 FA 13 94 48 F2 D0 8B 30 84 54 DF 23 19 5B 3D 59 F3 AE A2 82 63 01 83 2E D9 51 9B 7C A6 EB A5 BE 16 0C E3 61 C0 8C 3A F5 73 2C 25 0B BB 4E 89 6B 53 6A B4 F1 E1 E6 BD 45 E2 F4 B6 66 CC 95 03 56 D4 1C 1E D7 FB C3 8E B5 E9 CF BF BA EA 77 39 AF 33 C9 62 71 81 79 09 AD 24 CD F9 D8 E5 C5 B9 4D 44 08 86 E7 A1 1D AA ED 06 70 B2 D2 41 7B A0 11 31 C2 27 90 20 F6 60 FF 96 5C B1 AB 9E 9C 52 1B 5F 93 0A EF 91 85 49 EE 2D 4F 8F 3B 47 87 6D = Q0\n      - bytes: 75 F3 C6 F4 DB 7B FB C8 4A D3 E6 6B 45 7D E8 4B D6 32 D8 FD 37 71 F1 E1 30 0F F8 1B 87 FA 06 3F 5E BA AE 5B 8A 00 BC 9D 6D C1 B1 0E 80 5D D2 D5 A0 84 07 14 B5 90 2C A3 B2 73 4C 54 92 74 36 51 38 B0 BD 5A FC 60 62 96 6C 42 F7 10 7C 28 27 8C 13 95 9C C7 24 46 3B 70 CA E3 85 CB 11 D0 93 B8 A6 83 20 FF 9F 77 C3 CC 03 6F 08 BF 40 E7 2B E2 79 0C AA 82 41 3A EA B9 E4 9A A4 97 7E DA 7A 17 66 94 A1 1D 3D F0 DE B3 0B 72 A7 1C EF D1 53 3E 8F 33 26 5F EC 76 2A 49 81 88 EE 21 C4 1A EB D9 C5 39 99 CD AD 31 8B 01 18 23 DD = Q1\n      - bytes: 75 32 BC BC F3 21 EC EC C6 43 20 20 F4 C9 B3 B3 DB 03 DA DA 7B 8B 02 02 FB 2B E2 E2 C8 FA 9E 9E 4A EC C9 C9 D3 09 D4 D4 E6 6B 18 18 6B 9F 1E 1E 45 0E 98 98 7D 38 B2 B2 E8 D2 A6 A6 4B B7 26 26 D6 57 3C 3C 32 8A 93 93 D8 EE 82 82 FD 98 52 52 37 D4 7B 7B 71 37 BB BB F1 97 5B 5B E1 83 47 47 30 3C 24 24 0F E2 51 51 F8 C6 BA BA 1B F3 4A 4A 87 48 BF BF FA 70 0D 0D 06 B3 B0 B0 3F DE 75 75 5E FD D2 D2 BA 20 7D 7D AE 31 66 66 5B A3 3A 3A 8A 1C 59 59 00 00 00 00 BC 93 CD CD 9D E0 1A 1A 6D 2C AE AE C1 AB 7F 7F B1 C7 2B = MDS1\n      - bytes: 39 39 D9 A9 17 17 90 67 9C 9C 71 B3 A6 A6 D2 E8 07 07 05 04 52 52 98 FD 80 80 65 A3 E4 E4 DF 76 45 45 08 9A 4B 4B 02 92 E0 E0 A0 80 5A 5A 66 78 AF AF DD E4 6A 6A B0 DD 63 63 BF D1 2A 2A 36 38 E6 E6 54 0D 20 20 43 C6 CC CC 62 35 F2 F2 BE 98 12 12 1E 18 EB EB 24 F7 A1 A1 D7 EC 41 41 77 6C 28 28 BD 43 BC BC 32 75 7B 7B D4 37 88 88 9B 26 0D 0D 70 FA 44 44 F9 13 FB FB B1 94 7E 7E 5A 48 03 03 7A F2 8C 8C E4 D0 B6 B6 47 8B 24 24 3C 30 E7 E7 A5 84 6B 6B 41 54 DD DD 06 DF 60 60 C5 23 FD FD 45 19 3A 3A A3 5B C2 C2 68 = MDS2\n      - bytes: 32 BC 75 BC 21 EC F3 EC 43 20 C6 20 C9 B3 F4 B3 03 DA DB DA 8B 02 7B 02 2B E2 FB E2 FA 9E C8 9E EC C9 4A C9 09 D4 D3 D4 6B 18 E6 18 9F 1E 6B 1E 0E 98 45 98 38 B2 7D B2 D2 A6 E8 A6 B7 26 4B 26 57 3C D6 3C 8A 93 32 93 EE 82 D8 82 98 52 FD 52 D4 7B 37 7B 37 BB 71 BB 97 5B F1 5B 83 47 E1 47 3C 24 30 24 E2 51 0F 51 C6 BA F8 BA F3 4A 1B 4A 48 BF 87 BF 70 0D FA 0D B3 B0 06 B0 DE 75 3F 75 FD D2 5E D2 20 7D BA 7D 31 66 AE 66 A3 3A 5B 3A 1C 59 8A 59 00 00 00 00 93 CD BC CD E0 1A 9D 1A 2C AE 6D AE AB 7F C1 7F C7 2B B1 = MDS3\n      - bytes: D9 A9 39 D9 90 67 17 90 71 B3 9C 71 D2 E8 A6 D2 05 04 07 05 98 FD 52 98 65 A3 80 65 DF 76 E4 DF 08 9A 45 08 02 92 4B 02 A0 80 E0 A0 66 78 5A 66 DD E4 AF DD B0 DD 6A B0 BF D1 63 BF 36 38 2A 36 54 0D E6 54 43 C6 20 43 62 35 CC 62 BE 98 F2 BE 1E 18 12 1E 24 F7 EB 24 D7 EC A1 D7 77 6C 41 77 BD 43 28 BD 32 75 BC 32 D4 37 7B D4 9B 26 88 9B 70 FA 0D 70 F9 13 44 F9 B1 94 FB B1 5A 48 7E 5A 7A F2 03 7A E4 D0 8C E4 47 8B B6 47 3C 30 24 3C A5 84 E7 A5 41 54 6B 41 06 DF DD 06 C5 23 60 C5 45 19 FD 45 A3 5B 3A A3 68 3D C2 = MDS4\n      - bytes: 01 02 04 08 10 20 40 80 4D 9A 79 F2 A9 1F 3E 7C F8 BD 37 6E DC F5 A7 03 06 0C 18 30 60 C0 CD D7 E3 8B 5B B6 21 42 84 45 8A 59 B2 29 52 A4 05 0A 14 28 50 A0 0D 1A 34 68 D0 ED 97 63 C6 C1 CF D3 EB 9B 7B F6 A1 0F 1E 3C 78 F0 AD 17 2E 5C B8 3D 7A F4 A5 07 0E 1C 38 70 E0 8D 57 AE 11 22 44 88 5D BA 39 72 E4 85 47 8E 51 A2 09 12 24 48 90 6D DA F9 BF 33 66 CC D5 E7 83 4B 96 61 C2 C9 DF F3 AB 1B 36 6C D8 FD B7 23 46 8C 55 AA 19 32 64 C8 DD F7 A3 0B 16 2C 58 B0 2D 5A B4 25 4A 94 65 CA D9 FF B3 2B 56 AC 15 2A 54 A8 1D = EXP_TO_POLY\n      - bytes: A9 75 67 F3 B3 C6 E8 F4 04 DB FD 7B A3 FB 76 C8 9A 4A 92 D3 80 E6 78 6B E4 45 DD 7D D1 E8 38 4B 0D D6 C6 32 35 D8 98 FD 18 37 F7 71 EC F1 6C E1 43 30 75 0F 37 F8 26 1B FA 87 13 FA 94 06 48 3F F2 5E D0 BA 8B AE 30 5B 84 8A 54 00 DF BC 23 9D 19 6D 5B C1 3D B1 59 0E F3 80 AE 5D A2 D2 82 D5 63 A0 01 84 83 07 2E 14 D9 B5 51 90 9B 2C 7C A3 A6 B2 EB 73 A5 4C BE 54 16 92 0C 74 E3 36 61 51 C0 38 8C B0 3A BD F5 5A 73 FC 2C 60 25 62 0B 96 BB 6C 4E 42 89 F7 6B 10 53 7C 6A 28 B4 27 F1 8C E1 13 E6 95 BD 9C 45 C7 E2 24 F4 = CALC_SB_TBL\n","matches":[[{"type":"absolute","value":1698659556},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[{"type":"absolute","value":1698659580}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698660380},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[{"type":"absolute","value":1698660424}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[{"type":"absolute","value":1698660431}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[{"type":"absolute","value":1698660409}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698661440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[{"type":"absolute","value":1698662231}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[{"type":"absolute","value":1698662238}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[{"type":"absolute","value":1698662216}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698662270},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a967b3e804fda3769a928078e4ddd1380dc6359818f7ec6c43753726fa139448f2d08b308454df23195b3d59f3aea2826301832ed9519b7ca6eba5be160ce361c08c3af5732c250bbb4e896b536ab4f1e1e6bd45e2f4b666cc950356d41c1ed7fbc38eb5e9cfbfbaea7739af33c96271817909ad24cdf9d8e5c5b94d440886e7a11daaed0670b2d2417ba01131c2279020f660ff965cb1ab9e9c521b5f930aef918549ee2d4f8f3b47876d","description":"Q0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"75f3c6f4db7bfbc84ad3e66b457de84bd632d8fd3771f1e1300ff81b87fa063f5ebaae5b8a00bc9d6dc1b10e805dd2d5a0840714b5902ca3b2734c549274365138b0bd5afc6062966c42f7107c28278c13959cc724463b70cae385cb11d093b8a68320ff9f77c3cc036f08bf40e72be2790caa82413aeab9e49aa4977eda7a176694a11d3df0deb30b72a71cefd1533e8f33265fec762a498188ee21c41aebd9c53999cdad318b011823dd","description":"Q1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"7532bcbcf321ececc6432020f4c9b3b3db03dada7b8b0202fb2be2e2c8fa9e9e4aecc9c9d309d4d4e66b18186b9f1e1e450e98987d38b2b2e8d2a6a64bb72626d6573c3c328a9393d8ee8282fd98525237d47b7b7137bbbbf1975b5be1834747303c24240fe25151f8c6baba1bf34a4a8748bfbffa700d0d06b3b0b03fde75755efdd2d2ba207d7dae3166665ba33a3a8a1c595900000000bc93cdcd9de01a1a6d2caeaec1ab7f7fb1c72b","description":"MDS1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3939d9a9171790679c9c71b3a6a6d2e807070504525298fd808065a3e4e4df764545089a4b4b0292e0e0a0805a5a6678afafdde46a6ab0dd6363bfd12a2a3638e6e6540d202043c6cccc6235f2f2be9812121e18ebeb24f7a1a1d7ec4141776c2828bd43bcbc32757b7bd43788889b260d0d70fa4444f913fbfbb1947e7e5a4803037af28c8ce4d0b6b6478b24243c30e7e7a5846b6b4154dddd06df6060c523fdfd45193a3aa35bc2c268","description":"MDS2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"32bc75bc21ecf3ec4320c620c9b3f4b303dadbda8b027b022be2fbe2fa9ec89eecc94ac909d4d3d46b18e6189f1e6b1e0e98459838b27db2d2a6e8a6b7264b26573cd63c8a933293ee82d8829852fd52d47b377b37bb71bb975bf15b8347e1473c243024e2510f51c6baf8baf34a1b4a48bf87bf700dfa0db3b006b0de753f75fdd25ed2207dba7d3166ae66a33a5b3a1c598a590000000093cdbccde01a9d1a2cae6daeab7fc17fc72bb1","description":"MDS3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d9a939d99067179071b39c71d2e8a6d20504070598fd529865a38065df76e4df089a450802924b02a080e0a066785a66dde4afddb0dd6ab0bfd163bf36382a36540de65443c620436235cc62be98f2be1e18121e24f7eb24d7eca1d7776c4177bd4328bd3275bc32d4377bd49b26889b70fa0d70f91344f9b194fbb15a487e5a7af2037ae4d08ce4478bb6473c30243ca584e7a541546b4106dfdd06c52360c54519fd45a35b3aa3683dc2","description":"MDS4"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"01020408102040804d9a79f2a91f3e7cf8bd376edcf5a703060c183060c0cdd7e38b5bb6214284458a59b22952a4050a142850a00d1a3468d0ed9763c6c1cfd3eb9b7bf6a10f1e3c78f0ad172e5cb83d7af4a5070e1c3870e08d57ae112244885dba3972e485478e51a209122448906ddaf9bf3366ccd5e7834b9661c2c9dff3ab1b366cd8fdb723468c55aa193264c8ddf7a30b162c58b02d5ab4254a9465cad9ffb32b56ac152a54a81d","description":"EXP_TO_POLY"}},"children":[],"locations":[{"type":"absolute","value":1698662495}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"a97567f3b3c6e8f404dbfd7ba3fb76c89a4a92d380e6786be445dd7dd1e8384b0dd6c63235d898fd1837f771ecf16ce14330750f37f8261bfa8713fa9406483ff25ed0ba8bae305b848a5400dfbc239d196d5bc13db1590ef380ae5da2d282d563a0018483072e14d9b551909b2c7ca3a6b2eb73a54cbe5416920c74e3366151c0388cb03abdf55a73fc2c6025620b96bb6c4e4289f76b10537c6a28b427f18ce113e695bd9c45c7e224f4","description":"CALC_SB_TBL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using Camellia":{"meta":{"name":"encrypt data using Camellia","namespace":"data-manipulation/encryption/camellia","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","Camellia"],"objective":"Cryptography","behavior":"Encrypt Data","method":"Camellia","id":"C0027.003"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x6541CD50","112f9f0e8d349858a80dd8c14190e620:0x4CE3B2"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using Camellia\n    namespace: data-manipulation/encryption/camellia\n    authors:\n      - '@_re_fox'\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires bytes features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\n      - Cryptography::Encrypt Data::Camellia [C0027.003]\n    examples:\n      - 0761142efbda6c4b1e801223de723578:0x6541CD50\n      - 112f9f0e8d349858a80dd8c14190e620:0x4CE3B2\n  features:\n    - or:\n      - bytes: 00 70 70 70 00 82 82 82 00 2c 2c 2c 00 ec ec ec 00 b3 b3 b3 00 27 27 27 00 c0 c0 c0 00 e5 e5 e5 00 e4 e4 e4 00 85 85 85 00 57 57 57 00 35 35 35 00 ea ea ea 00 0c 0c 0c 00 ae ae ae 00 41 41 41 00 23 23 23 00 ef ef ef 00 6b 6b 6b 00 93 93 93 00 45 45 45 00 19 19 19 00 a5 a5 a5 00 21 21 21 00 ed ed ed 00 0e 0e 0e 00 4f 4f 4f 00 4e 4e 4e 00 1d 1d 1d 00 65 65 65 00 92 92 92 00 bd bd bd 00 86 86 86 00 b8 b8 b8 00 af af af 00 8f 8f 8f 00 7c 7c 7c 00 eb eb eb 00 1f 1f 1f 00 ce ce ce 00 3e 3e 3e 00 30 30 30 00 dc dc = libgcrypt_sp1110\n      - bytes: e0 e0 e0 00 05 05 05 00 58 58 58 00 d9 d9 d9 00 67 67 67 00 4e 4e 4e 00 81 81 81 00 cb cb cb 00 c9 c9 c9 00 0b 0b 0b 00 ae ae ae 00 6a 6a 6a 00 d5 d5 d5 00 18 18 18 00 5d 5d 5d 00 82 82 82 00 46 46 46 00 df df df 00 d6 d6 d6 00 27 27 27 00 8a 8a 8a 00 32 32 32 00 4b 4b 4b 00 42 42 42 00 db db db 00 1c 1c 1c 00 9e 9e 9e 00 9c 9c 9c 00 3a 3a 3a 00 ca ca ca 00 25 25 25 00 7b 7b 7b 00 0d 0d 0d 00 71 71 71 00 5f 5f 5f 00 1f 1f 1f 00 f8 f8 f8 00 d7 d7 d7 00 3e 3e 3e 00 9d 9d 9d 00 7c 7c 7c 00 60 60 60 00 b9 b9 b9 = libgcrypt_sp0222\n      - bytes: 38 38 00 38 41 41 00 41 16 16 00 16 76 76 00 76 d9 d9 00 d9 93 93 00 93 60 60 00 60 f2 f2 00 f2 72 72 00 72 c2 c2 00 c2 ab ab 00 ab 9a 9a 00 9a 75 75 00 75 06 06 00 06 57 57 00 57 a0 a0 00 a0 91 91 00 91 f7 f7 00 f7 b5 b5 00 b5 c9 c9 00 c9 a2 a2 00 a2 8c 8c 00 8c d2 d2 00 d2 90 90 00 90 f6 f6 00 f6 07 07 00 07 a7 a7 00 a7 27 27 00 27 8e 8e 00 8e b2 b2 00 b2 49 49 00 49 de de 00 de 43 43 00 43 5c 5c 00 5c d7 d7 00 d7 c7 c7 00 c7 3e 3e 00 3e f5 f5 00 f5 8f 8f 00 8f 67 67 00 67 1f 1f 00 1f 18 18 00 18 6e 6e 00 = libgcrypt_sp3033\n      - bytes: 70 00 70 70 2c 00 2c 2c b3 00 b3 b3 c0 00 c0 c0 e4 00 e4 e4 57 00 57 57 ea 00 ea ea ae 00 ae ae 23 00 23 23 6b 00 6b 6b 45 00 45 45 a5 00 a5 a5 ed 00 ed ed 4f 00 4f 4f 1d 00 1d 1d 92 00 92 92 86 00 86 86 af 00 af af 7c 00 7c 7c 1f 00 1f 1f 3e 00 3e 3e dc 00 dc dc 5e 00 5e 5e 0b 00 0b 0b a6 00 a6 a6 39 00 39 39 d5 00 d5 d5 5d 00 5d 5d d9 00 d9 d9 5a 00 5a 5a 51 00 51 51 6c 00 6c 6c 8b 00 8b 8b 9a 00 9a 9a fb 00 fb fb b0 00 b0 b0 74 00 74 74 2b 00 2b 2b f0 00 f0 f0 84 00 84 84 df 00 df df cb 00 cb cb 34 00 34 = libgcrypt_sp4404\n      - bytes: 70 82 2c ec b3 27 c0 e5 e4 85 57 35 ea 0c ae 41 23 ef 6b 93 45 19 a5 21 ed 0e 4f 4e 1d 65 92 bd 86 b8 af 8f 7c eb 1f ce 3e 30 dc 5f 5e c5 0b 1a a6 e1 39 ca d5 47 5d 3d d9 01 5a d6 51 56 6c 4d 8b 0d 9a 66 fb cc b0 2d 74 12 2b 20 f0 b1 84 99 df 4c cb c2 34 7e 76 05 6d b7 a9 31 d1 17 04 d7 14 58 3a 61 de 1b 11 1c 32 0f 9c 16 53 18 f2 22 fe 44 cf b2 c3 b5 7a 91 24 08 e8 a8 60 fc 69 50 aa d0 a0 7d a1 89 62 97 54 5b 1e 95 e0 ff 64 d2 10 c4 00 48 a3 f7 75 db 8a 03 e6 da 09 3f dd 94 87 5c 83 02 cd 4a 90 33 73 67 f6 f3 9d 7f bf e2 52 9b d8 26 c8 37 c6 3b 81 96 6f 4b 13 be 63 2e e9 79 a7 8c 9f 6e bc 8e 29 f5 f9 b6 2f fd b4 59 78 98 06 6a e7 46 71 ba d4 25 ab 42 88 a2 8d fa 72 07 b9 55 f8 ee ac 0a 36 49 2a 68 3c 38 f1 a4 40 28 d3 7b bb c9 43 c1 15 e3 ad f4 77 c7 80 9e = calccrypto_sbox\n      - or:\n        - and:\n          - number: 0x3bcc908b = CAMELLIA_SIGMA1R\n          - number: 0xa09e667f = CAMELLIA_SIGMA1L\n          - number: 0x4caa73b2 = CAMELLIA_SIGMA2R\n          - number: 0xb67ae858 = CAMELLIA_SIGMA2L\n          - number: 0xc6ef372f = CAMELLIA_SIGMA3L\n          - number: 0xe94f82be = CAMELLIA_SIGMA3R\n          - number: 0x54ff53a5 = CAMELLIA_SIGMA4L\n          - number: 0xf1d36f1c = CAMELLIA_SIGMA4R\n          - number: 0x10e527fa = CAMELLIA_SIGMA5L\n          - number: 0xde682d1d = CAMELLIA_SIGMA5R\n          - number: 0xb05688c2 = CAMELLIA_SIGMA6L\n          - number: 0xb3e6c1fd = CAMELLIA_SIGMA6R\n        - and:\n          - bytes: 8b 90 cc 3b 7f 66 9e a0 = sigma1\n          - bytes: b2 73 aa 4c 58 e8 7a b6 = sigma2\n          - bytes: be 82 4f e9 2f 37 ef c6 = sigma3\n          - bytes: 1c 6f d3 f1 a5 53 ff 54 = sigma4\n          - bytes: 1d 2d 68 de fa 27 e5 10 = sigma5\n          - bytes: fd c1 e6 b3 c2 88 56 b0 = sigma6\n        - and:\n          - string: /A09E667F3BCC908B/i\n            description: sigma1_str\n          - string: \"/B67AE8584CAA73B\"\n            description: sigma2_str\n          - string: /C6EF372FE94F82BE/i\n            description: sigma3_str\n          - string: /54FF53A5F1D36F1C/i\n            description: sigma4_str\n          - string: /10E527FADE682D1D/i\n            description: sigma5_str\n          - string: /B05688C2B3E6C1FD/i\n            description: sigma6_str\n","matches":[[{"type":"absolute","value":1698811216},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698811883}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698811869}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698811468}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698811765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698811793}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698811839}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698811989}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698811977}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698812098}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698812105}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698812224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698812231}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698813712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698815168},{"type":"absolute","value":1698815200},{"type":"absolute","value":1698814692},{"type":"absolute","value":1698815366},{"type":"absolute","value":1698814890},{"type":"absolute","value":1698814609},{"type":"absolute","value":1698815028},{"type":"absolute","value":1698815060},{"type":"absolute","value":1698815285},{"type":"absolute","value":1698814938}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698814591}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698814629}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698814533}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698814598}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698814603}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698814739}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698814744}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698814861}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698814872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698814995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698815010}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[{"type":"absolute","value":1698815141}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[{"type":"absolute","value":1698815147}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[{"type":"absolute","value":1698815292}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[{"type":"absolute","value":1698815303}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698817344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698817356}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698817363}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698817370}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698817377}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698819552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698819564}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698819571}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698819578}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698819585}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698821760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698821772}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698821779}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698821786}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698821793}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698824720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698824732}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698824739}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698824746}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698824753}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698811216},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698811883}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698811869}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698811468}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698811765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698811793}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698811839}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698811989}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698811977}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698812098}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698812105}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698812224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698812231}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698813712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[{"type":"absolute","value":1698815168},{"type":"absolute","value":1698815200},{"type":"absolute","value":1698814692},{"type":"absolute","value":1698815366},{"type":"absolute","value":1698814890},{"type":"absolute","value":1698814609},{"type":"absolute","value":1698815028},{"type":"absolute","value":1698815060},{"type":"absolute","value":1698815285},{"type":"absolute","value":1698814938}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[{"type":"absolute","value":1698814591}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[{"type":"absolute","value":1698814629}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[{"type":"absolute","value":1698814533}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[{"type":"absolute","value":1698814598}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[{"type":"absolute","value":1698814603}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[{"type":"absolute","value":1698814739}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[{"type":"absolute","value":1698814744}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[{"type":"absolute","value":1698814861}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[{"type":"absolute","value":1698814872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[{"type":"absolute","value":1698814995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[{"type":"absolute","value":1698815010}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[{"type":"absolute","value":1698815141}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[{"type":"absolute","value":1698815147}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[{"type":"absolute","value":1698815292}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[{"type":"absolute","value":1698815303}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698889168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"0070707000828282002c2c2c00ececec00b3b3b30027272700c0c0c000e5e5e500e4e4e400858585005757570035353500eaeaea000c0c0c00aeaeae004141410023232300efefef006b6b6b00939393004545450019191900a5a5a50021212100ededed000e0e0e004f4f4f004e4e4e001d1d1d006565650092929200bdbdbd0086868600b8b8b800afafaf008f8f8f007c7c7c00ebebeb001f1f1f00cecece003e3e3e0030303000dcdc","description":"libgcrypt_sp1110"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"e0e0e0000505050058585800d9d9d900676767004e4e4e0081818100cbcbcb00c9c9c9000b0b0b00aeaeae006a6a6a00d5d5d500181818005d5d5d008282820046464600dfdfdf00d6d6d600272727008a8a8a00323232004b4b4b0042424200dbdbdb001c1c1c009e9e9e009c9c9c003a3a3a00cacaca00252525007b7b7b000d0d0d00717171005f5f5f001f1f1f00f8f8f800d7d7d7003e3e3e009d9d9d007c7c7c0060606000b9b9b9","description":"libgcrypt_sp0222"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"38380038414100411616001676760076d9d900d99393009360600060f2f200f272720072c2c200c2abab00ab9a9a009a757500750606000657570057a0a000a091910091f7f700f7b5b500b5c9c900c9a2a200a28c8c008cd2d200d290900090f6f600f607070007a7a700a7272700278e8e008eb2b200b249490049dede00de434300435c5c005cd7d700d7c7c700c73e3e003ef5f500f58f8f008f676700671f1f001f181800186e6e00","description":"libgcrypt_sp3033"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"700070702c002c2cb300b3b3c000c0c0e400e4e457005757ea00eaeaae00aeae230023236b006b6b45004545a500a5a5ed00eded4f004f4f1d001d1d9200929286008686af00afaf7c007c7c1f001f1f3e003e3edc00dcdc5e005e5e0b000b0ba600a6a639003939d500d5d55d005d5dd900d9d95a005a5a510051516c006c6c8b008b8b9a009a9afb00fbfbb000b0b0740074742b002b2bf000f0f084008484df00dfdfcb00cbcb340034","description":"libgcrypt_sp4404"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"70822cecb327c0e5e4855735ea0cae4123ef6b934519a521ed0e4f4e1d6592bd86b8af8f7ceb1fce3e30dc5f5ec50b1aa6e139cad5475d3dd9015ad651566c4d8b0d9a66fbccb02d74122b20f0b18499df4ccbc2347e76056db7a931d11704d714583a61de1b111c320f9c165318f222fe44cfb2c3b57a912408e8a860fc6950aad0a07da1896297545b1e95e0ff64d210c40048a3f775db8a03e6da093fdd94875c8302cd4a90337367f6f39d7fbfe2529bd826c837c63b81966f4b13be632ee979a78c9f6ebc8e29f5f9b62ffdb4597898066ae74671bad425ab4288a28dfa7207b955f8eeac0a36492a683c38f1a44028d37bbbc943c115e3adf477c7809e","description":"calccrypto_sbox"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1003262091,"description":"CAMELLIA_SIGMA1R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2694735487,"description":"CAMELLIA_SIGMA1L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1286239154,"description":"CAMELLIA_SIGMA2R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3061508184,"description":"CAMELLIA_SIGMA2L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3337565999,"description":"CAMELLIA_SIGMA3L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3914302142,"description":"CAMELLIA_SIGMA3R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1426019237,"description":"CAMELLIA_SIGMA4L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4057165596,"description":"CAMELLIA_SIGMA4R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":283453434,"description":"CAMELLIA_SIGMA5L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3731369245,"description":"CAMELLIA_SIGMA5R"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2958461122,"description":"CAMELLIA_SIGMA6L"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3018244605,"description":"CAMELLIA_SIGMA6R"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"8b90cc3b7f669ea0","description":"sigma1"}},"children":[],"locations":[{"type":"absolute","value":1698889251}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"b273aa4c58e87ab6","description":"sigma2"}},"children":[],"locations":[{"type":"absolute","value":1698889468}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"be824fe92f37efc6","description":"sigma3"}},"children":[],"locations":[{"type":"absolute","value":1698889685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1c6fd3f1a553ff54","description":"sigma4"}},"children":[],"locations":[{"type":"absolute","value":1698889906}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"1d2d68defa27e510","description":"sigma5"}},"children":[],"locations":[{"type":"absolute","value":1698890161}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"fdc1e6b3c28856b0","description":"sigma6"}},"children":[],"locations":[{"type":"absolute","value":1698890378}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/A09E667F3BCC908B/i","description":"sigma1_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"/B67AE8584CAA73B","description":"sigma2_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/C6EF372FE94F82BE/i","description":"sigma3_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/54FF53A5F1D36F1C/i","description":"sigma4_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/10E527FADE682D1D/i","description":"sigma5_str"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/B05688C2B3E6C1FD/i","description":"sigma6_str"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using Curve25519":{"meta":{"name":"encrypt data using Curve25519","namespace":"data-manipulation/encryption/elliptic-curve","authors":["dimiter.andonov@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[],"references":[],"examples":["0a0882b8da225406cc838991b5f67d11:0x4135f6","0a0882b8da225406cc838991b5f67d11:0x416f51","80372de850597bd9e7e021a94f13f0a1:0x406480","80372de850597bd9e7e021a94f13f0a1:0x4086f4","b4a07cdd640bbaef21cd0493b4d62675:0x4098af"],"description":"Targets code that enforces Curve25519's secret key restrictions. The specification states \"The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32 uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte.\"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using Curve25519\n    namespace: data-manipulation/encryption/elliptic-curve\n    authors:\n      - dimiter.andonov@mandiant.com\n    description: Targets code that enforces Curve25519's secret key restrictions. The specification states \"The legitimate users are assumed to generate independent uniform random secret keys. A user can, for example, generate 32 uniform random bytes, clear bits 0, 1, 2 of the first byte, clear bit 7 of the last byte, and set bit 6 of the last byte.\"\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires mnemonic features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    examples:\n      - 0a0882b8da225406cc838991b5f67d11:0x4135f6\n      - 0a0882b8da225406cc838991b5f67d11:0x416f51\n      - 80372de850597bd9e7e021a94f13f0a1:0x406480\n      - 80372de850597bd9e7e021a94f13f0a1:0x4086f4\n      - b4a07cdd640bbaef21cd0493b4d62675:0x4098af\n  features:\n    # Common corresponding C source code:\n    #    e[0] &= 0xf8;\n    #   e[31] &= 0x7f;\n    #   e[31] |= 0x40;\n    - and:\n      - instruction:\n        - description: clear bits 0, 1, and 2 of the first byte\n        - mnemonic: and\n        - number: 0xf8\n      - or:\n        - instruction:\n          - description: clear bit 7 of the last byte\n          - mnemonic: and\n          - number: 0x7f\n        - instruction:\n          - description: clear bits 6 and 7 of the last byte; clearing bit 6 in addition to bit 7 is fine because bit 6 is ultimately set\n          - mnemonic: and\n          - number: 0x3f\n      - instruction:\n        - description: set bit 6 of the last byte\n        - mnemonic: or\n        - number: 0x40\n","matches":[[{"type":"absolute","value":1699032508},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699032554}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699032554}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699032554}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699032566}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699032566}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699032566}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699032563}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":127}},"children":[],"locations":[{"type":"absolute","value":1699032563}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699032563}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/df228712fa7a4a9bbf1198ada07295a1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699034480},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699034523}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699034523}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699034523}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699034533}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699034533}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699034533}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699034530}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":127}},"children":[],"locations":[{"type":"absolute","value":1699034530}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699034530}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/df228712fa7a4a9bbf1198ada07295a1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052157},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052160}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699052160}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052160}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699052170}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699052170}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052170}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/ffc258a49e9e420a9c7b923ea529eecb"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052167}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63}},"children":[],"locations":[{"type":"absolute","value":1699052167}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052167}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052591},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052595}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":248}},"children":[],"locations":[{"type":"absolute","value":1699052595}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052595}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":1699052618}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64}},"children":[],"locations":[{"type":"absolute","value":1699052618}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052618}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"encrypt data using Curve25519/ffc258a49e9e420a9c7b923ea529eecb"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":1699052615}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63}},"children":[],"locations":[{"type":"absolute","value":1699052615}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699052615}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using tiger":{"meta":{"name":"hash data using tiger","namespace":"data-manipulation/hashing/tiger","authors":["@_re_fox"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","Tiger"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"Tiger","id":"C0029.005"}],"references":[],"examples":["0761142efbda6c4b1e801223de723578:0x65471B97"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data using tiger\n    namespace: data-manipulation/hashing/tiger\n    authors:\n      - \"@_re_fox\"\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires characteristic, bytes, mnemonic features\n    mbc:\n      - Cryptography::Cryptographic Hash::Tiger [C0029.005]\n    examples:\n      - 0761142efbda6c4b1e801223de723578:0x65471B97\n  features:\n    - or:\n      - bytes: 5e 0c e9 f7 7c b1 aa 02 ec a8 43 e2 03 4b 42 ac d3 fc d5 0d e3 5b cd 72 3a 7f f9 f6 93 9b 01 6d 93 91 1f d2 ff 78 99 cd e2 29 80 70 c9 a1 73 75 c3 83 2a 92 6b 32 64 b1 70 58 91 04 ee 3e 88 46 e6 ec 03 71 05 e3 ac ea 5c 53 a3 08 b8 69 41 c5 7c c4 de 8d 91 54 e7 4c 0c f4 0d dc df f4 a2 0a fa be 4d a7 18 6f b7 10 6a ab d1 5a 23 b6 cc c6 ff e2 2f 57 21 61 72 13 1e 92 9d 19 6f 8c 48 1a ca 07 00 da f4 f9 c9 4b c7 41 52 e8 f6 e6 f5 26 b6 47 59 ea db 79 90 85 92 8c 9e c9 c5 85 18 4f 4b 86 6f a9 1e 76 8e d7 7d c1 b5 = sbox1\n      - bytes: 38 21 a1 05 5a be a6 e6 98 7c f8 b4 a5 22 a1 b5 90 69 0b 14 89 60 3c 56 d5 5d 1f 39 2e cb 46 4c 34 94 b7 c9 db ad 32 d9 f5 af 15 20 e4 70 ea 08 f1 8c 47 3e 67 a6 65 d7 99 8d 27 ab 7e 75 fb c4 92 06 6e 2d 86 c6 11 df 16 3b 7f 0d f1 84 eb dd 04 ea 65 a6 04 f6 2e 6f b3 df e0 f0 0f 0f 8e 4a 51 ba bc 3d f8 ee ed a5 1e 37 a4 0e 2a 0a 4f fc 29 84 b3 5c a8 1d 3e e8 e2 1c 1b ba 82 f8 8f dc 0d e8 53 83 5e 50 45 cd 17 07 db d4 00 9a d1 18 01 81 f3 a5 ed cf a0 34 f2 ca 87 88 51 7e e7 0b 36 51 c4 b3 38 14 34 1e f9 cc 89 = sbox2\n      - bytes: 9b f3 da f1 2f cc 9f f4 81 92 f2 6f c6 d5 7f 48 3f a8 dc fc 67 06 a3 e8 63 ce fc d2 e3 4b 9b 2c c2 bb fb 93 4b f7 3f da 66 ba 70 fe d2 65 a1 2f d4 93 0e 97 79 e2 03 a1 71 5e e4 b0 77 ec cd be 97 e4 85 39 72 1e b4 cf 17 50 f7 5e 02 aa 0a b7 e0 b8 40 38 f0 09 23 d4 79 85 89 35 d0 1a fc 8e c5 ab b2 e2 0b 92 c6 96 72 91 5a 37 63 41 af 66 fb 27 71 ca dc ab 74 21 41 ff 72 4a a6 ce 3c b3 a5 66 30 08 33 49 4a f0 f5 9a 28 d7 cd 0a 97 8d 5e c2 c8 31 e0 e8 96 8f 47 5d 87 76 22 c0 fe f3 dd 90 61 05 10 f3 7b ec 91 14 0f = sbox3\n      - bytes: 55 3c 32 26 85 60 0e 5b f5 59 1b fa a9 c1 46 1a fa 8f 4c 7c a1 45 e2 a9 d7 55 29 db 59 51 ca 65 c2 af 35 ce 76 0a db 05 45 3d 11 a9 7e c7 ea 81 0d 0a ac b6 8a f8 8e 52 ff e3 7b 59 53 a2 9e a0 56 cd 48 ac b3 df 0d 43 6f e4 5c f4 7a a6 b3 c4 5e d0 e2 fb d8 cf ce 4e f0 35 99 b3 10 6f f5 3e c6 19 d6 9c 82 d6 22 0b 69 20 df 74 0a 46 fd 17 40 ed 10 85 8e cc f8 6c a7 ca 6e 3a bf 24 c8 d6 49 70 81 1a 58 3d 24 61 a2 63 c1 bb b6 ac 8b 04 32 cc 44 7d c2 8a a3 d9 ab 10 f4 aa 5b ff dd 7f 4b 82 04 a8 5a 49 6d ad 94 9f 8c = sbox4\n      - and:\n        - description: tiger key schedule\n        - number: 0xa5a5a5a5a5a5a5a5\n        - number: 0x0123456789abcdef\n        - number: 0x13\n        - number: 0x17\n        - count(mnemonic(shr)): 2 or more\n        - count(mnemonic(shl)): 2 or more\n        - characteristic: nzxor\n","matches":[[{"type":"absolute","value":1699158935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"5e0ce9f77cb1aa02eca843e2034b42acd3fcd50de35bcd723a7ff9f6939b016d93911fd2ff7899cde2298070c9a17375c3832a926b3264b170589104ee3e8846e6ec037105e3acea5c53a308b86941c57cc4de8d9154e74c0cf40ddcdff4a20afabe4da7186fb7106aabd15a23b6ccc6ffe22f57216172131e929d196f8c481aca0700daf4f9c94bc74152e8f6e6f526b64759eadb799085928c9ec9c585184f4b866fa91e768ed77dc1b5","description":"sbox1"}},"children":[],"locations":[{"type":"absolute","value":1699158975}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3821a1055abea6e6987cf8b4a522a1b590690b1489603c56d55d1f392ecb464c3494b7c9dbad32d9f5af1520e470ea08f18c473e67a665d7998d27ab7e75fbc492066e2d86c611df163b7f0df184ebdd04ea65a604f62e6fb3dfe0f00f0f8e4a51babc3df8eeeda51e37a40e2a0a4ffc2984b35ca81d3ee8e21c1bba82f88fdc0de853835e5045cd1707dbd4009ad1180181f3a5edcfa034f2ca8788517ee70b3651c4b33814341ef9cc89","description":"sbox2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"9bf3daf12fcc9ff48192f26fc6d57f483fa8dcfc6706a3e863cefcd2e34b9b2cc2bbfb934bf73fda66ba70fed265a12fd4930e9779e203a1715ee4b077eccdbe97e48539721eb4cf1750f75e02aa0ab7e0b84038f00923d479858935d01afc8ec5abb2e20b92c69672915a376341af66fb2771cadcab742141ff724aa6ce3cb3a566300833494af0f59a28d7cd0a978d5ec2c831e0e8968f475d877622c0fef3dd90610510f37bec91140f","description":"sbox3"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"553c322685600e5bf5591bfaa9c1461afa8f4c7ca145e2a9d75529db5951ca65c2af35ce760adb05453d11a97ec7ea810d0aacb68af88e52ffe37b5953a29ea056cd48acb3df0d436fe45cf47aa6b3c45ed0e2fbd8cfce4ef03599b3106ff53ec619d69c82d6220b6920df740a46fd1740ed10858eccf86ca7ca6e3abf24c8d64970811a583d2461a263c1bbb6ac8b0432cc447dc28aa3d9ab10f4aa5bffdd7f4b8204a85a496dad949f8c","description":"sbox4"}},"children":[],"locations":[{"type":"absolute","value":1699158982}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"tiger key schedule"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11936128518282651045}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":81985529216486895}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":19}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":23}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shr"}}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shl"}}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699158994},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"5e0ce9f77cb1aa02eca843e2034b42acd3fcd50de35bcd723a7ff9f6939b016d93911fd2ff7899cde2298070c9a17375c3832a926b3264b170589104ee3e8846e6ec037105e3acea5c53a308b86941c57cc4de8d9154e74c0cf40ddcdff4a20afabe4da7186fb7106aabd15a23b6ccc6ffe22f57216172131e929d196f8c481aca0700daf4f9c94bc74152e8f6e6f526b64759eadb799085928c9ec9c585184f4b866fa91e768ed77dc1b5","description":"sbox1"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"3821a1055abea6e6987cf8b4a522a1b590690b1489603c56d55d1f392ecb464c3494b7c9dbad32d9f5af1520e470ea08f18c473e67a665d7998d27ab7e75fbc492066e2d86c611df163b7f0df184ebdd04ea65a604f62e6fb3dfe0f00f0f8e4a51babc3df8eeeda51e37a40e2a0a4ffc2984b35ca81d3ee8e21c1bba82f88fdc0de853835e5045cd1707dbd4009ad1180181f3a5edcfa034f2ca8788517ee70b3651c4b33814341ef9cc89","description":"sbox2"}},"children":[],"locations":[{"type":"absolute","value":1699160770},{"type":"absolute","value":1699161064},{"type":"absolute","value":1699160040},{"type":"absolute","value":1699160329},{"type":"absolute","value":1699160623},{"type":"absolute","value":1699161359},{"type":"absolute","value":1699159057},{"type":"absolute","value":1699161620},{"type":"absolute","value":1699160917},{"type":"absolute","value":1699161211},{"type":"absolute","value":1699160476}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"9bf3daf12fcc9ff48192f26fc6d57f483fa8dcfc6706a3e863cefcd2e34b9b2cc2bbfb934bf73fda66ba70fed265a12fd4930e9779e203a1715ee4b077eccdbe97e48539721eb4cf1750f75e02aa0ab7e0b84038f00923d479858935d01afc8ec5abb2e20b92c69672915a376341af66fb2771cadcab742141ff724aa6ce3cb3a566300833494af0f59a28d7cd0a978d5ec2c831e0e8968f475d877622c0fef3dd90610510f37bec91140f","description":"sbox3"}},"children":[],"locations":[{"type":"absolute","value":1699161729},{"type":"absolute","value":1699160006},{"type":"absolute","value":1699161030},{"type":"absolute","value":1699161670},{"type":"absolute","value":1699160971},{"type":"absolute","value":1699160589},{"type":"absolute","value":1699161530},{"type":"absolute","value":1699160530},{"type":"absolute","value":1699161177},{"type":"absolute","value":1699159068},{"type":"absolute","value":1699161118},{"type":"absolute","value":1699160736},{"type":"absolute","value":1699160677},{"type":"absolute","value":1699160295},{"type":"absolute","value":1699160236},{"type":"absolute","value":1699161325},{"type":"absolute","value":1699161266},{"type":"absolute","value":1699160883},{"type":"absolute","value":1699161586},{"type":"absolute","value":1699161855},{"type":"absolute","value":1699160824},{"type":"absolute","value":1699160442},{"type":"absolute","value":1699160383}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"553c322685600e5bf5591bfaa9c1461afa8f4c7ca145e2a9d75529db5951ca65c2af35ce760adb05453d11a97ec7ea810d0aacb68af88e52ffe37b5953a29ea056cd48acb3df0d436fe45cf47aa6b3c45ed0e2fbd8cfce4ef03599b3106ff53ec619d69c82d6220b6920df740a46fd1740ed10858eccf86ca7ca6e3abf24c8d64970811a583d2461a263c1bbb6ac8b0432cc447dc28aa3d9ab10f4aa5bffdd7f4b8204a85a496dad949f8c","description":"sbox4"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"tiger key schedule"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11936128518282651045}},"children":[],"locations":[{"type":"absolute","value":1699161384},{"type":"absolute","value":1699160058}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":81985529216486895}},"children":[],"locations":[{"type":"absolute","value":1699160187},{"type":"absolute","value":1699162365}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":19}},"children":[],"locations":[{"type":"absolute","value":1699161416},{"type":"absolute","value":1699160149},{"type":"absolute","value":1699160102},{"type":"absolute","value":1699161463}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23}},"children":[],"locations":[{"type":"absolute","value":1699160171},{"type":"absolute","value":1699160124},{"type":"absolute","value":1699161485},{"type":"absolute","value":1699161438}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shr"}}},"children":[],"locations":[{"type":"absolute","value":1699161600},{"type":"absolute","value":1699160321},{"type":"absolute","value":1699159554},{"type":"absolute","value":1699160577},{"type":"absolute","value":1699162116},{"type":"absolute","value":1699161095},{"type":"absolute","value":1699161351},{"type":"absolute","value":1699159050},{"type":"absolute","value":1699159818},{"type":"absolute","value":1699159564},{"type":"absolute","value":1699161612},{"type":"absolute","value":1699159310},{"type":"absolute","value":1699160847},{"type":"absolute","value":1699161869},{"type":"absolute","value":1699161106},{"type":"absolute","value":1699159321},{"type":"absolute","value":1699161881},{"type":"absolute","value":1699160603},{"type":"absolute","value":1699162141},{"type":"absolute","value":1699162402},{"type":"absolute","value":1699159846},{"type":"absolute","value":1699160615},{"type":"absolute","value":1699159592},{"type":"absolute","value":1699160360},{"type":"absolute","value":1699160871},{"type":"absolute","value":1699162152},{"type":"absolute","value":1699161644},{"type":"absolute","value":1699161906},{"type":"absolute","value":1699159091},{"type":"absolute","value":1699160371},{"type":"absolute","value":1699161141},{"type":"absolute","value":1699162421},{"type":"absolute","value":1699161655},{"type":"absolute","value":1699159352},{"type":"absolute","value":1699159867},{"type":"absolute","value":1699160124},{"type":"absolute","value":1699161917},{"type":"absolute","value":1699159616},{"type":"absolute","value":1699160897},{"type":"absolute","value":1699162433},{"type":"absolute","value":1699162180},{"type":"absolute","value":1699159373},{"type":"absolute","value":1699160654},{"type":"absolute","value":1699160909},{"type":"absolute","value":1699161165},{"type":"absolute","value":1699159889},{"type":"absolute","value":1699159122},{"type":"absolute","value":1699159635},{"type":"absolute","value":1699160406},{"type":"absolute","value":1699162455},{"type":"absolute","value":1699160665},{"type":"absolute","value":1699161945},{"type":"absolute","value":1699162201},{"type":"absolute","value":1699159901},{"type":"absolute","value":1699161438},{"type":"absolute","value":1699159647},{"type":"absolute","value":1699159392},{"type":"absolute","value":1699161693},{"type":"absolute","value":1699162465},{"type":"absolute","value":1699159143},{"type":"absolute","value":1699161191},{"type":"absolute","value":1699160171},{"type":"absolute","value":1699159404},{"type":"absolute","value":1699160430},{"type":"absolute","value":1699162223},{"type":"absolute","value":1699161969},{"type":"absolute","value":1699159155},{"type":"absolute","value":1699160948},{"type":"absolute","value":1699161203},{"type":"absolute","value":1699161717},{"type":"absolute","value":1699159931},{"type":"absolute","value":1699160700},{"type":"absolute","value":1699159677},{"type":"absolute","value":1699162235},{"type":"absolute","value":1699160959},{"type":"absolute","value":1699162493},{"type":"absolute","value":1699161988},{"type":"absolute","value":1699159942},{"type":"absolute","value":1699159688},{"type":"absolute","value":1699160456},{"type":"absolute","value":1699159434},{"type":"absolute","value":1699161485},{"type":"absolute","value":1699161743},{"type":"absolute","value":1699162000},{"type":"absolute","value":1699159444},{"type":"absolute","value":1699160213},{"type":"absolute","value":1699160468},{"type":"absolute","value":1699160724},{"type":"absolute","value":1699159192},{"type":"absolute","value":1699162260},{"type":"absolute","value":1699161243},{"type":"absolute","value":1699161755},{"type":"absolute","value":1699162270},{"type":"absolute","value":1699160224},{"type":"absolute","value":1699159970},{"type":"absolute","value":1699159203},{"type":"absolute","value":1699160994},{"type":"absolute","value":1699161507},{"type":"absolute","value":1699161254},{"type":"absolute","value":1699159719},{"type":"absolute","value":1699162025},{"type":"absolute","value":1699160750},{"type":"absolute","value":1699161518},{"type":"absolute","value":1699159472},{"type":"absolute","value":1699161780},{"type":"absolute","value":1699162036},{"type":"absolute","value":1699159994},{"type":"absolute","value":1699160507},{"type":"absolute","value":1699160762},{"type":"absolute","value":1699161018},{"type":"absolute","value":1699162298},{"type":"absolute","value":1699159743},{"type":"absolute","value":1699159231},{"type":"absolute","value":1699161791},{"type":"absolute","value":1699160259},{"type":"absolute","value":1699159493},{"type":"absolute","value":1699160518},{"type":"absolute","value":1699161289},{"type":"absolute","value":1699162319},{"type":"absolute","value":1699162064},{"type":"absolute","value":1699161553},{"type":"absolute","value":1699159762},{"type":"absolute","value":1699159252},{"type":"absolute","value":1699160020},{"type":"absolute","value":1699161044},{"type":"absolute","value":1699159512},{"type":"absolute","value":1699160283},{"type":"absolute","value":1699159039},{"type":"absolute","value":1699161819},{"type":"absolute","value":1699159774},{"type":"absolute","value":1699160032},{"type":"absolute","value":1699160801},{"type":"absolute","value":1699161056},{"type":"absolute","value":1699161313},{"type":"absolute","value":1699159524},{"type":"absolute","value":1699162085},{"type":"absolute","value":1699161574},{"type":"absolute","value":1699159271},{"type":"absolute","value":1699162338},{"type":"absolute","value":1699160553},{"type":"absolute","value":1699160812},{"type":"absolute","value":1699162350},{"type":"absolute","value":1699159283},{"type":"absolute","value":1699161843},{"type":"absolute","value":1699160309},{"type":"absolute","value":1699162104},{"type":"absolute","value":1699161339},{"type":"absolute","value":1699159807}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"shl"}}},"children":[],"locations":[{"type":"absolute","value":1699161416},{"type":"absolute","value":1699160149},{"type":"absolute","value":1699160102},{"type":"absolute","value":1699161463}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699161089},{"type":"absolute","value":1699160068},{"type":"absolute","value":1699161604},{"type":"absolute","value":1699162124},{"type":"absolute","value":1699160596},{"type":"absolute","value":1699160085},{"type":"absolute","value":1699162135},{"type":"absolute","value":1699159576},{"type":"absolute","value":1699161627},{"type":"absolute","value":1699160607},{"type":"absolute","value":1699159584},{"type":"absolute","value":1699159075},{"type":"absolute","value":1699161125},{"type":"absolute","value":1699161638},{"type":"absolute","value":1699160106},{"type":"absolute","value":1699159083},{"type":"absolute","value":1699161133},{"type":"absolute","value":1699159600},{"type":"absolute","value":1699160112},{"type":"absolute","value":1699162164},{"type":"absolute","value":1699160630},{"type":"absolute","value":1699159098},{"type":"absolute","value":1699162172},{"type":"absolute","value":1699161149},{"type":"absolute","value":1699160128},{"type":"absolute","value":1699160648},{"type":"absolute","value":1699160137},{"type":"absolute","value":1699159628},{"type":"absolute","value":1699161677},{"type":"absolute","value":1699162188},{"type":"absolute","value":1699161685},{"type":"absolute","value":1699159639},{"type":"absolute","value":1699160153},{"type":"absolute","value":1699160159},{"type":"absolute","value":1699159136},{"type":"absolute","value":1699161184},{"type":"absolute","value":1699161701},{"type":"absolute","value":1699159655},{"type":"absolute","value":1699162216},{"type":"absolute","value":1699159147},{"type":"absolute","value":1699160684},{"type":"absolute","value":1699161195},{"type":"absolute","value":1699160175},{"type":"absolute","value":1699162227},{"type":"absolute","value":1699160692},{"type":"absolute","value":1699160181},{"type":"absolute","value":1699159671},{"type":"absolute","value":1699159165},{"type":"absolute","value":1699161218},{"type":"absolute","value":1699162243},{"type":"absolute","value":1699160708},{"type":"absolute","value":1699160197},{"type":"absolute","value":1699161736},{"type":"absolute","value":1699162254},{"type":"absolute","value":1699160207},{"type":"absolute","value":1699159186},{"type":"absolute","value":1699161747},{"type":"absolute","value":1699161236},{"type":"absolute","value":1699159703},{"type":"absolute","value":1699159711},{"type":"absolute","value":1699161763},{"type":"absolute","value":1699160743},{"type":"absolute","value":1699162282},{"type":"absolute","value":1699161774},{"type":"absolute","value":1699159215},{"type":"absolute","value":1699159727},{"type":"absolute","value":1699160754},{"type":"absolute","value":1699160243},{"type":"absolute","value":1699162290},{"type":"absolute","value":1699159223},{"type":"absolute","value":1699161273},{"type":"absolute","value":1699160251},{"type":"absolute","value":1699161281},{"type":"absolute","value":1699162306},{"type":"absolute","value":1699159239},{"type":"absolute","value":1699160777},{"type":"absolute","value":1699159755},{"type":"absolute","value":1699160267},{"type":"absolute","value":1699161803},{"type":"absolute","value":1699161297},{"type":"absolute","value":1699161811},{"type":"absolute","value":1699159766},{"type":"absolute","value":1699160795},{"type":"absolute","value":1699162331},{"type":"absolute","value":1699159264},{"type":"absolute","value":1699161827},{"type":"absolute","value":1699162342},{"type":"absolute","value":1699159785},{"type":"absolute","value":1699159275},{"type":"absolute","value":1699160302},{"type":"absolute","value":1699161332},{"type":"absolute","value":1699162358},{"type":"absolute","value":1699159801},{"type":"absolute","value":1699160313},{"type":"absolute","value":1699159291},{"type":"absolute","value":1699161343},{"type":"absolute","value":1699160831},{"type":"absolute","value":1699159302},{"type":"absolute","value":1699160839},{"type":"absolute","value":1699161862},{"type":"absolute","value":1699162375},{"type":"absolute","value":1699162381},{"type":"absolute","value":1699160336},{"type":"absolute","value":1699161873},{"type":"absolute","value":1699159830},{"type":"absolute","value":1699160855},{"type":"absolute","value":1699161366},{"type":"absolute","value":1699159838},{"type":"absolute","value":1699161889},{"type":"absolute","value":1699160354},{"type":"absolute","value":1699159336},{"type":"absolute","value":1699161900},{"type":"absolute","value":1699162108},{"type":"absolute","value":1699159854},{"type":"absolute","value":1699162414},{"type":"absolute","value":1699159344},{"type":"absolute","value":1699161398},{"type":"absolute","value":1699162425},{"type":"absolute","value":1699160890},{"type":"absolute","value":1699161404},{"type":"absolute","value":1699159360},{"type":"absolute","value":1699160901},{"type":"absolute","value":1699160390},{"type":"absolute","value":1699161929},{"type":"absolute","value":1699159882},{"type":"absolute","value":1699162441},{"type":"absolute","value":1699161420},{"type":"absolute","value":1699160398},{"type":"absolute","value":1699161937},{"type":"absolute","value":1699161426},{"type":"absolute","value":1699159893},{"type":"absolute","value":1699159385},{"type":"absolute","value":1699160924},{"type":"absolute","value":1699160414},{"type":"absolute","value":1699161953},{"type":"absolute","value":1699161442},{"type":"absolute","value":1699159396},{"type":"absolute","value":1699159909},{"type":"absolute","value":1699161451},{"type":"absolute","value":1699162477},{"type":"absolute","value":1699160942},{"type":"absolute","value":1699159412},{"type":"absolute","value":1699159925},{"type":"absolute","value":1699162485},{"type":"absolute","value":1699161467},{"type":"absolute","value":1699161981},{"type":"absolute","value":1699160449},{"type":"absolute","value":1699161473},{"type":"absolute","value":1699159428},{"type":"absolute","value":1699162501},{"type":"absolute","value":1699161992},{"type":"absolute","value":1699160460},{"type":"absolute","value":1699161489},{"type":"absolute","value":1699159954},{"type":"absolute","value":1699160978},{"type":"absolute","value":1699162513},{"type":"absolute","value":1699161495},{"type":"absolute","value":1699162008},{"type":"absolute","value":1699159962},{"type":"absolute","value":1699160986},{"type":"absolute","value":1699161501},{"type":"absolute","value":1699159456},{"type":"absolute","value":1699160483},{"type":"absolute","value":1699162019},{"type":"absolute","value":1699159464},{"type":"absolute","value":1699159978},{"type":"absolute","value":1699161002},{"type":"absolute","value":1699160501},{"type":"absolute","value":1699159480},{"type":"absolute","value":1699162048},{"type":"absolute","value":1699161537},{"type":"absolute","value":1699162056},{"type":"absolute","value":1699161545},{"type":"absolute","value":1699160013},{"type":"absolute","value":1699161037},{"type":"absolute","value":1699159505},{"type":"absolute","value":1699160024},{"type":"absolute","value":1699160537},{"type":"absolute","value":1699161048},{"type":"absolute","value":1699161561},{"type":"absolute","value":1699159516},{"type":"absolute","value":1699162072},{"type":"absolute","value":1699160545},{"type":"absolute","value":1699159532},{"type":"absolute","value":1699160047},{"type":"absolute","value":1699161071},{"type":"absolute","value":1699160561},{"type":"absolute","value":1699162097},{"type":"absolute","value":1699159031},{"type":"absolute","value":1699161593},{"type":"absolute","value":1699159548}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via IOCTL":{"meta":{"name":"interact with driver via IOCTL","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x40108c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: interact with driver via IOCTL\n    namespace: host-interaction/driver\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    examples:\n      - Practical Malware Analysis Lab 10-03.exe_:0x40108c\n  features:\n    - or:\n      - api: DeviceIoControl\n","matches":[[{"type":"absolute","value":1699231874},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":1699231931}],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open registry key\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Operating System::Registry::Create Registry Key [C0036.004]\n      - Operating System::Registry::Open Registry Key [C0036.003]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\n      - 493167E85E45363D09495D0841C30648:0x404D60\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: advapi32.RegOpenKey\n      - api: advapi32.RegOpenKeyEx\n      - api: advapi32.RegCreateKey\n      - api: advapi32.RegCreateKeyEx\n      - api: advapi32.RegOpenCurrentUser\n      - api: advapi32.RegOpenKeyTransacted\n      - api: advapi32.RegOpenUserClassesRoot\n      - api: advapi32.RegCreateKeyTransacted\n      - api: ZwOpenKey\n      - api: ZwOpenKeyEx\n      - api: ZwCreateKey\n      - api: ZwOpenKeyTransacted\n      - api: ZwOpenKeyTransactedEx\n      - api: ZwCreateKeyTransacted\n      - api: NtOpenKey\n      - api: NtCreateKey\n      - api: SHRegOpenUSKey\n      - api: SHRegCreateUSKey\n      - api: RtlCreateRegistryKey\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\n","matches":[[{"type":"absolute","value":1699232109},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":1699232142}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"change memory protection":{"meta":{"name":"change memory protection","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Change Memory Protection"],"objective":"Memory","behavior":"Change Memory Protection","method":"","id":"C0008"}],"references":[],"examples":["Practical Malware Analysis Lab 11-02.dll_:0x10001203"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: change memory protection\n    authors:\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Change Memory Protection [C0008]\n    examples:\n      - Practical Malware Analysis Lab 11-02.dll_:0x10001203\n  features:\n    - or:\n      - api: kernel32.VirtualProtect\n      - api: kernel32.VirtualProtectEx\n      - api: NtProtectVirtualMemory\n      - api: ZwProtectVirtualMemory\n      - and:\n        - match: link function at runtime on Windows\n        - or:\n          - string: \"VirtualProtect\"\n          - string: \"VirtualProtectEx\"\n          - string: \"NtProtectVirtualMemory\"\n          - string: \"ZwProtectVirtualMemory\"\n","matches":[[{"type":"absolute","value":1699278612},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":1699278646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699279074},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":1699279085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RWX memory":{"meta":{"name":"allocate or change RWX memory","namespace":"host-interaction/process/inject","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate or change RWX memory\n    namespace: host-interaction/process/inject\n    authors:\n      - \"@mr-tz\"\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n      # ntdll\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\n  features:\n    - and:\n      - or:\n        - match: allocate memory\n        - match: change memory protection\n      - or:\n        - number: 0x40 = PAGE_EXECUTE_READWRITE\n        # lea     r9d, [rcx+40h]  ; flProtect\n        # call    cs:VirtualAlloc\n        - instruction:\n          - mnemonic: lea\n          - offset: 0x40 = PAGE_EXECUTE_READWRITE\n","matches":[[{"type":"absolute","value":1699278612},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":1699278646}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699278612}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":1699278624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain loop\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    examples:\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - characteristic: loop\n      - characteristic: tight loop\n      - characteristic: recursive call\n","matches":[[{"type":"absolute","value":1698435088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698435088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436432}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698454643},{"type":"absolute","value":1698454564}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698464016},{"type":"absolute","value":1698464260},{"type":"absolute","value":1698463772},{"type":"absolute","value":1698463669}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436704},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436752},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436752}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698436944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698436944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699243376},{"type":"absolute","value":1699243410}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437408}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437424}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437440}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698437920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698437920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438048}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699275381}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236836}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236992},{"type":"absolute","value":1699237059}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698438336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698438608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698480912},{"type":"absolute","value":1698480960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698439744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698439744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698440976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698440976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698518024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441424}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441584}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698529680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698441792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698441792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698442944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698442944}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699210234}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698553472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443216},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443216}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699269728},{"type":"absolute","value":1699269653},{"type":"absolute","value":1699269367},{"type":"absolute","value":1699269562},{"type":"absolute","value":1699269292},{"type":"absolute","value":1699269486}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698446144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443392}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443600},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443712}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698443888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698443888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698444944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698444944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698445344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698445344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698445728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698445728}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698446144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698446304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698446304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698446864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698446928},{"type":"absolute","value":1698446960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698447040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698447040}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698447184},{"type":"absolute","value":1698447265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698448288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698448288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698451616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698451616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452192}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698452784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698452784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698453136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698453136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698453344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698453344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698453936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698453936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698454496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698454496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698454643},{"type":"absolute","value":1698454564}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698454736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698454736}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698454976},{"type":"absolute","value":1698455008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698460768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698460768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698461184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698461184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698461648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698461648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698461984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698461984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462176}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698462624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698462624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698463024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698463024}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698464016},{"type":"absolute","value":1698464260},{"type":"absolute","value":1698463772},{"type":"absolute","value":1698463669}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698464512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698464512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698465264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698465264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698466720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698466720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698467072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698467072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698468096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698468096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698468304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698468304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698468496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698468496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698468624},{"type":"absolute","value":1698468704},{"type":"absolute","value":1698468784},{"type":"absolute","value":1698468675},{"type":"absolute","value":1698468755},{"type":"absolute","value":1698468597},{"type":"absolute","value":1698468832},{"type":"absolute","value":1698468864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698469184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698469184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698470448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698470448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698470512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698470512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698470624},{"type":"absolute","value":1698470672},{"type":"absolute","value":1698470720},{"type":"absolute","value":1698470768},{"type":"absolute","value":1698470896},{"type":"absolute","value":1698470944},{"type":"absolute","value":1698470992},{"type":"absolute","value":1698471040}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698471072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698471072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698471344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698471360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698473280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698473280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698474496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698474496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698475088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698475088}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475232},{"type":"absolute","value":1698475264},{"type":"absolute","value":1698475173}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698475616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698475680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698475680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698475872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698475680}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698476064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476320},{"type":"absolute","value":1698476180}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698476416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476768},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698476416}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698477120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698477120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698477728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698477728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698478560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698478560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698478848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698478944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698479536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698479536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698480848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698480912},{"type":"absolute","value":1698480960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698482016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698482016}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487680},{"type":"absolute","value":1698491264},{"type":"absolute","value":1698491586},{"type":"absolute","value":1698490435},{"type":"absolute","value":1698493312},{"type":"absolute","value":1698487749},{"type":"absolute","value":1698488392},{"type":"absolute","value":1698487632},{"type":"absolute","value":1698489872},{"type":"absolute","value":1698492112},{"type":"absolute","value":1698492496},{"type":"absolute","value":1698491477},{"type":"absolute","value":1698488032},{"type":"absolute","value":1698490080},{"type":"absolute","value":1698490018},{"type":"absolute","value":1698490273},{"type":"absolute","value":1698490336},{"type":"absolute","value":1698490977},{"type":"absolute","value":1698491808},{"type":"absolute","value":1698492064},{"type":"absolute","value":1698492448},{"type":"absolute","value":1698488297},{"type":"absolute","value":1698491632},{"type":"absolute","value":1698490161},{"type":"absolute","value":1698490484},{"type":"absolute","value":1698487797},{"type":"absolute","value":1698491764}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698482784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698483136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672},{"type":"absolute","value":1698509257},{"type":"absolute","value":1698504194},{"type":"absolute","value":1698508950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698483648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698483936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568},{"type":"absolute","value":1698499280},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482},{"type":"absolute","value":1698510928},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698485696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698485696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698486048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698486144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698486368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698486368}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698486705},{"type":"absolute","value":1698486754},{"type":"absolute","value":1698486930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698487168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698487168}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698487632},{"type":"absolute","value":1698487680},{"type":"absolute","value":1698488032},{"type":"absolute","value":1698487797},{"type":"absolute","value":1698487749},{"type":"absolute","value":1698488392},{"type":"absolute","value":1698488297}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698488592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698488592}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698488912},{"type":"absolute","value":1698489056},{"type":"absolute","value":1698489186},{"type":"absolute","value":1698489297},{"type":"absolute","value":1698489108},{"type":"absolute","value":1698489346},{"type":"absolute","value":1698489443},{"type":"absolute","value":1698489488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698489552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698489552}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698489872},{"type":"absolute","value":1698490161},{"type":"absolute","value":1698490018},{"type":"absolute","value":1698490080},{"type":"absolute","value":1698490273},{"type":"absolute","value":1698490336},{"type":"absolute","value":1698490435},{"type":"absolute","value":1698490484}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698490544}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698490800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698490800}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698490977}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698491056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698491264},{"type":"absolute","value":1698491632},{"type":"absolute","value":1698491586},{"type":"absolute","value":1698491808},{"type":"absolute","value":1698491764},{"type":"absolute","value":1698491477}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698491888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698491888}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064},{"type":"absolute","value":1698492448},{"type":"absolute","value":1698492496},{"type":"absolute","value":1698492112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698492736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698492736}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698493136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698493136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698493312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698493632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698493632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698493872},{"type":"absolute","value":1698494064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698494544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698494721}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698495266}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495504},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698495266}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698495266}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698495536}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698492064},{"type":"absolute","value":1698492448},{"type":"absolute","value":1698492496},{"type":"absolute","value":1698492112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698495904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496016},{"type":"absolute","value":1698496080},{"type":"absolute","value":1698496128},{"type":"absolute","value":1698496192},{"type":"absolute","value":1698496243}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698496368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698496368}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497504},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698497680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497808}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698497936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698497936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698498240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698498240}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698498388}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698498752},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698499424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698499424}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698499824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698499824}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698500160},{"type":"absolute","value":1698500020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698501104},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698501104}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698501776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698501808},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698502768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698502896},{"type":"absolute","value":1698503584}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698503952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698504240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698504194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505824}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698505984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698506467}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698506528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698506528}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508115},{"type":"absolute","value":1698508087},{"type":"absolute","value":1698508155},{"type":"absolute","value":1698507069},{"type":"absolute","value":1698508015}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698508336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698508336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672},{"type":"absolute","value":1698509257},{"type":"absolute","value":1698508950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698509296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698509296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698510864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698510928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698511040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512080},{"type":"absolute","value":1698511849},{"type":"absolute","value":1698511881}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698512480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698512480}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698512800},{"type":"absolute","value":1698513152},{"type":"absolute","value":1698513200},{"type":"absolute","value":1698512848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698513520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698513520}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698513856},{"type":"absolute","value":1698513906},{"type":"absolute","value":1698514212},{"type":"absolute","value":1698514272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698514576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698514576}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698515312},{"type":"absolute","value":1698515731}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698516064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698516064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698516496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698516496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698517568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698517568}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698518024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698518512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698518512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698519936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698519936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698520032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698520032}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698520432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698520432}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698520624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698520624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698522176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698522176}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698522624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698522624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698526688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698526688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698527072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698527072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698527328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698527328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698527968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698527968}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698528016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698528288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698528640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698528992},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698528992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698529680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529792}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529808},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529808}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698529968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698530224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698530224}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698530672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698530672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698531920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698531920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698532256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698532944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698532944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698533840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698533840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698534560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698534560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698534640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698534640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698534768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698534768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698535152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535696}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698497568},{"type":"absolute","value":1698499280},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482},{"type":"absolute","value":1698510928},{"type":"absolute","value":1698499209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698499280},{"type":"absolute","value":1698499209},{"type":"absolute","value":1698495266},{"type":"absolute","value":1698504482}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698536032}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698496880},{"type":"absolute","value":1698497136},{"type":"absolute","value":1698496928},{"type":"absolute","value":1698497184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698536080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698508672},{"type":"absolute","value":1698509257},{"type":"absolute","value":1698504194},{"type":"absolute","value":1698508950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698536496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698536560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698538704},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698538800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698538832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698538832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698539456},{"type":"absolute","value":1698539488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698539648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698539648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698541872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698541872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698542032},{"type":"absolute","value":1698543456},{"type":"absolute","value":1698543344},{"type":"absolute","value":1698543568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698543744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698543744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698544480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698544480}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698544896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698545520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698545520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698545968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698545968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698546096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698546096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698546224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698546224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698547712},{"type":"absolute","value":1698551463},{"type":"absolute","value":1698551582},{"type":"absolute","value":1698546960},{"type":"absolute","value":1698548976},{"type":"absolute","value":1698546738},{"type":"absolute","value":1698549234},{"type":"absolute","value":1698548117},{"type":"absolute","value":1698550526},{"type":"absolute","value":1698550431}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698552304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698552579}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698552848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698552848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698553440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698553472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698553520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698553520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698554240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698554240}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698554624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698555792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698555792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698557600},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698557600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698558112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698558112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698558112}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698558944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698558944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698559344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698559344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698559536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698561168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698561168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698561408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698561408}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698561797}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698562080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698562080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698563392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698563392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698563761}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698564176}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698564464},{"type":"absolute","value":1698564544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698564960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698565136},{"type":"absolute","value":1698565361},{"type":"absolute","value":1698565330},{"type":"absolute","value":1698565410},{"type":"absolute","value":1698565632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698565856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698565856}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698566176},{"type":"absolute","value":1698566208},{"type":"absolute","value":1698566402},{"type":"absolute","value":1698566117},{"type":"absolute","value":1698566085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698566768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698566768}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698566864},{"type":"absolute","value":1698566960},{"type":"absolute","value":1698567011}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698566768}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698567296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567364}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567632},{"type":"absolute","value":1698567776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698567872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698567872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698567952}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568224},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568304},{"type":"absolute","value":1698568416}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698568512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698568512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568960},{"type":"absolute","value":1698568819},{"type":"absolute","value":1698570352},{"type":"absolute","value":1698570304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698571360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698571360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698568960},{"type":"absolute","value":1698568819},{"type":"absolute","value":1698570352},{"type":"absolute","value":1698570304}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698571360}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698582416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698582592},{"type":"absolute","value":1698582628},{"type":"absolute","value":1698582704}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698582416}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698582592},{"type":"absolute","value":1698582628},{"type":"absolute","value":1698582704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583232},{"type":"absolute","value":1698583376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698583472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698583824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698583904},{"type":"absolute","value":1698584016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698594336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698594336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698594352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698594624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698594624}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698598144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698598144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698598432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698598432}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698598544},{"type":"absolute","value":1698599202},{"type":"absolute","value":1698598816}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698599616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698599616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698600080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698600080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698600149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698600352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698600352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698600416}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698600720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698600720}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698600784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698627360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698627520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698628160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698628160}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698628896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698628896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698629392},{"type":"absolute","value":1698629920},{"type":"absolute","value":1698629749},{"type":"absolute","value":1698629446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698630528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698630528}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698629392},{"type":"absolute","value":1698629920},{"type":"absolute","value":1698629749},{"type":"absolute","value":1698629446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698631904}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698631984},{"type":"absolute","value":1698644352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698632160}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698632464}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698632544},{"type":"absolute","value":1698643152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698632720}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633473},{"type":"absolute","value":1698633138}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698633696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698633792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698643616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698644656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698644832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645024},{"type":"absolute","value":1698645360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698645616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698645968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698645968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698646304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698646304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698646688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698646688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698650976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698651248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698651568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698652880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698652880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698653760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698653760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698654656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698654656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698657376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698657376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698659472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698659472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698663648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698663648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698663908}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698664208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698664208}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698664468}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698664832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698664832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698665076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698665328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698665328}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698665533}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698666288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698666880},{"type":"absolute","value":1698666489}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698714000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698714000}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698719728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698719792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698719792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698720448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698720736},{"type":"absolute","value":1698720594},{"type":"absolute","value":1698720848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698721072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698721072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698721360},{"type":"absolute","value":1698721218}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698721712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698721856},{"type":"absolute","value":1698722098},{"type":"absolute","value":1698722000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698722288},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698722288}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698722500}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698723440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698723440}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698723857},{"type":"absolute","value":1698723642}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698804144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698804512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698804848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698805664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698805664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698810640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698810640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698810640}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698829312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698829472},{"type":"absolute","value":1698829600},{"type":"absolute","value":1698829728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698829936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698829936}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698830096},{"type":"absolute","value":1698830224}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698830592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698830864},{"type":"absolute","value":1698830739},{"type":"absolute","value":1698830992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698831184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698831184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698831409},{"type":"absolute","value":1698831929}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698832432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698832432}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698832898},{"type":"absolute","value":1698832643},{"type":"absolute","value":1698833099}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698956128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698956128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698956256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698956256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698956864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698956976},{"type":"absolute","value":1698957216}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698957344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698957344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698957472},{"type":"absolute","value":1698957427}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698957344}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698958576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698958576}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698958816},{"type":"absolute","value":1698959173}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698959376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698959376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698959621}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698960344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698960344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698960840},{"type":"absolute","value":1698963474}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698965792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698965812}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698965856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698965856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698966320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698966320}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560},{"type":"absolute","value":1698966848},{"type":"absolute","value":1698966896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698967040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698967040}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698966560},{"type":"absolute","value":1698966848},{"type":"absolute","value":1698966896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698967072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698967072}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698967344},{"type":"absolute","value":1698967648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698968192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698968192}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698971433},{"type":"absolute","value":1698971027},{"type":"absolute","value":1698968773},{"type":"absolute","value":1698971071}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698971584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698971584}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698972233},{"type":"absolute","value":1698974315},{"type":"absolute","value":1698974685},{"type":"absolute","value":1698974359}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698981432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698981432}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698989792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698989792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698992576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698992576}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698994224},{"type":"absolute","value":1698995073},{"type":"absolute","value":1698995440},{"type":"absolute","value":1698994864},{"type":"absolute","value":1698996240},{"type":"absolute","value":1698997843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699000208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699000208}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699001888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699001888}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699002512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699002576}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699005488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699005488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699009184},{"type":"absolute","value":1699008522}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699011856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699011856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699016448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699016448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699016976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699016976}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699018496},{"type":"absolute","value":1699017873},{"type":"absolute","value":1699018640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699025232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699025232}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699031152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699031152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699031929},{"type":"absolute","value":1699031588},{"type":"absolute","value":1699032149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699039024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699039024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699039232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699039232}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699040544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699040544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699043008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699043008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699047088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699047408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699047488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699047488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699047648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699050976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699051360},{"type":"absolute","value":1699051123}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699051824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699052128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699052564}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699052912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699053616},{"type":"absolute","value":1699054016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699054608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699055562},{"type":"absolute","value":1699055446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699055984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699055984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058337},{"type":"absolute","value":1699059072},{"type":"absolute","value":1699059472},{"type":"absolute","value":1699058414}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699058560},{"type":"absolute","value":1699058801},{"type":"absolute","value":1699060192},{"type":"absolute","value":1699060672},{"type":"absolute","value":1699058877}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699058960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699059072},{"type":"absolute","value":1699059472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699060064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699060192},{"type":"absolute","value":1699060672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699061584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699061584}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699061935}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699063456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699063568},{"type":"absolute","value":1699063858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699063920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699063920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699064016},{"type":"absolute","value":1699063970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699065232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699065232}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699065264},{"type":"absolute","value":1699065364}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699065760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699065776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699066096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699066240},{"type":"absolute","value":1699066368},{"type":"absolute","value":1699066739}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699067200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699067250}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699068688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699068704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699068752},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699068976},{"type":"absolute","value":1699068884}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699069168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699069232}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699071344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699071616},{"type":"absolute","value":1699071524}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699071856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699077520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699077536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699077584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699077728},{"type":"absolute","value":1699077824}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699079040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699079344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699090400},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699090704},{"type":"absolute","value":1699090532}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699090896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699090949}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699091024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699091024}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699091184},{"type":"absolute","value":1699093513}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699094768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699094768}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699094912},{"type":"absolute","value":1699097121}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699098368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699098368}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699098592},{"type":"absolute","value":1699100810},{"type":"absolute","value":1699101744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699104512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699104512}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699104912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699111328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699111472},{"type":"absolute","value":1699111680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699111872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699111925}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699112016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699112075}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699126160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699126222}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699140352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699140352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699140544},{"type":"absolute","value":1699142992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699144704},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699144752}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699144784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699144784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699147264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699147264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699148608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699148608}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699151120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699151120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699152464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699152464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699154816},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699154816}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699156960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699156960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699157456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699157456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699158935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699158935}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699162583}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699162633},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699162840},{"type":"absolute","value":1699162793}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699163504},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699163504}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699163920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699163504}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699164256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699164256}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699163920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699164368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699164528},{"type":"absolute","value":1699164704},{"type":"absolute","value":1699164608},{"type":"absolute","value":1699164787},{"type":"absolute","value":1699164848},{"type":"absolute","value":1699164928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699165136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699165136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699167664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699167872}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699173744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699173888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699178336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699178464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699178864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699178963},{"type":"absolute","value":1699179316},{"type":"absolute","value":1699179246}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699179840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699179840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180256}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180672}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699180880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699180912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699181120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699181152}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699181360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699181392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699181600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699181632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699182928},{"type":"absolute","value":1699182017}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699183344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699183344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699184016},{"type":"absolute","value":1699183761},{"type":"absolute","value":1699183618},{"type":"absolute","value":1699184304},{"type":"absolute","value":1699184817}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699187984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699188240}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699193120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699193392},{"type":"absolute","value":1699193252}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699193680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699193733}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699193888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699193888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699198016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699198016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699202000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699202000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699206160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699206160}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699206320},{"type":"absolute","value":1699207156},{"type":"absolute","value":1699206496},{"type":"absolute","value":1699206352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699207280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699207280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699207971},{"type":"absolute","value":1699207794},{"type":"absolute","value":1699207939}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699208304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699208304}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699208496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699208496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699209632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699209632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699209712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699209712}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699214528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699209840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699209840}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699210234}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699210384},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699210384}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699210832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699210832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699211136},{"type":"absolute","value":1699211223}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699211312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699211584}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699212992},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699212992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699213184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699213184}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699213760},{"type":"absolute","value":1699213843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699214416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699214416}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699214528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699214928},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699214928}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699214960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699215248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698482912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699215296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699215296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698527152},{"type":"absolute","value":1698527248},{"type":"absolute","value":1698527202},{"type":"absolute","value":1698527296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699215424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699215424}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699216240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699216240}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699216464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699216464}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699216485}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699216560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699216560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699217632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699217632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699218464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699218464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699218976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699218976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699219296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699219296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699220928},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699220928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699223280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699223280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699224576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699224576}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699225296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699225296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226032}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226336}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226648}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699226730}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699226871},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699226871}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699227064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699227064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699227374},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699227374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699227920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699227920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699228093},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699228093}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699228369},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699228369}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699228894},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699228894}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699229592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699229592}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699230022}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699230544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699230544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699230864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699230864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699231472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699234544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699234544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699234992},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699234992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699235904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699235904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236432}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699236608}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236836}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699236912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699236992},{"type":"absolute","value":1699237059}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699237120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699237280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699237376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699237376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699238000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699238048},{"type":"absolute","value":1699238080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699238128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699238128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699238480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699238480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699239008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699239008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699239024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699239024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699239136},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699239136}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240496}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240512}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699240976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699240976}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699241856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699241856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699243280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699243376},{"type":"absolute","value":1699243410}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699243568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699243568}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699244400},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699244400}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699239604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699244448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699244448}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699244768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699244768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699245152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699245152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699245392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699245392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699246560},{"type":"absolute","value":1699246484},{"type":"absolute","value":1699247056}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699250096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699250096}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699250352},{"type":"absolute","value":1699250480},{"type":"absolute","value":1699250181}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699250896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699250896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699250976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699250976}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699251088}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699251264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699251264}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699251440},{"type":"absolute","value":1699251728},{"type":"absolute","value":1699251664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699251776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699237168},{"type":"absolute","value":1699251842}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699252016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699252096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699252544},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699252544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699254128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699254128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699256016},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699256064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699256096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699256096}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699256677},{"type":"absolute","value":1699256629},{"type":"absolute","value":1699256736}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699257232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699257296}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699257344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699257344}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699257409}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699257616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699257616}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699258304},{"type":"absolute","value":1699258131}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699257616}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699258800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699258800}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699258864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699259056},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699259056}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699259552},{"type":"absolute","value":1699259397}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699259056}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699259952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699259952}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699258864},{"type":"absolute","value":1699257409},{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699260192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699260192}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699260304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699260304}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699260416}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699260720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699260720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1699260720}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699261792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699261792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699261984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699262128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262288},{"type":"absolute","value":1699262193}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699263008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699263008}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699263648},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699263648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699263904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699263904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699264336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699264336}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699264736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699264736}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262016},{"type":"absolute","value":1699262048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265392}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699265552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265856}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265888},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699265936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699266048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699266048}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699266816},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699262288},{"type":"absolute","value":1699262193}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699266896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699266896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699267248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699267376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699267472},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699267472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699268576},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699047408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699269168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699269728},{"type":"absolute","value":1699269653},{"type":"absolute","value":1699269367},{"type":"absolute","value":1699269562},{"type":"absolute","value":1699269292},{"type":"absolute","value":1699269486}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699269856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699269856}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699271296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699271296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699266016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699272848},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699272848}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699275381}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699276464}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276624},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276719},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699276912}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699276960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699276960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277072},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277072}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699277379}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277424},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277424}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699277472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277536}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699277472}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699277792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699277792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699278096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699278096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699278272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699278272}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699278592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699278784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699278784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699279904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699279904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699280640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699280640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699280880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699280880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699281141}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281328},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281328}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281408},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281552},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281552}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281744}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699281920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699282080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699282287}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699282448},{"type":"absolute","value":1699282496}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699283936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1699283936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write file on Windows":{"meta":{"name":"write file on Windows","namespace":"host-interaction/file-system/write","authors":["william.ballenthin@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Writes File"],"objective":"File System","behavior":"Writes File","method":"","id":"C0052"}],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x4011FC","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: write file on Windows\n    namespace: host-interaction/file-system/write\n    authors:\n      - william.ballenthin@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Writes File [C0052]\n    examples:\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      # ntdll\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - basic block:\n            - or:\n              - number: 0x40000000 = GENERIC_WRITE\n              - number: 0x2 = FILE_WRITE_DATA\n              - match: create or open file\n          - call:\n            - or:\n              - number: 0x40000000 = GENERIC_WRITE\n              - number: 0x2 = FILE_WRITE_DATA\n              - match: create or open file\n        - or:\n          - api: kernel32.WriteFile\n          - api: kernel32.WriteFileEx\n          - api: NtWriteFile\n          - api: ZwWriteFile\n          - api: _fwrite\n          - api: fwrite\n      - api: System.IO.File::WriteAllBytes\n      - api: System.IO.File::WriteAllBytesAsync\n      - api: System.IO.File::WriteAllLines\n      - api: System.IO.File::WriteAllLinesAsync\n      - api: System.IO.File::WriteAllText\n      - api: System.IO.File::WriteAllTextAsync\n      - api: System.IO.File::AppendAllLines\n      - api: System.IO.File::AppendAllLinesAsync\n      - api: System.IO.File::AppendAllText\n      - api: System.IO.File::AppendAllTextAsync\n      - api: System.IO.File::AppendText\n      - api: System.IO.FileInfo::AppendText\n","matches":[[{"type":"absolute","value":1698441680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/dd68c950ebff4e93af47de1cf45a4f58"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698526848},{"type":"absolute","value":1698526874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698444080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444336}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444384}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1698444254}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698444288},{"type":"absolute","value":1698444336},{"type":"absolute","value":1698444194},{"type":"absolute","value":1698444384},{"type":"absolute","value":1698444254}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698444371},{"type":"absolute","value":1698444419},{"type":"absolute","value":1698444229}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698526688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/dd68c950ebff4e93af47de1cf45a4f58"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698526848},{"type":"absolute","value":1698526874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698529808},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/dd68c950ebff4e93af47de1cf45a4f58"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1698526848},{"type":"absolute","value":1698526874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699284592},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":1699284667},{"type":"absolute","value":1699284606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699284592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":1699284657}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using murmur3":{"meta":{"name":"hash data using murmur3","namespace":"data-manipulation/hashing/murmur","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Data","Non-Cryptographic Hash","MurmurHash"],"objective":"Data","behavior":"Non-Cryptographic Hash","method":"MurmurHash","id":"C0030.001"}],"references":["https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp"],"examples":["c66172b12971a329f8d5ff01665f204b:0x404A18"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data using murmur3\n    namespace: data-manipulation/hashing/murmur\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic, mnemonic features\n    mbc:\n      - Data::Non-Cryptographic Hash::MurmurHash [C0030.001]\n    references:\n      - https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp\n    examples:\n      - c66172b12971a329f8d5ff01665f204b:0x404A18\n  features:\n    - or:\n      - and:\n        - number: 0x85ebca6b = 32-bit finalization mix constant 1\n        - number: 0xc2b2ae35 = 32-bit finalization mix constant 2\n      - and:\n        - number: 0xff51afd7ed558ccd = 64-bit finalization mix constant 1\n        - number: 0xc4ceb9fe1a85ec53 = 64-bit finalization mix constant 2\n      - and:\n        - number: 0xcc9e2d51 = c1 32-bit hash\n        - number: 0x1b873593 = c2 32-bit hash\n      - and:\n        - number: 0x239b961b = 32-bit c1 for 128-bit hash\n        - number: 0xab0e9789 = 32-bit c2 for 128-bit hash\n        - number: 0x38b34ae5 = 32-bit c3 for 128-bit hash\n        - number: 0xa1e38b93 = 32-bit c4 for 128-bit hash\n      - and:\n        - number: 0x87c37b91114253d5 = 64-bit c1 for 128-bit hash\n        - number: 0x4cf5ad432745937f = 64-bit c2 for 128-bit hash\n      - basic block:\n        - and:\n          - description: 'hash >> 16; hash >> 13; hash >> 16'\n          - count(mnemonic(shr)): 3\n          - instruction:\n            - mnemonic: shr\n            - number: 16\n          - instruction:\n            - mnemonic: shr\n            - number: 13\n          - optional:\n            - count(characteristic(nzxor)): 3 or more\n      - and:\n        # Group this two blocks under an `and` as on their own they are not\n        # unique enough and would cause false positives\n        - instruction:\n          - description: k ROL r1\n          - mnemonic: rol\n          - number: 15 = r1\n        - instruction:\n          - description: hash ROL r2\n          - mnemonic: rol\n          - number: 13 = r2\n","matches":[[{"type":"absolute","value":1698475088},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/a4ba62e534b74e81911b81f9165be749"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1698475286}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1698475286}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698475286}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1698475283}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1698475283}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698475283}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699067200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/a4ba62e534b74e81911b81f9165be749"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068458}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068458}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068558}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068558}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068645}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068645}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068350}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699068350}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699068458},{"type":"absolute","value":1699068558},{"type":"absolute","value":1699068645},{"type":"absolute","value":1699068350}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699067937}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699067937}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068236}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699068236}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699067804}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699067804}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699068079}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699068079}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699067937},{"type":"absolute","value":1699068236},{"type":"absolute","value":1699067804},{"type":"absolute","value":1699068079}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699071824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/a4ba62e534b74e81911b81f9165be749"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072133}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072133}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073737}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699073737}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075535}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699075535}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074000}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699074000}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699074336}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073185}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699073185}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699075360}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699075685}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699076390}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699076390}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072423}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072423}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072360}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072360}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074663}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699074663}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073517}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699073517}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077236}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699077236}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699076537}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699076537}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072703}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699072703}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699072133},{"type":"absolute","value":1699073737},{"type":"absolute","value":1699075535},{"type":"absolute","value":1699074000},{"type":"absolute","value":1699074336},{"type":"absolute","value":1699073185},{"type":"absolute","value":1699075360},{"type":"absolute","value":1699075685},{"type":"absolute","value":1699076390},{"type":"absolute","value":1699072423},{"type":"absolute","value":1699072360},{"type":"absolute","value":1699074663},{"type":"absolute","value":1699073517},{"type":"absolute","value":1699077236},{"type":"absolute","value":1699076537},{"type":"absolute","value":1699072703}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075073}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699075073}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073218}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699073218}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074242}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074242}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077058}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699077058}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074889}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074889}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699075148}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699075148}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074065}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074065}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074844}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074844}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699073117}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699073117}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074595}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074595}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699072293}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699076841}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699076841}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077097}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699077097}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699074028}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699074028}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699077293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699077293}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699072574}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699072574}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699075073},{"type":"absolute","value":1699073218},{"type":"absolute","value":1699074242},{"type":"absolute","value":1699077058},{"type":"absolute","value":1699074889},{"type":"absolute","value":1699075148},{"type":"absolute","value":1699074065},{"type":"absolute","value":1699074844},{"type":"absolute","value":1699073117},{"type":"absolute","value":1699074595},{"type":"absolute","value":1699072293},{"type":"absolute","value":1699076841},{"type":"absolute","value":1699077097},{"type":"absolute","value":1699074028},{"type":"absolute","value":1699077293},{"type":"absolute","value":1699072574}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699079040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data using murmur3/a4ba62e534b74e81911b81f9165be749"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2246822507,"description":"32-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3266489909,"description":"32-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":18397679294719823053,"description":"64-bit finalization mix constant 1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":14181476777654086739,"description":"64-bit finalization mix constant 2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3432918353,"description":"c1 32-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":461845907,"description":"c2 32-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":9782798678568883157,"description":"64-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5545529020109919103,"description":"64-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082115}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082115}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089668}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089668}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081733}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081733}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087373}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087373}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084047}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084047}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085332}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085332}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084181}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084181}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089300}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089300}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088792}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088792}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083550}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083550}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084961}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084961}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083042}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083042}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081379}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081379}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086241}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086241}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084581}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084581}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089830}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089830}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082664}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082664}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087912}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087912}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088427}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088427}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085871}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085871}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082296}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082296}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087162}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087162}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086780}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086780}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085501}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085501}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088961}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088961}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088066}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088066}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087557}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087557}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081926}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081926}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083719}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083719}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699081549}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083214}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083214}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085133}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085133}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089490}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089490}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086035}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086035}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086423}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086423}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088221}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088221}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084384}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084384}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082849}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082849}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086585}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086585}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088613}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699088613}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089127}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699089127}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699084776}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083376}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083376}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085680}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699085680}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082482}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699082482}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699083890}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087729}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699087729}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086969}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"r1"}},"children":[],"locations":[{"type":"absolute","value":1699086969}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699082115},{"type":"absolute","value":1699089668},{"type":"absolute","value":1699081733},{"type":"absolute","value":1699087373},{"type":"absolute","value":1699084047},{"type":"absolute","value":1699085332},{"type":"absolute","value":1699084181},{"type":"absolute","value":1699089300},{"type":"absolute","value":1699088792},{"type":"absolute","value":1699083550},{"type":"absolute","value":1699084961},{"type":"absolute","value":1699083042},{"type":"absolute","value":1699081379},{"type":"absolute","value":1699086241},{"type":"absolute","value":1699084581},{"type":"absolute","value":1699089830},{"type":"absolute","value":1699082664},{"type":"absolute","value":1699087912},{"type":"absolute","value":1699088427},{"type":"absolute","value":1699085871},{"type":"absolute","value":1699082296},{"type":"absolute","value":1699087162},{"type":"absolute","value":1699086780},{"type":"absolute","value":1699085501},{"type":"absolute","value":1699088961},{"type":"absolute","value":1699088066},{"type":"absolute","value":1699087557},{"type":"absolute","value":1699081926},{"type":"absolute","value":1699083719},{"type":"absolute","value":1699081549},{"type":"absolute","value":1699083214},{"type":"absolute","value":1699085133},{"type":"absolute","value":1699089490},{"type":"absolute","value":1699086035},{"type":"absolute","value":1699086423},{"type":"absolute","value":1699088221},{"type":"absolute","value":1699084384},{"type":"absolute","value":1699082849},{"type":"absolute","value":1699086585},{"type":"absolute","value":1699088613},{"type":"absolute","value":1699089127},{"type":"absolute","value":1699084776},{"type":"absolute","value":1699083376},{"type":"absolute","value":1699085680},{"type":"absolute","value":1699082482},{"type":"absolute","value":1699083890},{"type":"absolute","value":1699087729},{"type":"absolute","value":1699086969}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082112}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082112}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086603}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086603}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085324}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085324}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089420}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089420}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081742}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081742}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089678}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089678}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084054}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084054}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087383}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087383}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087896}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087896}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086233}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086233}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083547}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083547}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088796}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088796}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084957}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084957}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083038}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083038}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089313}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089313}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082660}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082660}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084585}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084585}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084204}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084204}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088431}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088431}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081394}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081394}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085875}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085875}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082293}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086777}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086777}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087165}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087165}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089855}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089855}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085504}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085504}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081922}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081922}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083715}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083715}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087561}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087561}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699081546}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699081546}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083211}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083211}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088074}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088074}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088970}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088970}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084375}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084375}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085143}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085143}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086426}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086426}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699085662}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699085662}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082853}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082853}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086057}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086057}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699084780}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699084780}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083373}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083373}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699082478}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699082478}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088239}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088239}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699088623}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699088623}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699086961}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699086961}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699089140}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699089140}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699087733}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699087733}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"rol"}},"children":[],"locations":[{"type":"absolute","value":1699083898}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"r2"}},"children":[],"locations":[{"type":"absolute","value":1699083898}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699082112},{"type":"absolute","value":1699086603},{"type":"absolute","value":1699085324},{"type":"absolute","value":1699089420},{"type":"absolute","value":1699081742},{"type":"absolute","value":1699089678},{"type":"absolute","value":1699084054},{"type":"absolute","value":1699087383},{"type":"absolute","value":1699087896},{"type":"absolute","value":1699086233},{"type":"absolute","value":1699083547},{"type":"absolute","value":1699088796},{"type":"absolute","value":1699084957},{"type":"absolute","value":1699083038},{"type":"absolute","value":1699089313},{"type":"absolute","value":1699082660},{"type":"absolute","value":1699084585},{"type":"absolute","value":1699084204},{"type":"absolute","value":1699088431},{"type":"absolute","value":1699081394},{"type":"absolute","value":1699085875},{"type":"absolute","value":1699082293},{"type":"absolute","value":1699086777},{"type":"absolute","value":1699087165},{"type":"absolute","value":1699089855},{"type":"absolute","value":1699085504},{"type":"absolute","value":1699081922},{"type":"absolute","value":1699083715},{"type":"absolute","value":1699087561},{"type":"absolute","value":1699081546},{"type":"absolute","value":1699083211},{"type":"absolute","value":1699088074},{"type":"absolute","value":1699088970},{"type":"absolute","value":1699084375},{"type":"absolute","value":1699085143},{"type":"absolute","value":1699086426},{"type":"absolute","value":1699085662},{"type":"absolute","value":1699082853},{"type":"absolute","value":1699086057},{"type":"absolute","value":1699084780},{"type":"absolute","value":1699083373},{"type":"absolute","value":1699082478},{"type":"absolute","value":1699088239},{"type":"absolute","value":1699088623},{"type":"absolute","value":1699086961},{"type":"absolute","value":1699089140},{"type":"absolute","value":1699087733},{"type":"absolute","value":1699083898}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":597399067,"description":"32-bit c1 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2869860233,"description":"32-bit c2 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":951274213,"description":"32-bit c3 for 128-bit hash"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2716044179,"description":"32-bit c4 for 128-bit hash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"authenticate HMAC":{"meta":{"name":"authenticate HMAC","namespace":"data-manipulation/hmac","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Cryptography","Hashed Message Authentication Code"],"objective":"Cryptography","behavior":"Hashed Message Authentication Code","method":"","id":"C0061"}],"references":["https://tools.ietf.org/html/rfc2104","https://tools.ietf.org/html/rfc4634","https://github.com/ogay/hmac"],"examples":["mimikatz.exe_:0x403408"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: authenticate HMAC\n    namespace: data-manipulation/hmac\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    mbc:\n      - Cryptography::Hashed Message Authentication Code [C0061]\n    references:\n      - https://tools.ietf.org/html/rfc2104\n      - https://tools.ietf.org/html/rfc4634\n      - https://github.com/ogay/hmac\n    examples:\n      - mimikatz.exe_:0x403408\n  features:\n    - and:\n      # block-sized inner padding, consisting of repeated bytes valued 0x36\n      - number: 0x36 = inner padding byte value\n      # block-sized outer padding, consisting of repeated bytes valued 0x5c\n      - number: 0x5C = outer padding byte value\n      - match: contain loop\n      - count(characteristic(nzxor)): 2 or more\n      - optional:\n        - description: block size\n        - number: 64 = MD5, SHA-1, SHA-224, or SHA-256\n        - number: 128 = SHA-384 or SHA-512\n","matches":[[{"type":"absolute","value":1698476416},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":54,"description":"inner padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":92,"description":"outer padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698476729}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698476768},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698476416}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698476416}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698476729},{"type":"absolute","value":1698476722}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"block size"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"MD5, SHA-1, SHA-224, or SHA-256"}},"children":[],"locations":[{"type":"absolute","value":1698476748},{"type":"absolute","value":1698476677}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":128,"description":"SHA-384 or SHA-512"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698530672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":54,"description":"inner padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531228}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":92,"description":"outer padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698531377},{"type":"absolute","value":1698531452}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698530672}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698530672}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531377}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"block size"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"MD5, SHA-1, SHA-224, or SHA-256"}},"children":[],"locations":[{"type":"absolute","value":1698531170},{"type":"absolute","value":1698531112},{"type":"absolute","value":1698530792},{"type":"absolute","value":1698531116},{"type":"absolute","value":1698531180},{"type":"absolute","value":1698531566},{"type":"absolute","value":1698531184},{"type":"absolute","value":1698530802},{"type":"absolute","value":1698531099},{"type":"absolute","value":1698531580},{"type":"absolute","value":1698531102},{"type":"absolute","value":1698531167}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":128,"description":"SHA-384 or SHA-512"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698535408},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":54,"description":"inner padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531228}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":92,"description":"outer padding byte value"}},"children":[],"locations":[{"type":"absolute","value":1698531377},{"type":"absolute","value":1698531452}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698535408}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698535408}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698530944},{"type":"absolute","value":1698531377}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"block size"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"MD5, SHA-1, SHA-224, or SHA-256"}},"children":[],"locations":[{"type":"absolute","value":1698531170},{"type":"absolute","value":1698531112},{"type":"absolute","value":1698530792},{"type":"absolute","value":1698531116},{"type":"absolute","value":1698531180},{"type":"absolute","value":1698531566},{"type":"absolute","value":1698531184},{"type":"absolute","value":1698530802},{"type":"absolute","value":1698531099},{"type":"absolute","value":1698531580},{"type":"absolute","value":1698531102},{"type":"absolute","value":1698531167}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":128,"description":"SHA-384 or SHA-512"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read file on Windows\n    namespace: host-interaction/file-system/read\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Read File [C0051]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - and:\n            - number: 0x80000000 = GENERIC_READ\n            - match: create or open file\n        - or:\n          - api: kernel32.ReadFile\n          - api: ReadFileEx\n          - api: NtReadFile\n          - api: ZwReadFile\n          - api: LZRead\n          - api: _read\n          - api: fread\n      - api: System.IO.File::ReadAllBytes\n      - api: System.IO.File::ReadAllBytesAsync\n      - api: System.IO.File::ReadAllLines\n      - api: System.IO.File::ReadAllLinesAsync\n      - api: System.IO.File::ReadAllText\n      - api: System.IO.File::ReadAllTextAsync\n      - api: System.IO.File::ReadLines\n","matches":[[{"type":"absolute","value":1698477120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[{"type":"absolute","value":1698477149}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698477120}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[{"type":"absolute","value":1698477245}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699211584},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[{"type":"absolute","value":1699211758}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using ADD XOR SUB operations":{"meta":{"name":"encode data using ADD XOR SUB operations","namespace":"data-manipulation/encoding","authors":["jakub.jozwiak@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Custom Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Custom Algorithm","id":"E1027.m03"}],"references":[],"examples":["df814d4b55912e4ba404c62080b3a7eda70a3c6283ea740f8a14a9116d803259:0x1000100F"],"description":"Data encoding using a sequence of ADD/XOR/SUB (or SUB/XOR/ADD) operations common for PlugX but also used by other malware families.","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encode data using ADD XOR SUB operations\n    namespace: data-manipulation/encoding\n    authors:\n      - jakub.jozwiak@mandiant.com\n    description: Data encoding using a sequence of ADD/XOR/SUB (or SUB/XOR/ADD) operations common for PlugX but also used by other malware families.\n    scopes:\n      static: function\n      dynamic: unsupported  # requires basic block, characteristic, mnemonic features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Custom Algorithm [E1027.m03]\n    examples:\n      - df814d4b55912e4ba404c62080b3a7eda70a3c6283ea740f8a14a9116d803259:0x1000100F\n  features:\n    - and:\n      - count(basic blocks): 6 or fewer\n      - basic block:\n        - and:\n          - characteristic: tight loop\n          - characteristic: nzxor\n          - count(mnemonic(add)): 1\n          - count(mnemonic(sub)): 1\n","matches":[[{"type":"absolute","value":1698505648},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698505664},{"type":"absolute","value":1698505674}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"add"}}},"children":[],"locations":[{"type":"absolute","value":1698505667}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"sub"}}},"children":[],"locations":[{"type":"absolute","value":1698505682}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698505664}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":6,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698505648},{"type":"absolute","value":1698505688},{"type":"absolute","value":1698505653},{"type":"absolute","value":1698505664}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698643312},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1698643461}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"add"}}},"children":[],"locations":[{"type":"absolute","value":1698643481}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"mnemonic","mnemonic":"sub"}}},"children":[],"locations":[{"type":"absolute","value":1698643496}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698643456}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":6,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698643312},{"type":"absolute","value":1698643456},{"type":"absolute","value":1698643454},{"type":"absolute","value":1698643502}],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using AES via x86 extensions":{"meta":{"name":"encrypt data using AES via x86 extensions","namespace":"data-manipulation/encryption/aes","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encryption-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encryption-Standard Algorithm","id":"E1027.m05"},{"parts":["Cryptography","Encrypt Data","AES"],"objective":"Cryptography","behavior":"Encrypt Data","method":"AES","id":"C0027.001"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using AES via x86 extensions\n    namespace: data-manipulation/encryption/aes\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]\n      - Cryptography::Encrypt Data::AES [C0027.001]\n  features:\n    - or:\n      - mnemonic: aesenc = Perform One Round of an AES Encryption Flow\n      - mnemonic: vaesenc\n      - mnemonic: aesenclast = Perform Last Round of an AES Encryption Flow\n      - mnemonic: vaesenclast\n      - mnemonic: aesimc = Perform the AES InvMixColumn Transformation\n      - mnemonic: vaesimc\n      - mnemonic: aeskeygenassist = AES Round Key Generation Assist\n      - mnemonic: vaeskeygenassist\n","matches":[[{"type":"absolute","value":1698627360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[{"type":"absolute","value":1698650497},{"type":"absolute","value":1698650689},{"type":"absolute","value":1698650595},{"type":"absolute","value":1698650535},{"type":"absolute","value":1698650440},{"type":"absolute","value":1698650631},{"type":"absolute","value":1698650573},{"type":"absolute","value":1698650478},{"type":"absolute","value":1698650516},{"type":"absolute","value":1698650711},{"type":"absolute","value":1698650554},{"type":"absolute","value":1698650459},{"type":"absolute","value":1698650653}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698631904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653057},{"type":"absolute","value":1698653315},{"type":"absolute","value":1698653188},{"type":"absolute","value":1698653062},{"type":"absolute","value":1698653320},{"type":"absolute","value":1698653193},{"type":"absolute","value":1698653067},{"type":"absolute","value":1698653579},{"type":"absolute","value":1698653325},{"type":"absolute","value":1698653198},{"type":"absolute","value":1698653072},{"type":"absolute","value":1698653203},{"type":"absolute","value":1698653592},{"type":"absolute","value":1698653082},{"type":"absolute","value":1698653087},{"type":"absolute","value":1698653566},{"type":"absolute","value":1698653092},{"type":"absolute","value":1698653221},{"type":"absolute","value":1698653097},{"type":"absolute","value":1698653226},{"type":"absolute","value":1698653611},{"type":"absolute","value":1698653231},{"type":"absolute","value":1698653107},{"type":"absolute","value":1698653236},{"type":"absolute","value":1698652982},{"type":"absolute","value":1698653112},{"type":"absolute","value":1698653624},{"type":"absolute","value":1698652987},{"type":"absolute","value":1698653117},{"type":"absolute","value":1698652992},{"type":"absolute","value":1698653249},{"type":"absolute","value":1698653122},{"type":"absolute","value":1698653506},{"type":"absolute","value":1698652997},{"type":"absolute","value":1698653254},{"type":"absolute","value":1698653259},{"type":"absolute","value":1698653132},{"type":"absolute","value":1698653516},{"type":"absolute","value":1698653643},{"type":"absolute","value":1698653007},{"type":"absolute","value":1698653264},{"type":"absolute","value":1698653137},{"type":"absolute","value":1698653012},{"type":"absolute","value":1698653142},{"type":"absolute","value":1698653526},{"type":"absolute","value":1698653656},{"type":"absolute","value":1698653017},{"type":"absolute","value":1698653147},{"type":"absolute","value":1698653022},{"type":"absolute","value":1698653536},{"type":"absolute","value":1698653282},{"type":"absolute","value":1698653287},{"type":"absolute","value":1698653032},{"type":"absolute","value":1698653160},{"type":"absolute","value":1698653546},{"type":"absolute","value":1698653292},{"type":"absolute","value":1698653037},{"type":"absolute","value":1698653165},{"type":"absolute","value":1698653047},{"type":"absolute","value":1698653297},{"type":"absolute","value":1698653042},{"type":"absolute","value":1698653170},{"type":"absolute","value":1698653556},{"type":"absolute","value":1698653175},{"type":"absolute","value":1698653310}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653348},{"type":"absolute","value":1698653669},{"type":"absolute","value":1698653353},{"type":"absolute","value":1698653338},{"type":"absolute","value":1698653343}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651078},{"type":"absolute","value":1698651048},{"type":"absolute","value":1698651114},{"type":"absolute","value":1698651146},{"type":"absolute","value":1698651178},{"type":"absolute","value":1698651088},{"type":"absolute","value":1698651133},{"type":"absolute","value":1698651058},{"type":"absolute","value":1698651165},{"type":"absolute","value":1698651028},{"type":"absolute","value":1698651068},{"type":"absolute","value":1698651101},{"type":"absolute","value":1698651038}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698632720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651365},{"type":"absolute","value":1698651398},{"type":"absolute","value":1698651335},{"type":"absolute","value":1698651430},{"type":"absolute","value":1698651462},{"type":"absolute","value":1698651375},{"type":"absolute","value":1698651345},{"type":"absolute","value":1698651411},{"type":"absolute","value":1698651443},{"type":"absolute","value":1698651475},{"type":"absolute","value":1698651385},{"type":"absolute","value":1698651355},{"type":"absolute","value":1698651325}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698648368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[{"type":"absolute","value":1698649089},{"type":"absolute","value":1698648706},{"type":"absolute","value":1698648451},{"type":"absolute","value":1698649347},{"type":"absolute","value":1698650308},{"type":"absolute","value":1698649866},{"type":"absolute","value":1698649293},{"type":"absolute","value":1698649038},{"type":"absolute","value":1698648655},{"type":"absolute","value":1698648400},{"type":"absolute","value":1698649617},{"type":"absolute","value":1698650130},{"type":"absolute","value":1698649242},{"type":"absolute","value":1698649563},{"type":"absolute","value":1698648604},{"type":"absolute","value":1698648987},{"type":"absolute","value":1698648865},{"type":"absolute","value":1698649697},{"type":"absolute","value":1698650210},{"type":"absolute","value":1698649509},{"type":"absolute","value":1698649958},{"type":"absolute","value":1698649191},{"type":"absolute","value":1698648553},{"type":"absolute","value":1698648811},{"type":"absolute","value":1698649455},{"type":"absolute","value":1698650035},{"type":"absolute","value":1698649140},{"type":"absolute","value":1698648757},{"type":"absolute","value":1698648502},{"type":"absolute","value":1698649401},{"type":"absolute","value":1698649789}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650400},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[{"type":"absolute","value":1698650497},{"type":"absolute","value":1698650689},{"type":"absolute","value":1698650595},{"type":"absolute","value":1698650535},{"type":"absolute","value":1698650440},{"type":"absolute","value":1698650631},{"type":"absolute","value":1698650573},{"type":"absolute","value":1698650478},{"type":"absolute","value":1698650516},{"type":"absolute","value":1698650711},{"type":"absolute","value":1698650554},{"type":"absolute","value":1698650459},{"type":"absolute","value":1698650653}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698650852},{"type":"absolute","value":1698650822},{"type":"absolute","value":1698650940},{"type":"absolute","value":1698650792},{"type":"absolute","value":1698650927},{"type":"absolute","value":1698650832},{"type":"absolute","value":1698650865},{"type":"absolute","value":1698650802},{"type":"absolute","value":1698650896},{"type":"absolute","value":1698650842},{"type":"absolute","value":1698650812},{"type":"absolute","value":1698650909},{"type":"absolute","value":1698650878}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698650953}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698650976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651078},{"type":"absolute","value":1698651048},{"type":"absolute","value":1698651114},{"type":"absolute","value":1698651146},{"type":"absolute","value":1698651178},{"type":"absolute","value":1698651088},{"type":"absolute","value":1698651133},{"type":"absolute","value":1698651058},{"type":"absolute","value":1698651165},{"type":"absolute","value":1698651028},{"type":"absolute","value":1698651068},{"type":"absolute","value":1698651101},{"type":"absolute","value":1698651038}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651248},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651365},{"type":"absolute","value":1698651398},{"type":"absolute","value":1698651335},{"type":"absolute","value":1698651430},{"type":"absolute","value":1698651462},{"type":"absolute","value":1698651375},{"type":"absolute","value":1698651345},{"type":"absolute","value":1698651411},{"type":"absolute","value":1698651443},{"type":"absolute","value":1698651475},{"type":"absolute","value":1698651385},{"type":"absolute","value":1698651355},{"type":"absolute","value":1698651325}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698651488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698651568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652545},{"type":"absolute","value":1698652166},{"type":"absolute","value":1698652422},{"type":"absolute","value":1698651913},{"type":"absolute","value":1698652171},{"type":"absolute","value":1698652044},{"type":"absolute","value":1698651918},{"type":"absolute","value":1698652558},{"type":"absolute","value":1698652176},{"type":"absolute","value":1698652049},{"type":"absolute","value":1698652432},{"type":"absolute","value":1698651923},{"type":"absolute","value":1698652181},{"type":"absolute","value":1698652054},{"type":"absolute","value":1698651928},{"type":"absolute","value":1698652442},{"type":"absolute","value":1698652059},{"type":"absolute","value":1698651938},{"type":"absolute","value":1698652452},{"type":"absolute","value":1698651943},{"type":"absolute","value":1698651948},{"type":"absolute","value":1698652077},{"type":"absolute","value":1698652462},{"type":"absolute","value":1698651953},{"type":"absolute","value":1698652082},{"type":"absolute","value":1698652087},{"type":"absolute","value":1698651963},{"type":"absolute","value":1698652092},{"type":"absolute","value":1698652475},{"type":"absolute","value":1698651838},{"type":"absolute","value":1698651968},{"type":"absolute","value":1698651843},{"type":"absolute","value":1698651973},{"type":"absolute","value":1698651848},{"type":"absolute","value":1698652105},{"type":"absolute","value":1698651978},{"type":"absolute","value":1698652488},{"type":"absolute","value":1698651853},{"type":"absolute","value":1698652110},{"type":"absolute","value":1698652115},{"type":"absolute","value":1698651988},{"type":"absolute","value":1698651863},{"type":"absolute","value":1698652120},{"type":"absolute","value":1698651993},{"type":"absolute","value":1698651898},{"type":"absolute","value":1698651868},{"type":"absolute","value":1698651998},{"type":"absolute","value":1698652510},{"type":"absolute","value":1698651873},{"type":"absolute","value":1698652003},{"type":"absolute","value":1698651878},{"type":"absolute","value":1698652138},{"type":"absolute","value":1698652523},{"type":"absolute","value":1698652143},{"type":"absolute","value":1698651888},{"type":"absolute","value":1698652016},{"type":"absolute","value":1698652402},{"type":"absolute","value":1698651903},{"type":"absolute","value":1698652148},{"type":"absolute","value":1698651893},{"type":"absolute","value":1698652021},{"type":"absolute","value":1698652153},{"type":"absolute","value":1698652026},{"type":"absolute","value":1698652412},{"type":"absolute","value":1698652031}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652209},{"type":"absolute","value":1698652194},{"type":"absolute","value":1698652199},{"type":"absolute","value":1698652571},{"type":"absolute","value":1698652204}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698652880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653057},{"type":"absolute","value":1698653315},{"type":"absolute","value":1698653188},{"type":"absolute","value":1698653062},{"type":"absolute","value":1698653320},{"type":"absolute","value":1698653193},{"type":"absolute","value":1698653067},{"type":"absolute","value":1698653579},{"type":"absolute","value":1698653325},{"type":"absolute","value":1698653198},{"type":"absolute","value":1698653072},{"type":"absolute","value":1698653203},{"type":"absolute","value":1698653592},{"type":"absolute","value":1698653082},{"type":"absolute","value":1698653087},{"type":"absolute","value":1698653566},{"type":"absolute","value":1698653092},{"type":"absolute","value":1698653221},{"type":"absolute","value":1698653097},{"type":"absolute","value":1698653226},{"type":"absolute","value":1698653611},{"type":"absolute","value":1698653231},{"type":"absolute","value":1698653107},{"type":"absolute","value":1698653236},{"type":"absolute","value":1698652982},{"type":"absolute","value":1698653112},{"type":"absolute","value":1698653624},{"type":"absolute","value":1698652987},{"type":"absolute","value":1698653117},{"type":"absolute","value":1698652992},{"type":"absolute","value":1698653249},{"type":"absolute","value":1698653122},{"type":"absolute","value":1698653506},{"type":"absolute","value":1698652997},{"type":"absolute","value":1698653254},{"type":"absolute","value":1698653259},{"type":"absolute","value":1698653132},{"type":"absolute","value":1698653516},{"type":"absolute","value":1698653643},{"type":"absolute","value":1698653007},{"type":"absolute","value":1698653264},{"type":"absolute","value":1698653137},{"type":"absolute","value":1698653012},{"type":"absolute","value":1698653142},{"type":"absolute","value":1698653526},{"type":"absolute","value":1698653656},{"type":"absolute","value":1698653017},{"type":"absolute","value":1698653147},{"type":"absolute","value":1698653022},{"type":"absolute","value":1698653536},{"type":"absolute","value":1698653282},{"type":"absolute","value":1698653287},{"type":"absolute","value":1698653032},{"type":"absolute","value":1698653160},{"type":"absolute","value":1698653546},{"type":"absolute","value":1698653292},{"type":"absolute","value":1698653037},{"type":"absolute","value":1698653165},{"type":"absolute","value":1698653047},{"type":"absolute","value":1698653297},{"type":"absolute","value":1698653042},{"type":"absolute","value":1698653170},{"type":"absolute","value":1698653556},{"type":"absolute","value":1698653175},{"type":"absolute","value":1698653310}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653348},{"type":"absolute","value":1698653669},{"type":"absolute","value":1698653353},{"type":"absolute","value":1698653338},{"type":"absolute","value":1698653343}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698654656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698656771},{"type":"absolute","value":1698656776},{"type":"absolute","value":1698654985},{"type":"absolute","value":1698657292},{"type":"absolute","value":1698656781},{"type":"absolute","value":1698657305},{"type":"absolute","value":1698656794},{"type":"absolute","value":1698656799},{"type":"absolute","value":1698656804},{"type":"absolute","value":1698656809},{"type":"absolute","value":1698656822},{"type":"absolute","value":1698656827},{"type":"absolute","value":1698656832},{"type":"absolute","value":1698656837},{"type":"absolute","value":1698656855},{"type":"absolute","value":1698656860},{"type":"absolute","value":1698656865},{"type":"absolute","value":1698656870},{"type":"absolute","value":1698656616},{"type":"absolute","value":1698656621},{"type":"absolute","value":1698656626},{"type":"absolute","value":1698656883},{"type":"absolute","value":1698654837},{"type":"absolute","value":1698656631},{"type":"absolute","value":1698656888},{"type":"absolute","value":1698656893},{"type":"absolute","value":1698654847},{"type":"absolute","value":1698656641},{"type":"absolute","value":1698656898},{"type":"absolute","value":1698657157},{"type":"absolute","value":1698656646},{"type":"absolute","value":1698654857},{"type":"absolute","value":1698656651},{"type":"absolute","value":1698657167},{"type":"absolute","value":1698656656},{"type":"absolute","value":1698654867},{"type":"absolute","value":1698656916},{"type":"absolute","value":1698656921},{"type":"absolute","value":1698656666},{"type":"absolute","value":1698657177},{"type":"absolute","value":1698654877},{"type":"absolute","value":1698656926},{"type":"absolute","value":1698656671},{"type":"absolute","value":1698656931},{"type":"absolute","value":1698656676},{"type":"absolute","value":1698657187},{"type":"absolute","value":1698654887},{"type":"absolute","value":1698656681},{"type":"absolute","value":1698657197},{"type":"absolute","value":1698656944},{"type":"absolute","value":1698654897},{"type":"absolute","value":1698656691},{"type":"absolute","value":1698656949},{"type":"absolute","value":1698657207},{"type":"absolute","value":1698656696},{"type":"absolute","value":1698656954},{"type":"absolute","value":1698656701},{"type":"absolute","value":1698654910},{"type":"absolute","value":1698656959},{"type":"absolute","value":1698657217},{"type":"absolute","value":1698656706},{"type":"absolute","value":1698654923},{"type":"absolute","value":1698656716},{"type":"absolute","value":1698657230},{"type":"absolute","value":1698656721},{"type":"absolute","value":1698656726},{"type":"absolute","value":1698656731},{"type":"absolute","value":1698657243},{"type":"absolute","value":1698654941},{"type":"absolute","value":1698656741},{"type":"absolute","value":1698654954},{"type":"absolute","value":1698656746},{"type":"absolute","value":1698657261},{"type":"absolute","value":1698656751},{"type":"absolute","value":1698656756},{"type":"absolute","value":1698657274},{"type":"absolute","value":1698654972},{"type":"absolute","value":1698656766}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698656977},{"type":"absolute","value":1698654998},{"type":"absolute","value":1698656982},{"type":"absolute","value":1698657318},{"type":"absolute","value":1698656987},{"type":"absolute","value":1698656972}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698657376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698658562},{"type":"absolute","value":1698657539},{"type":"absolute","value":1698658057},{"type":"absolute","value":1698657549},{"type":"absolute","value":1698658062},{"type":"absolute","value":1698658067},{"type":"absolute","value":1698658580},{"type":"absolute","value":1698657559},{"type":"absolute","value":1698658072},{"type":"absolute","value":1698657569},{"type":"absolute","value":1698658082},{"type":"absolute","value":1698658593},{"type":"absolute","value":1698658087},{"type":"absolute","value":1698657579},{"type":"absolute","value":1698658092},{"type":"absolute","value":1698658097},{"type":"absolute","value":1698657592},{"type":"absolute","value":1698658107},{"type":"absolute","value":1698658112},{"type":"absolute","value":1698657605},{"type":"absolute","value":1698658117},{"type":"absolute","value":1698658122},{"type":"absolute","value":1698657623},{"type":"absolute","value":1698658135},{"type":"absolute","value":1698658140},{"type":"absolute","value":1698658145},{"type":"absolute","value":1698657636},{"type":"absolute","value":1698658150},{"type":"absolute","value":1698658163},{"type":"absolute","value":1698657654},{"type":"absolute","value":1698658168},{"type":"absolute","value":1698658173},{"type":"absolute","value":1698658178},{"type":"absolute","value":1698657667},{"type":"absolute","value":1698658445},{"type":"absolute","value":1698658196},{"type":"absolute","value":1698658455},{"type":"absolute","value":1698658201},{"type":"absolute","value":1698658206},{"type":"absolute","value":1698658465},{"type":"absolute","value":1698658211},{"type":"absolute","value":1698657957},{"type":"absolute","value":1698657962},{"type":"absolute","value":1698658475},{"type":"absolute","value":1698657967},{"type":"absolute","value":1698658224},{"type":"absolute","value":1698657972},{"type":"absolute","value":1698658229},{"type":"absolute","value":1698658485},{"type":"absolute","value":1698658234},{"type":"absolute","value":1698657982},{"type":"absolute","value":1698658239},{"type":"absolute","value":1698658495},{"type":"absolute","value":1698657987},{"type":"absolute","value":1698657992},{"type":"absolute","value":1698658505},{"type":"absolute","value":1698657997},{"type":"absolute","value":1698658257},{"type":"absolute","value":1698658262},{"type":"absolute","value":1698658007},{"type":"absolute","value":1698658518},{"type":"absolute","value":1698658267},{"type":"absolute","value":1698658012},{"type":"absolute","value":1698658272},{"type":"absolute","value":1698658017},{"type":"absolute","value":1698658531},{"type":"absolute","value":1698658022},{"type":"absolute","value":1698658285},{"type":"absolute","value":1698657519},{"type":"absolute","value":1698658032},{"type":"absolute","value":1698658290},{"type":"absolute","value":1698658037},{"type":"absolute","value":1698658549},{"type":"absolute","value":1698658295},{"type":"absolute","value":1698657529},{"type":"absolute","value":1698658042},{"type":"absolute","value":1698658300},{"type":"absolute","value":1698658047}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698657680},{"type":"absolute","value":1698658606},{"type":"absolute","value":1698658323},{"type":"absolute","value":1698658328},{"type":"absolute","value":1698658313},{"type":"absolute","value":1698658318}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698833800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698849280},{"type":"absolute","value":1698836481},{"type":"absolute","value":1698849285},{"type":"absolute","value":1698836486},{"type":"absolute","value":1698849290},{"type":"absolute","value":1698836491},{"type":"absolute","value":1698849295},{"type":"absolute","value":1698836496},{"type":"absolute","value":1698849300},{"type":"absolute","value":1698836501},{"type":"absolute","value":1698849305},{"type":"absolute","value":1698836506},{"type":"absolute","value":1698840605},{"type":"absolute","value":1698849310},{"type":"absolute","value":1698840610},{"type":"absolute","value":1698849315},{"type":"absolute","value":1698854947},{"type":"absolute","value":1698840615},{"type":"absolute","value":1698854952},{"type":"absolute","value":1698840620},{"type":"absolute","value":1698854957},{"type":"absolute","value":1698840625},{"type":"absolute","value":1698854962},{"type":"absolute","value":1698840630},{"type":"absolute","value":1698854967},{"type":"absolute","value":1698840635},{"type":"absolute","value":1698854972},{"type":"absolute","value":1698844221},{"type":"absolute","value":1698840640},{"type":"absolute","value":1698854977},{"type":"absolute","value":1698844226},{"type":"absolute","value":1698854982},{"type":"absolute","value":1698844231},{"type":"absolute","value":1698844236},{"type":"absolute","value":1698844241},{"type":"absolute","value":1698844246},{"type":"absolute","value":1698844251},{"type":"absolute","value":1698844256},{"type":"absolute","value":1698835567},{"type":"absolute","value":1698835572},{"type":"absolute","value":1698848373},{"type":"absolute","value":1698835577},{"type":"absolute","value":1698848378},{"type":"absolute","value":1698835582},{"type":"absolute","value":1698848383},{"type":"absolute","value":1698835587},{"type":"absolute","value":1698848388},{"type":"absolute","value":1698835592},{"type":"absolute","value":1698848393},{"type":"absolute","value":1698835597},{"type":"absolute","value":1698848398},{"type":"absolute","value":1698839183},{"type":"absolute","value":1698835602},{"type":"absolute","value":1698848403},{"type":"absolute","value":1698839188},{"type":"absolute","value":1698848408},{"type":"absolute","value":1698839193},{"type":"absolute","value":1698854040},{"type":"absolute","value":1698854045},{"type":"absolute","value":1698839198},{"type":"absolute","value":1698854050},{"type":"absolute","value":1698839203},{"type":"absolute","value":1698854055},{"type":"absolute","value":1698839208},{"type":"absolute","value":1698854060},{"type":"absolute","value":1698839213},{"type":"absolute","value":1698854065},{"type":"absolute","value":1698839218},{"type":"absolute","value":1698843317},{"type":"absolute","value":1698854070},{"type":"absolute","value":1698843322},{"type":"absolute","value":1698854075},{"type":"absolute","value":1698843327},{"type":"absolute","value":1698843332},{"type":"absolute","value":1698857668},{"type":"absolute","value":1698843337},{"type":"absolute","value":1698857673},{"type":"absolute","value":1698843342},{"type":"absolute","value":1698857678},{"type":"absolute","value":1698843347},{"type":"absolute","value":1698857683},{"type":"absolute","value":1698843352},{"type":"absolute","value":1698857688},{"type":"absolute","value":1698857693},{"type":"absolute","value":1698857698},{"type":"absolute","value":1698834663},{"type":"absolute","value":1698857703},{"type":"absolute","value":1698847466},{"type":"absolute","value":1698834668},{"type":"absolute","value":1698847471},{"type":"absolute","value":1698834673},{"type":"absolute","value":1698847476},{"type":"absolute","value":1698834678},{"type":"absolute","value":1698847481},{"type":"absolute","value":1698834683},{"type":"absolute","value":1698847486},{"type":"absolute","value":1698834688},{"type":"absolute","value":1698847491},{"type":"absolute","value":1698834693},{"type":"absolute","value":1698838279},{"type":"absolute","value":1698847496},{"type":"absolute","value":1698834698},{"type":"absolute","value":1698838284},{"type":"absolute","value":1698847501},{"type":"absolute","value":1698853133},{"type":"absolute","value":1698838289},{"type":"absolute","value":1698853138},{"type":"absolute","value":1698838294},{"type":"absolute","value":1698851094},{"type":"absolute","value":1698853143},{"type":"absolute","value":1698838299},{"type":"absolute","value":1698851099},{"type":"absolute","value":1698853148},{"type":"absolute","value":1698838304},{"type":"absolute","value":1698851104},{"type":"absolute","value":1698853153},{"type":"absolute","value":1698838309},{"type":"absolute","value":1698851109},{"type":"absolute","value":1698853158},{"type":"absolute","value":1698838314},{"type":"absolute","value":1698851114},{"type":"absolute","value":1698853163},{"type":"absolute","value":1698842413},{"type":"absolute","value":1698851119},{"type":"absolute","value":1698853168},{"type":"absolute","value":1698842418},{"type":"absolute","value":1698851124},{"type":"absolute","value":1698842423},{"type":"absolute","value":1698851129},{"type":"absolute","value":1698856761},{"type":"absolute","value":1698842428},{"type":"absolute","value":1698856766},{"type":"absolute","value":1698842433},{"type":"absolute","value":1698856771},{"type":"absolute","value":1698842438},{"type":"absolute","value":1698856776},{"type":"absolute","value":1698842443},{"type":"absolute","value":1698856781},{"type":"absolute","value":1698842448},{"type":"absolute","value":1698856786},{"type":"absolute","value":1698856791},{"type":"absolute","value":1698856796},{"type":"absolute","value":1698846559},{"type":"absolute","value":1698846564},{"type":"absolute","value":1698846569},{"type":"absolute","value":1698846574},{"type":"absolute","value":1698846579},{"type":"absolute","value":1698846584},{"type":"absolute","value":1698846589},{"type":"absolute","value":1698837375},{"type":"absolute","value":1698846594},{"type":"absolute","value":1698837380},{"type":"absolute","value":1698837385},{"type":"absolute","value":1698850187},{"type":"absolute","value":1698837390},{"type":"absolute","value":1698850192},{"type":"absolute","value":1698837395},{"type":"absolute","value":1698850197},{"type":"absolute","value":1698837400},{"type":"absolute","value":1698850202},{"type":"absolute","value":1698837405},{"type":"absolute","value":1698850207},{"type":"absolute","value":1698837410},{"type":"absolute","value":1698850212},{"type":"absolute","value":1698841509},{"type":"absolute","value":1698850217},{"type":"absolute","value":1698841514},{"type":"absolute","value":1698850222},{"type":"absolute","value":1698841519},{"type":"absolute","value":1698855854},{"type":"absolute","value":1698855859},{"type":"absolute","value":1698841524},{"type":"absolute","value":1698855864},{"type":"absolute","value":1698841529},{"type":"absolute","value":1698855869},{"type":"absolute","value":1698841534},{"type":"absolute","value":1698855874},{"type":"absolute","value":1698841539},{"type":"absolute","value":1698845125},{"type":"absolute","value":1698855879},{"type":"absolute","value":1698841544},{"type":"absolute","value":1698845130},{"type":"absolute","value":1698855884},{"type":"absolute","value":1698845135},{"type":"absolute","value":1698855889},{"type":"absolute","value":1698845140},{"type":"absolute","value":1698845145},{"type":"absolute","value":1698845150},{"type":"absolute","value":1698845155},{"type":"absolute","value":1698845160},{"type":"absolute","value":1698836471},{"type":"absolute","value":1698836476}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698858208},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698863616},{"type":"absolute","value":1698872833},{"type":"absolute","value":1698863621},{"type":"absolute","value":1698872838},{"type":"absolute","value":1698863626},{"type":"absolute","value":1698863631},{"type":"absolute","value":1698863636},{"type":"absolute","value":1698876950},{"type":"absolute","value":1698863641},{"type":"absolute","value":1698876955},{"type":"absolute","value":1698863646},{"type":"absolute","value":1698876960},{"type":"absolute","value":1698863651},{"type":"absolute","value":1698876965},{"type":"absolute","value":1698876970},{"type":"absolute","value":1698876975},{"type":"absolute","value":1698860023},{"type":"absolute","value":1698876980},{"type":"absolute","value":1698867765},{"type":"absolute","value":1698876985},{"type":"absolute","value":1698867770},{"type":"absolute","value":1698867775},{"type":"absolute","value":1698880578},{"type":"absolute","value":1698867780},{"type":"absolute","value":1698880583},{"type":"absolute","value":1698859081},{"type":"absolute","value":1698867785},{"type":"absolute","value":1698880588},{"type":"absolute","value":1698859086},{"type":"absolute","value":1698867790},{"type":"absolute","value":1698880593},{"type":"absolute","value":1698859091},{"type":"absolute","value":1698867795},{"type":"absolute","value":1698880598},{"type":"absolute","value":1698859096},{"type":"absolute","value":1698867800},{"type":"absolute","value":1698871899},{"type":"absolute","value":1698880603},{"type":"absolute","value":1698859101},{"type":"absolute","value":1698871904},{"type":"absolute","value":1698880608},{"type":"absolute","value":1698859106},{"type":"absolute","value":1698871909},{"type":"absolute","value":1698880613},{"type":"absolute","value":1698859111},{"type":"absolute","value":1698871914},{"type":"absolute","value":1698859116},{"type":"absolute","value":1698871919},{"type":"absolute","value":1698871924},{"type":"absolute","value":1698862709},{"type":"absolute","value":1698871929},{"type":"absolute","value":1698862714},{"type":"absolute","value":1698875515},{"type":"absolute","value":1698871934},{"type":"absolute","value":1698862719},{"type":"absolute","value":1698875520},{"type":"absolute","value":1698862724},{"type":"absolute","value":1698875525},{"type":"absolute","value":1698862729},{"type":"absolute","value":1698875530},{"type":"absolute","value":1698862734},{"type":"absolute","value":1698875535},{"type":"absolute","value":1698862739},{"type":"absolute","value":1698875540},{"type":"absolute","value":1698862744},{"type":"absolute","value":1698875545},{"type":"absolute","value":1698875550},{"type":"absolute","value":1698866861},{"type":"absolute","value":1698866866},{"type":"absolute","value":1698866871},{"type":"absolute","value":1698879671},{"type":"absolute","value":1698866876},{"type":"absolute","value":1698879676},{"type":"absolute","value":1698866881},{"type":"absolute","value":1698879681},{"type":"absolute","value":1698866886},{"type":"absolute","value":1698879686},{"type":"absolute","value":1698866891},{"type":"absolute","value":1698879691},{"type":"absolute","value":1698866896},{"type":"absolute","value":1698879696},{"type":"absolute","value":1698870995},{"type":"absolute","value":1698879701},{"type":"absolute","value":1698871000},{"type":"absolute","value":1698879706},{"type":"absolute","value":1698871005},{"type":"absolute","value":1698871010},{"type":"absolute","value":1698871015},{"type":"absolute","value":1698861802},{"type":"absolute","value":1698871020},{"type":"absolute","value":1698861807},{"type":"absolute","value":1698871025},{"type":"absolute","value":1698874611},{"type":"absolute","value":1698861812},{"type":"absolute","value":1698871030},{"type":"absolute","value":1698874616},{"type":"absolute","value":1698861817},{"type":"absolute","value":1698874621},{"type":"absolute","value":1698861822},{"type":"absolute","value":1698874626},{"type":"absolute","value":1698861827},{"type":"absolute","value":1698874631},{"type":"absolute","value":1698861832},{"type":"absolute","value":1698874636},{"type":"absolute","value":1698861837},{"type":"absolute","value":1698874641},{"type":"absolute","value":1698874646},{"type":"absolute","value":1698865957},{"type":"absolute","value":1698865962},{"type":"absolute","value":1698878764},{"type":"absolute","value":1698865967},{"type":"absolute","value":1698878769},{"type":"absolute","value":1698865972},{"type":"absolute","value":1698878774},{"type":"absolute","value":1698865977},{"type":"absolute","value":1698878779},{"type":"absolute","value":1698865982},{"type":"absolute","value":1698878784},{"type":"absolute","value":1698865987},{"type":"absolute","value":1698869573},{"type":"absolute","value":1698878789},{"type":"absolute","value":1698865992},{"type":"absolute","value":1698869578},{"type":"absolute","value":1698878794},{"type":"absolute","value":1698869583},{"type":"absolute","value":1698878799},{"type":"absolute","value":1698869588},{"type":"absolute","value":1698869593},{"type":"absolute","value":1698869598},{"type":"absolute","value":1698860895},{"type":"absolute","value":1698869603},{"type":"absolute","value":1698860900},{"type":"absolute","value":1698869608},{"type":"absolute","value":1698860905},{"type":"absolute","value":1698873707},{"type":"absolute","value":1698860910},{"type":"absolute","value":1698873712},{"type":"absolute","value":1698860915},{"type":"absolute","value":1698873717},{"type":"absolute","value":1698860920},{"type":"absolute","value":1698873722},{"type":"absolute","value":1698860925},{"type":"absolute","value":1698873727},{"type":"absolute","value":1698860930},{"type":"absolute","value":1698873732},{"type":"absolute","value":1698873737},{"type":"absolute","value":1698873742},{"type":"absolute","value":1698865053},{"type":"absolute","value":1698877857},{"type":"absolute","value":1698865058},{"type":"absolute","value":1698877862},{"type":"absolute","value":1698865063},{"type":"absolute","value":1698877867},{"type":"absolute","value":1698865068},{"type":"absolute","value":1698877872},{"type":"absolute","value":1698865073},{"type":"absolute","value":1698877877},{"type":"absolute","value":1698865078},{"type":"absolute","value":1698877882},{"type":"absolute","value":1698865083},{"type":"absolute","value":1698868669},{"type":"absolute","value":1698877887},{"type":"absolute","value":1698865088},{"type":"absolute","value":1698868674},{"type":"absolute","value":1698877892},{"type":"absolute","value":1698868679},{"type":"absolute","value":1698868684},{"type":"absolute","value":1698881485},{"type":"absolute","value":1698868689},{"type":"absolute","value":1698881490},{"type":"absolute","value":1698859988},{"type":"absolute","value":1698868694},{"type":"absolute","value":1698881495},{"type":"absolute","value":1698859993},{"type":"absolute","value":1698868699},{"type":"absolute","value":1698881500},{"type":"absolute","value":1698859998},{"type":"absolute","value":1698868704},{"type":"absolute","value":1698881505},{"type":"absolute","value":1698860003},{"type":"absolute","value":1698872803},{"type":"absolute","value":1698881510},{"type":"absolute","value":1698860008},{"type":"absolute","value":1698872808},{"type":"absolute","value":1698881515},{"type":"absolute","value":1698860013},{"type":"absolute","value":1698872813},{"type":"absolute","value":1698881520},{"type":"absolute","value":1698860018},{"type":"absolute","value":1698872818},{"type":"absolute","value":1698872823},{"type":"absolute","value":1698872828}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698892616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698890468},{"type":"absolute","value":1698889341},{"type":"absolute","value":1698886950},{"type":"absolute","value":1698887591},{"type":"absolute","value":1698890251},{"type":"absolute","value":1698889996},{"type":"absolute","value":1698889775},{"type":"absolute","value":1698887376},{"type":"absolute","value":1698889558},{"type":"absolute","value":1698887165}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698892936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698900992},{"type":"absolute","value":1698903040},{"type":"absolute","value":1698911235},{"type":"absolute","value":1698913284},{"type":"absolute","value":1698903045},{"type":"absolute","value":1698911240},{"type":"absolute","value":1698913289},{"type":"absolute","value":1698903050},{"type":"absolute","value":1698911245},{"type":"absolute","value":1698913294},{"type":"absolute","value":1698902033},{"type":"absolute","value":1698911250},{"type":"absolute","value":1698913299},{"type":"absolute","value":1698902038},{"type":"absolute","value":1698911255},{"type":"absolute","value":1698913304},{"type":"absolute","value":1698893849},{"type":"absolute","value":1698902043},{"type":"absolute","value":1698904091},{"type":"absolute","value":1698913309},{"type":"absolute","value":1698893854},{"type":"absolute","value":1698902048},{"type":"absolute","value":1698904096},{"type":"absolute","value":1698913314},{"type":"absolute","value":1698893859},{"type":"absolute","value":1698902053},{"type":"absolute","value":1698904101},{"type":"absolute","value":1698913319},{"type":"absolute","value":1698893864},{"type":"absolute","value":1698902058},{"type":"absolute","value":1698904106},{"type":"absolute","value":1698912299},{"type":"absolute","value":1698893869},{"type":"absolute","value":1698902063},{"type":"absolute","value":1698904111},{"type":"absolute","value":1698912304},{"type":"absolute","value":1698893874},{"type":"absolute","value":1698902068},{"type":"absolute","value":1698904116},{"type":"absolute","value":1698912309},{"type":"absolute","value":1698893879},{"type":"absolute","value":1698904121},{"type":"absolute","value":1698912314},{"type":"absolute","value":1698893884},{"type":"absolute","value":1698904126},{"type":"absolute","value":1698912319},{"type":"absolute","value":1698912324},{"type":"absolute","value":1698903109},{"type":"absolute","value":1698912329},{"type":"absolute","value":1698903114},{"type":"absolute","value":1698894925},{"type":"absolute","value":1698912334},{"type":"absolute","value":1698903119},{"type":"absolute","value":1698905167},{"type":"absolute","value":1698894930},{"type":"absolute","value":1698903124},{"type":"absolute","value":1698905172},{"type":"absolute","value":1698894935},{"type":"absolute","value":1698903129},{"type":"absolute","value":1698905177},{"type":"absolute","value":1698894940},{"type":"absolute","value":1698903134},{"type":"absolute","value":1698905182},{"type":"absolute","value":1698894945},{"type":"absolute","value":1698913378},{"type":"absolute","value":1698903139},{"type":"absolute","value":1698905187},{"type":"absolute","value":1698894950},{"type":"absolute","value":1698913383},{"type":"absolute","value":1698903144},{"type":"absolute","value":1698905192},{"type":"absolute","value":1698894955},{"type":"absolute","value":1698913388},{"type":"absolute","value":1698905197},{"type":"absolute","value":1698894960},{"type":"absolute","value":1698913393},{"type":"absolute","value":1698905202},{"type":"absolute","value":1698913398},{"type":"absolute","value":1698893943},{"type":"absolute","value":1698904185},{"type":"absolute","value":1698913403},{"type":"absolute","value":1698893948},{"type":"absolute","value":1698904190},{"type":"absolute","value":1698913408},{"type":"absolute","value":1698893953},{"type":"absolute","value":1698896001},{"type":"absolute","value":1698904195},{"type":"absolute","value":1698906243},{"type":"absolute","value":1698913413},{"type":"absolute","value":1698893958},{"type":"absolute","value":1698896006},{"type":"absolute","value":1698904200},{"type":"absolute","value":1698906248},{"type":"absolute","value":1698893963},{"type":"absolute","value":1698896011},{"type":"absolute","value":1698904205},{"type":"absolute","value":1698906253},{"type":"absolute","value":1698893968},{"type":"absolute","value":1698896016},{"type":"absolute","value":1698904210},{"type":"absolute","value":1698906258},{"type":"absolute","value":1698893973},{"type":"absolute","value":1698896021},{"type":"absolute","value":1698904215},{"type":"absolute","value":1698906263},{"type":"absolute","value":1698893978},{"type":"absolute","value":1698896026},{"type":"absolute","value":1698904220},{"type":"absolute","value":1698906268},{"type":"absolute","value":1698896031},{"type":"absolute","value":1698906273},{"type":"absolute","value":1698896036},{"type":"absolute","value":1698906278},{"type":"absolute","value":1698895019},{"type":"absolute","value":1698905261},{"type":"absolute","value":1698895024},{"type":"absolute","value":1698905266},{"type":"absolute","value":1698895029},{"type":"absolute","value":1698897077},{"type":"absolute","value":1698905271},{"type":"absolute","value":1698895034},{"type":"absolute","value":1698897082},{"type":"absolute","value":1698905276},{"type":"absolute","value":1698895039},{"type":"absolute","value":1698897087},{"type":"absolute","value":1698905281},{"type":"absolute","value":1698895044},{"type":"absolute","value":1698897092},{"type":"absolute","value":1698905286},{"type":"absolute","value":1698895049},{"type":"absolute","value":1698897097},{"type":"absolute","value":1698905291},{"type":"absolute","value":1698895054},{"type":"absolute","value":1698897102},{"type":"absolute","value":1698905296},{"type":"absolute","value":1698897107},{"type":"absolute","value":1698897112},{"type":"absolute","value":1698915546},{"type":"absolute","value":1698896095},{"type":"absolute","value":1698915551},{"type":"absolute","value":1698906337},{"type":"absolute","value":1698896100},{"type":"absolute","value":1698915556},{"type":"absolute","value":1698906342},{"type":"absolute","value":1698896105},{"type":"absolute","value":1698898153},{"type":"absolute","value":1698906347},{"type":"absolute","value":1698915561},{"type":"absolute","value":1698896110},{"type":"absolute","value":1698898158},{"type":"absolute","value":1698906352},{"type":"absolute","value":1698915566},{"type":"absolute","value":1698896115},{"type":"absolute","value":1698898163},{"type":"absolute","value":1698906357},{"type":"absolute","value":1698915571},{"type":"absolute","value":1698896120},{"type":"absolute","value":1698898168},{"type":"absolute","value":1698906362},{"type":"absolute","value":1698915576},{"type":"absolute","value":1698896125},{"type":"absolute","value":1698898173},{"type":"absolute","value":1698906367},{"type":"absolute","value":1698915581},{"type":"absolute","value":1698896130},{"type":"absolute","value":1698898178},{"type":"absolute","value":1698906372},{"type":"absolute","value":1698898183},{"type":"absolute","value":1698898188},{"type":"absolute","value":1698916625},{"type":"absolute","value":1698897171},{"type":"absolute","value":1698916630},{"type":"absolute","value":1698897176},{"type":"absolute","value":1698916635},{"type":"absolute","value":1698897181},{"type":"absolute","value":1698899229},{"type":"absolute","value":1698916640},{"type":"absolute","value":1698897186},{"type":"absolute","value":1698899234},{"type":"absolute","value":1698916645},{"type":"absolute","value":1698897191},{"type":"absolute","value":1698899239},{"type":"absolute","value":1698916650},{"type":"absolute","value":1698897196},{"type":"absolute","value":1698899244},{"type":"absolute","value":1698916655},{"type":"absolute","value":1698897201},{"type":"absolute","value":1698899249},{"type":"absolute","value":1698916660},{"type":"absolute","value":1698897206},{"type":"absolute","value":1698899254},{"type":"absolute","value":1698915640},{"type":"absolute","value":1698899259},{"type":"absolute","value":1698915645},{"type":"absolute","value":1698899264},{"type":"absolute","value":1698915650},{"type":"absolute","value":1698898247},{"type":"absolute","value":1698915655},{"type":"absolute","value":1698917704},{"type":"absolute","value":1698898252},{"type":"absolute","value":1698915660},{"type":"absolute","value":1698917709},{"type":"absolute","value":1698898257},{"type":"absolute","value":1698915665},{"type":"absolute","value":1698917714},{"type":"absolute","value":1698898262},{"type":"absolute","value":1698915670},{"type":"absolute","value":1698917719},{"type":"absolute","value":1698898267},{"type":"absolute","value":1698915675},{"type":"absolute","value":1698917724},{"type":"absolute","value":1698898272},{"type":"absolute","value":1698917729},{"type":"absolute","value":1698898277},{"type":"absolute","value":1698917734},{"type":"absolute","value":1698898282},{"type":"absolute","value":1698917739},{"type":"absolute","value":1698916719},{"type":"absolute","value":1698916724},{"type":"absolute","value":1698916729},{"type":"absolute","value":1698899323},{"type":"absolute","value":1698916734},{"type":"absolute","value":1698918783},{"type":"absolute","value":1698899328},{"type":"absolute","value":1698916739},{"type":"absolute","value":1698918788},{"type":"absolute","value":1698899333},{"type":"absolute","value":1698903035},{"type":"absolute","value":1698916744},{"type":"absolute","value":1698918793},{"type":"absolute","value":1698899338},{"type":"absolute","value":1698916749},{"type":"absolute","value":1698918798},{"type":"absolute","value":1698899343},{"type":"absolute","value":1698916754},{"type":"absolute","value":1698918803},{"type":"absolute","value":1698899348},{"type":"absolute","value":1698918808},{"type":"absolute","value":1698899353},{"type":"absolute","value":1698918813},{"type":"absolute","value":1698899358},{"type":"absolute","value":1698918818},{"type":"absolute","value":1698917798},{"type":"absolute","value":1698917803},{"type":"absolute","value":1698917808},{"type":"absolute","value":1698917813},{"type":"absolute","value":1698919862},{"type":"absolute","value":1698917818},{"type":"absolute","value":1698919867},{"type":"absolute","value":1698917823},{"type":"absolute","value":1698919872},{"type":"absolute","value":1698917828},{"type":"absolute","value":1698919877},{"type":"absolute","value":1698917833},{"type":"absolute","value":1698919882},{"type":"absolute","value":1698919887},{"type":"absolute","value":1698919892},{"type":"absolute","value":1698919897},{"type":"absolute","value":1698918877},{"type":"absolute","value":1698918882},{"type":"absolute","value":1698918887},{"type":"absolute","value":1698918892},{"type":"absolute","value":1698920941},{"type":"absolute","value":1698918897},{"type":"absolute","value":1698920946},{"type":"absolute","value":1698918902},{"type":"absolute","value":1698920951},{"type":"absolute","value":1698918907},{"type":"absolute","value":1698920956},{"type":"absolute","value":1698918912},{"type":"absolute","value":1698920961},{"type":"absolute","value":1698920966},{"type":"absolute","value":1698920971},{"type":"absolute","value":1698920976},{"type":"absolute","value":1698919956},{"type":"absolute","value":1698919961},{"type":"absolute","value":1698919966},{"type":"absolute","value":1698919971},{"type":"absolute","value":1698919976},{"type":"absolute","value":1698919981},{"type":"absolute","value":1698919986},{"type":"absolute","value":1698919991},{"type":"absolute","value":1698921035},{"type":"absolute","value":1698921040},{"type":"absolute","value":1698921045},{"type":"absolute","value":1698921050},{"type":"absolute","value":1698921055},{"type":"absolute","value":1698921060},{"type":"absolute","value":1698921065},{"type":"absolute","value":1698921070},{"type":"absolute","value":1698907889},{"type":"absolute","value":1698907894},{"type":"absolute","value":1698907899},{"type":"absolute","value":1698907904},{"type":"absolute","value":1698907909},{"type":"absolute","value":1698907914},{"type":"absolute","value":1698907919},{"type":"absolute","value":1698907924},{"type":"absolute","value":1698908968},{"type":"absolute","value":1698908973},{"type":"absolute","value":1698908978},{"type":"absolute","value":1698908983},{"type":"absolute","value":1698908988},{"type":"absolute","value":1698908993},{"type":"absolute","value":1698908998},{"type":"absolute","value":1698909003},{"type":"absolute","value":1698907983},{"type":"absolute","value":1698907988},{"type":"absolute","value":1698907993},{"type":"absolute","value":1698907998},{"type":"absolute","value":1698910047},{"type":"absolute","value":1698908003},{"type":"absolute","value":1698910052},{"type":"absolute","value":1698908008},{"type":"absolute","value":1698910057},{"type":"absolute","value":1698908013},{"type":"absolute","value":1698910062},{"type":"absolute","value":1698908018},{"type":"absolute","value":1698910067},{"type":"absolute","value":1698910072},{"type":"absolute","value":1698910077},{"type":"absolute","value":1698900863},{"type":"absolute","value":1698910082},{"type":"absolute","value":1698900868},{"type":"absolute","value":1698909062},{"type":"absolute","value":1698900873},{"type":"absolute","value":1698909067},{"type":"absolute","value":1698900878},{"type":"absolute","value":1698909072},{"type":"absolute","value":1698900883},{"type":"absolute","value":1698909077},{"type":"absolute","value":1698911126},{"type":"absolute","value":1698900888},{"type":"absolute","value":1698909082},{"type":"absolute","value":1698911131},{"type":"absolute","value":1698900893},{"type":"absolute","value":1698909087},{"type":"absolute","value":1698911136},{"type":"absolute","value":1698900898},{"type":"absolute","value":1698909092},{"type":"absolute","value":1698911141},{"type":"absolute","value":1698909097},{"type":"absolute","value":1698911146},{"type":"absolute","value":1698911151},{"type":"absolute","value":1698901939},{"type":"absolute","value":1698911156},{"type":"absolute","value":1698901944},{"type":"absolute","value":1698911161},{"type":"absolute","value":1698901949},{"type":"absolute","value":1698910141},{"type":"absolute","value":1698901954},{"type":"absolute","value":1698910146},{"type":"absolute","value":1698901959},{"type":"absolute","value":1698910151},{"type":"absolute","value":1698901964},{"type":"absolute","value":1698910156},{"type":"absolute","value":1698912205},{"type":"absolute","value":1698901969},{"type":"absolute","value":1698910161},{"type":"absolute","value":1698912210},{"type":"absolute","value":1698901974},{"type":"absolute","value":1698910166},{"type":"absolute","value":1698912215},{"type":"absolute","value":1698910171},{"type":"absolute","value":1698912220},{"type":"absolute","value":1698900957},{"type":"absolute","value":1698910176},{"type":"absolute","value":1698912225},{"type":"absolute","value":1698900962},{"type":"absolute","value":1698912230},{"type":"absolute","value":1698900967},{"type":"absolute","value":1698903015},{"type":"absolute","value":1698912235},{"type":"absolute","value":1698900972},{"type":"absolute","value":1698903020},{"type":"absolute","value":1698912240},{"type":"absolute","value":1698900977},{"type":"absolute","value":1698903025},{"type":"absolute","value":1698911220},{"type":"absolute","value":1698900982},{"type":"absolute","value":1698903030},{"type":"absolute","value":1698911225},{"type":"absolute","value":1698900987},{"type":"absolute","value":1698911230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698921616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenc","description":"Perform One Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesenclast","description":"Perform Last Round of an AES Encryption Flow"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesenclast"}},"children":[],"locations":[{"type":"absolute","value":1698930689},{"type":"absolute","value":1698940931},{"type":"absolute","value":1698930694},{"type":"absolute","value":1698940936},{"type":"absolute","value":1698929677},{"type":"absolute","value":1698939919},{"type":"absolute","value":1698929682},{"type":"absolute","value":1698939924},{"type":"absolute","value":1698929687},{"type":"absolute","value":1698931735},{"type":"absolute","value":1698939929},{"type":"absolute","value":1698941977},{"type":"absolute","value":1698929692},{"type":"absolute","value":1698931740},{"type":"absolute","value":1698939934},{"type":"absolute","value":1698941982},{"type":"absolute","value":1698929697},{"type":"absolute","value":1698931745},{"type":"absolute","value":1698939939},{"type":"absolute","value":1698941987},{"type":"absolute","value":1698929702},{"type":"absolute","value":1698931750},{"type":"absolute","value":1698939944},{"type":"absolute","value":1698941992},{"type":"absolute","value":1698922539},{"type":"absolute","value":1698929707},{"type":"absolute","value":1698931755},{"type":"absolute","value":1698939949},{"type":"absolute","value":1698941997},{"type":"absolute","value":1698922544},{"type":"absolute","value":1698929712},{"type":"absolute","value":1698931760},{"type":"absolute","value":1698939954},{"type":"absolute","value":1698942002},{"type":"absolute","value":1698922549},{"type":"absolute","value":1698931765},{"type":"absolute","value":1698942007},{"type":"absolute","value":1698922554},{"type":"absolute","value":1698931770},{"type":"absolute","value":1698942012},{"type":"absolute","value":1698922559},{"type":"absolute","value":1698930753},{"type":"absolute","value":1698940995},{"type":"absolute","value":1698922564},{"type":"absolute","value":1698930758},{"type":"absolute","value":1698941000},{"type":"absolute","value":1698922569},{"type":"absolute","value":1698930763},{"type":"absolute","value":1698932811},{"type":"absolute","value":1698941005},{"type":"absolute","value":1698922574},{"type":"absolute","value":1698930768},{"type":"absolute","value":1698932816},{"type":"absolute","value":1698941010},{"type":"absolute","value":1698930773},{"type":"absolute","value":1698932821},{"type":"absolute","value":1698941015},{"type":"absolute","value":1698930778},{"type":"absolute","value":1698932826},{"type":"absolute","value":1698941020},{"type":"absolute","value":1698930783},{"type":"absolute","value":1698932831},{"type":"absolute","value":1698941025},{"type":"absolute","value":1698923618},{"type":"absolute","value":1698930788},{"type":"absolute","value":1698932836},{"type":"absolute","value":1698941030},{"type":"absolute","value":1698923623},{"type":"absolute","value":1698932841},{"type":"absolute","value":1698923628},{"type":"absolute","value":1698932846},{"type":"absolute","value":1698923633},{"type":"absolute","value":1698931829},{"type":"absolute","value":1698923638},{"type":"absolute","value":1698942071},{"type":"absolute","value":1698931834},{"type":"absolute","value":1698923643},{"type":"absolute","value":1698942076},{"type":"absolute","value":1698931839},{"type":"absolute","value":1698923648},{"type":"absolute","value":1698933887},{"type":"absolute","value":1698942081},{"type":"absolute","value":1698931844},{"type":"absolute","value":1698923653},{"type":"absolute","value":1698933892},{"type":"absolute","value":1698942086},{"type":"absolute","value":1698922633},{"type":"absolute","value":1698931849},{"type":"absolute","value":1698933897},{"type":"absolute","value":1698942091},{"type":"absolute","value":1698922638},{"type":"absolute","value":1698931854},{"type":"absolute","value":1698933902},{"type":"absolute","value":1698942096},{"type":"absolute","value":1698922643},{"type":"absolute","value":1698931859},{"type":"absolute","value":1698933907},{"type":"absolute","value":1698942101},{"type":"absolute","value":1698922648},{"type":"absolute","value":1698924697},{"type":"absolute","value":1698931864},{"type":"absolute","value":1698933912},{"type":"absolute","value":1698942106},{"type":"absolute","value":1698922653},{"type":"absolute","value":1698924702},{"type":"absolute","value":1698933917},{"type":"absolute","value":1698922658},{"type":"absolute","value":1698924707},{"type":"absolute","value":1698933922},{"type":"absolute","value":1698922663},{"type":"absolute","value":1698924712},{"type":"absolute","value":1698932905},{"type":"absolute","value":1698922668},{"type":"absolute","value":1698924717},{"type":"absolute","value":1698932910},{"type":"absolute","value":1698924722},{"type":"absolute","value":1698932915},{"type":"absolute","value":1698934963},{"type":"absolute","value":1698924727},{"type":"absolute","value":1698932920},{"type":"absolute","value":1698934968},{"type":"absolute","value":1698924732},{"type":"absolute","value":1698932925},{"type":"absolute","value":1698934973},{"type":"absolute","value":1698923712},{"type":"absolute","value":1698932930},{"type":"absolute","value":1698934978},{"type":"absolute","value":1698923717},{"type":"absolute","value":1698932935},{"type":"absolute","value":1698934983},{"type":"absolute","value":1698923722},{"type":"absolute","value":1698932940},{"type":"absolute","value":1698934988},{"type":"absolute","value":1698923727},{"type":"absolute","value":1698925776},{"type":"absolute","value":1698934993},{"type":"absolute","value":1698923732},{"type":"absolute","value":1698925781},{"type":"absolute","value":1698934998},{"type":"absolute","value":1698923737},{"type":"absolute","value":1698925786},{"type":"absolute","value":1698933981},{"type":"absolute","value":1698923742},{"type":"absolute","value":1698925791},{"type":"absolute","value":1698933986},{"type":"absolute","value":1698923747},{"type":"absolute","value":1698925796},{"type":"absolute","value":1698933991},{"type":"absolute","value":1698925801},{"type":"absolute","value":1698933996},{"type":"absolute","value":1698925806},{"type":"absolute","value":1698934001},{"type":"absolute","value":1698925811},{"type":"absolute","value":1698934006},{"type":"absolute","value":1698924791},{"type":"absolute","value":1698934011},{"type":"absolute","value":1698924796},{"type":"absolute","value":1698934016},{"type":"absolute","value":1698924801},{"type":"absolute","value":1698924806},{"type":"absolute","value":1698926855},{"type":"absolute","value":1698924811},{"type":"absolute","value":1698926860},{"type":"absolute","value":1698924816},{"type":"absolute","value":1698926865},{"type":"absolute","value":1698935057},{"type":"absolute","value":1698924821},{"type":"absolute","value":1698926870},{"type":"absolute","value":1698935062},{"type":"absolute","value":1698924826},{"type":"absolute","value":1698926875},{"type":"absolute","value":1698935067},{"type":"absolute","value":1698926880},{"type":"absolute","value":1698935072},{"type":"absolute","value":1698926885},{"type":"absolute","value":1698935077},{"type":"absolute","value":1698926890},{"type":"absolute","value":1698935082},{"type":"absolute","value":1698925870},{"type":"absolute","value":1698935087},{"type":"absolute","value":1698925875},{"type":"absolute","value":1698935092},{"type":"absolute","value":1698925880},{"type":"absolute","value":1698925885},{"type":"absolute","value":1698927934},{"type":"absolute","value":1698925890},{"type":"absolute","value":1698927939},{"type":"absolute","value":1698925895},{"type":"absolute","value":1698927944},{"type":"absolute","value":1698925900},{"type":"absolute","value":1698927949},{"type":"absolute","value":1698925905},{"type":"absolute","value":1698927954},{"type":"absolute","value":1698927959},{"type":"absolute","value":1698927964},{"type":"absolute","value":1698927969},{"type":"absolute","value":1698926949},{"type":"absolute","value":1698926954},{"type":"absolute","value":1698926959},{"type":"absolute","value":1698926964},{"type":"absolute","value":1698926969},{"type":"absolute","value":1698926974},{"type":"absolute","value":1698926979},{"type":"absolute","value":1698926984},{"type":"absolute","value":1698928028},{"type":"absolute","value":1698928033},{"type":"absolute","value":1698928038},{"type":"absolute","value":1698928043},{"type":"absolute","value":1698928048},{"type":"absolute","value":1698928053},{"type":"absolute","value":1698928058},{"type":"absolute","value":1698928063},{"type":"absolute","value":1698938873},{"type":"absolute","value":1698938878},{"type":"absolute","value":1698943583},{"type":"absolute","value":1698943588},{"type":"absolute","value":1698943593},{"type":"absolute","value":1698943598},{"type":"absolute","value":1698943603},{"type":"absolute","value":1698943608},{"type":"absolute","value":1698943613},{"type":"absolute","value":1698943618},{"type":"absolute","value":1698944662},{"type":"absolute","value":1698944667},{"type":"absolute","value":1698944672},{"type":"absolute","value":1698944677},{"type":"absolute","value":1698944682},{"type":"absolute","value":1698944687},{"type":"absolute","value":1698944692},{"type":"absolute","value":1698944697},{"type":"absolute","value":1698943677},{"type":"absolute","value":1698943682},{"type":"absolute","value":1698943687},{"type":"absolute","value":1698943692},{"type":"absolute","value":1698945741},{"type":"absolute","value":1698943697},{"type":"absolute","value":1698945746},{"type":"absolute","value":1698943702},{"type":"absolute","value":1698945751},{"type":"absolute","value":1698943707},{"type":"absolute","value":1698945756},{"type":"absolute","value":1698943712},{"type":"absolute","value":1698945761},{"type":"absolute","value":1698945766},{"type":"absolute","value":1698945771},{"type":"absolute","value":1698945776},{"type":"absolute","value":1698944756},{"type":"absolute","value":1698944761},{"type":"absolute","value":1698944766},{"type":"absolute","value":1698944771},{"type":"absolute","value":1698946820},{"type":"absolute","value":1698944776},{"type":"absolute","value":1698946825},{"type":"absolute","value":1698944781},{"type":"absolute","value":1698946830},{"type":"absolute","value":1698944786},{"type":"absolute","value":1698946835},{"type":"absolute","value":1698936597},{"type":"absolute","value":1698944791},{"type":"absolute","value":1698946840},{"type":"absolute","value":1698936602},{"type":"absolute","value":1698946845},{"type":"absolute","value":1698936607},{"type":"absolute","value":1698946850},{"type":"absolute","value":1698936612},{"type":"absolute","value":1698946855},{"type":"absolute","value":1698936617},{"type":"absolute","value":1698945835},{"type":"absolute","value":1698936622},{"type":"absolute","value":1698945840},{"type":"absolute","value":1698936627},{"type":"absolute","value":1698945845},{"type":"absolute","value":1698936632},{"type":"absolute","value":1698945850},{"type":"absolute","value":1698947899},{"type":"absolute","value":1698945855},{"type":"absolute","value":1698947904},{"type":"absolute","value":1698945860},{"type":"absolute","value":1698947909},{"type":"absolute","value":1698937673},{"type":"absolute","value":1698945865},{"type":"absolute","value":1698947914},{"type":"absolute","value":1698937678},{"type":"absolute","value":1698945870},{"type":"absolute","value":1698947919},{"type":"absolute","value":1698937683},{"type":"absolute","value":1698947924},{"type":"absolute","value":1698937688},{"type":"absolute","value":1698947929},{"type":"absolute","value":1698937693},{"type":"absolute","value":1698947934},{"type":"absolute","value":1698937698},{"type":"absolute","value":1698946914},{"type":"absolute","value":1698937703},{"type":"absolute","value":1698946919},{"type":"absolute","value":1698937708},{"type":"absolute","value":1698946924},{"type":"absolute","value":1698946929},{"type":"absolute","value":1698948978},{"type":"absolute","value":1698936691},{"type":"absolute","value":1698946934},{"type":"absolute","value":1698948983},{"type":"absolute","value":1698936696},{"type":"absolute","value":1698946939},{"type":"absolute","value":1698948988},{"type":"absolute","value":1698936701},{"type":"absolute","value":1698938749},{"type":"absolute","value":1698946944},{"type":"absolute","value":1698948993},{"type":"absolute","value":1698936706},{"type":"absolute","value":1698938754},{"type":"absolute","value":1698946949},{"type":"absolute","value":1698948998},{"type":"absolute","value":1698936711},{"type":"absolute","value":1698938759},{"type":"absolute","value":1698949003},{"type":"absolute","value":1698936716},{"type":"absolute","value":1698938764},{"type":"absolute","value":1698949008},{"type":"absolute","value":1698936721},{"type":"absolute","value":1698938769},{"type":"absolute","value":1698949013},{"type":"absolute","value":1698936726},{"type":"absolute","value":1698938774},{"type":"absolute","value":1698947993},{"type":"absolute","value":1698938779},{"type":"absolute","value":1698947998},{"type":"absolute","value":1698938784},{"type":"absolute","value":1698948003},{"type":"absolute","value":1698937767},{"type":"absolute","value":1698948008},{"type":"absolute","value":1698937772},{"type":"absolute","value":1698948013},{"type":"absolute","value":1698929583},{"type":"absolute","value":1698937777},{"type":"absolute","value":1698939825},{"type":"absolute","value":1698948018},{"type":"absolute","value":1698929588},{"type":"absolute","value":1698937782},{"type":"absolute","value":1698939830},{"type":"absolute","value":1698948023},{"type":"absolute","value":1698929593},{"type":"absolute","value":1698937787},{"type":"absolute","value":1698939835},{"type":"absolute","value":1698948028},{"type":"absolute","value":1698929598},{"type":"absolute","value":1698937792},{"type":"absolute","value":1698939840},{"type":"absolute","value":1698929603},{"type":"absolute","value":1698937797},{"type":"absolute","value":1698939845},{"type":"absolute","value":1698929608},{"type":"absolute","value":1698937802},{"type":"absolute","value":1698939850},{"type":"absolute","value":1698929613},{"type":"absolute","value":1698939855},{"type":"absolute","value":1698949072},{"type":"absolute","value":1698929618},{"type":"absolute","value":1698939860},{"type":"absolute","value":1698949077},{"type":"absolute","value":1698949082},{"type":"absolute","value":1698938843},{"type":"absolute","value":1698949087},{"type":"absolute","value":1698938848},{"type":"absolute","value":1698930659},{"type":"absolute","value":1698949092},{"type":"absolute","value":1698938853},{"type":"absolute","value":1698940901},{"type":"absolute","value":1698930664},{"type":"absolute","value":1698949097},{"type":"absolute","value":1698938858},{"type":"absolute","value":1698940906},{"type":"absolute","value":1698930669},{"type":"absolute","value":1698949102},{"type":"absolute","value":1698938863},{"type":"absolute","value":1698940911},{"type":"absolute","value":1698930674},{"type":"absolute","value":1698949107},{"type":"absolute","value":1698938868},{"type":"absolute","value":1698940916},{"type":"absolute","value":1698930679},{"type":"absolute","value":1698940921},{"type":"absolute","value":1698930684},{"type":"absolute","value":1698940926}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesimc","description":"Perform the AES InvMixColumn Transformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesimc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aeskeygenassist","description":"AES Round Key Generation Assist"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaeskeygenassist"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"resolve function by parsing PE exports":{"meta":{"name":"resolve function by parsing PE exports","namespace":"load-code/pe","authors":["sara-rn"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["73CE04892E5F39EC82B00C02FC04C70F:0x406BA1"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: resolve function by parsing PE exports\n    namespace: load-code/pe\n    authors:\n      - sara-rn\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\n    examples:\n      - 73CE04892E5F39EC82B00C02FC04C70F:0x406BA1\n  features:\n    - and:\n      - os: windows\n      - or:\n        - characteristic: loop\n        - mnemonic: movzx\n      - and:\n        - offset: 0x3C = IMAGE_DOS_HEADER.PE.e_lfanew\n        - or:\n          - and:\n            - arch: i386\n            - offset: 0x78 = offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]\n          - and:\n            - arch: amd64\n            - offset: 0x88 = offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]\n        - 3 or more:\n          - offset: 0x14 = IMAGE_EXPORT_DIRECTORY.NumberOfFunctions\n          - offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals\n          - offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames\n          - offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames\n          - offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions\n      - optional:\n        - or:\n          - api: LoadLibrary\n          - api: strcmp\n","matches":[[{"type":"absolute","value":1698634064},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698635778},{"type":"absolute","value":1698637827},{"type":"absolute","value":1698637830},{"type":"absolute","value":1698637833},{"type":"absolute","value":1698636810},{"type":"absolute","value":1698634765},{"type":"absolute","value":1698636813},{"type":"absolute","value":1698637839},{"type":"absolute","value":1698634768},{"type":"absolute","value":1698635792},{"type":"absolute","value":1698635795},{"type":"absolute","value":1698634782},{"type":"absolute","value":1698634785},{"type":"absolute","value":1698637869},{"type":"absolute","value":1698636846},{"type":"absolute","value":1698637872},{"type":"absolute","value":1698636849},{"type":"absolute","value":1698635829},{"type":"absolute","value":1698637878},{"type":"absolute","value":1698635832},{"type":"absolute","value":1698637884},{"type":"absolute","value":1698636863},{"type":"absolute","value":1698634816},{"type":"absolute","value":1698636866},{"type":"absolute","value":1698634819},{"type":"absolute","value":1698635846},{"type":"absolute","value":1698637896},{"type":"absolute","value":1698635849},{"type":"absolute","value":1698637899},{"type":"absolute","value":1698637902},{"type":"absolute","value":1698634833},{"type":"absolute","value":1698634836},{"type":"absolute","value":1698637908},{"type":"absolute","value":1698636895},{"type":"absolute","value":1698636898},{"type":"absolute","value":1698635882},{"type":"absolute","value":1698635885},{"type":"absolute","value":1698636912},{"type":"absolute","value":1698634866},{"type":"absolute","value":1698636915},{"type":"absolute","value":1698634869},{"type":"absolute","value":1698637942},{"type":"absolute","value":1698637945},{"type":"absolute","value":1698635899},{"type":"absolute","value":1698635902},{"type":"absolute","value":1698637951},{"type":"absolute","value":1698634883},{"type":"absolute","value":1698637957},{"type":"absolute","value":1698634886},{"type":"absolute","value":1698637969},{"type":"absolute","value":1698637972},{"type":"absolute","value":1698636950},{"type":"absolute","value":1698637975},{"type":"absolute","value":1698636953},{"type":"absolute","value":1698637981},{"type":"absolute","value":1698634912},{"type":"absolute","value":1698634915},{"type":"absolute","value":1698635942},{"type":"absolute","value":1698636967},{"type":"absolute","value":1698635945},{"type":"absolute","value":1698636970},{"type":"absolute","value":1698635951},{"type":"absolute","value":1698634929},{"type":"absolute","value":1698634932},{"type":"absolute","value":1698635957},{"type":"absolute","value":1698635963},{"type":"absolute","value":1698638013},{"type":"absolute","value":1698635966},{"type":"absolute","value":1698638016},{"type":"absolute","value":1698635969},{"type":"absolute","value":1698638022},{"type":"absolute","value":1698635975},{"type":"absolute","value":1698637004},{"type":"absolute","value":1698638028},{"type":"absolute","value":1698637007},{"type":"absolute","value":1698634964},{"type":"absolute","value":1698634967},{"type":"absolute","value":1698638039},{"type":"absolute","value":1698638042},{"type":"absolute","value":1698637021},{"type":"absolute","value":1698638045},{"type":"absolute","value":1698637024},{"type":"absolute","value":1698638051},{"type":"absolute","value":1698634981},{"type":"absolute","value":1698636005},{"type":"absolute","value":1698634984},{"type":"absolute","value":1698636008},{"type":"absolute","value":1698636014},{"type":"absolute","value":1698636020},{"type":"absolute","value":1698636032},{"type":"absolute","value":1698637057},{"type":"absolute","value":1698636035},{"type":"absolute","value":1698637060},{"type":"absolute","value":1698636038},{"type":"absolute","value":1698635015},{"type":"absolute","value":1698635018},{"type":"absolute","value":1698636044},{"type":"absolute","value":1698637074},{"type":"absolute","value":1698637077},{"type":"absolute","value":1698635032},{"type":"absolute","value":1698635035},{"type":"absolute","value":1698636078},{"type":"absolute","value":1698636081},{"type":"absolute","value":1698637106},{"type":"absolute","value":1698637109},{"type":"absolute","value":1698636087},{"type":"absolute","value":1698635065},{"type":"absolute","value":1698637115},{"type":"absolute","value":1698635068},{"type":"absolute","value":1698636093},{"type":"absolute","value":1698637121},{"type":"absolute","value":1698637127},{"type":"absolute","value":1698636105},{"type":"absolute","value":1698635082},{"type":"absolute","value":1698637130},{"type":"absolute","value":1698636108},{"type":"absolute","value":1698635085},{"type":"absolute","value":1698637133},{"type":"absolute","value":1698636111},{"type":"absolute","value":1698637139},{"type":"absolute","value":1698636117},{"type":"absolute","value":1698635111},{"type":"absolute","value":1698635114},{"type":"absolute","value":1698637169},{"type":"absolute","value":1698637172},{"type":"absolute","value":1698636149},{"type":"absolute","value":1698635128},{"type":"absolute","value":1698636152},{"type":"absolute","value":1698637178},{"type":"absolute","value":1698635131},{"type":"absolute","value":1698636158},{"type":"absolute","value":1698637184},{"type":"absolute","value":1698634116},{"type":"absolute","value":1698636164},{"type":"absolute","value":1698634119},{"type":"absolute","value":1698637196},{"type":"absolute","value":1698636175},{"type":"absolute","value":1698637199},{"type":"absolute","value":1698636178},{"type":"absolute","value":1698637202},{"type":"absolute","value":1698634133},{"type":"absolute","value":1698636181},{"type":"absolute","value":1698634136},{"type":"absolute","value":1698637208},{"type":"absolute","value":1698635163},{"type":"absolute","value":1698636187},{"type":"absolute","value":1698635166},{"type":"absolute","value":1698635180},{"type":"absolute","value":1698635183},{"type":"absolute","value":1698634168},{"type":"absolute","value":1698637242},{"type":"absolute","value":1698634171},{"type":"absolute","value":1698637245},{"type":"absolute","value":1698637251},{"type":"absolute","value":1698634185},{"type":"absolute","value":1698637257},{"type":"absolute","value":1698634188},{"type":"absolute","value":1698635214},{"type":"absolute","value":1698635217},{"type":"absolute","value":1698637269},{"type":"absolute","value":1698637272},{"type":"absolute","value":1698637275},{"type":"absolute","value":1698635231},{"type":"absolute","value":1698637281},{"type":"absolute","value":1698635234},{"type":"absolute","value":1698636262},{"type":"absolute","value":1698636265},{"type":"absolute","value":1698634219},{"type":"absolute","value":1698634222},{"type":"absolute","value":1698636279},{"type":"absolute","value":1698636282},{"type":"absolute","value":1698634236},{"type":"absolute","value":1698634239},{"type":"absolute","value":1698635264},{"type":"absolute","value":1698637313},{"type":"absolute","value":1698635267},{"type":"absolute","value":1698637316},{"type":"absolute","value":1698637322},{"type":"absolute","value":1698637328},{"type":"absolute","value":1698635281},{"type":"absolute","value":1698635284},{"type":"absolute","value":1698637339},{"type":"absolute","value":1698634269},{"type":"absolute","value":1698636317},{"type":"absolute","value":1698637342},{"type":"absolute","value":1698634272},{"type":"absolute","value":1698636320},{"type":"absolute","value":1698637345},{"type":"absolute","value":1698637351},{"type":"absolute","value":1698634286},{"type":"absolute","value":1698635310},{"type":"absolute","value":1698636334},{"type":"absolute","value":1698634289},{"type":"absolute","value":1698635313},{"type":"absolute","value":1698636337},{"type":"absolute","value":1698635327},{"type":"absolute","value":1698635330},{"type":"absolute","value":1698637384},{"type":"absolute","value":1698634315},{"type":"absolute","value":1698637387},{"type":"absolute","value":1698634318},{"type":"absolute","value":1698636371},{"type":"absolute","value":1698636374},{"type":"absolute","value":1698637401},{"type":"absolute","value":1698634332},{"type":"absolute","value":1698637404},{"type":"absolute","value":1698634335},{"type":"absolute","value":1698635362},{"type":"absolute","value":1698636388},{"type":"absolute","value":1698635365},{"type":"absolute","value":1698636391},{"type":"absolute","value":1698635379},{"type":"absolute","value":1698635382},{"type":"absolute","value":1698634367},{"type":"absolute","value":1698637439},{"type":"absolute","value":1698634370},{"type":"absolute","value":1698637442},{"type":"absolute","value":1698636424},{"type":"absolute","value":1698636427},{"type":"absolute","value":1698634384},{"type":"absolute","value":1698637456},{"type":"absolute","value":1698634387},{"type":"absolute","value":1698637459},{"type":"absolute","value":1698635413},{"type":"absolute","value":1698635416},{"type":"absolute","value":1698636441},{"type":"absolute","value":1698636444},{"type":"absolute","value":1698635430},{"type":"absolute","value":1698635433},{"type":"absolute","value":1698634418},{"type":"absolute","value":1698634421},{"type":"absolute","value":1698637493},{"type":"absolute","value":1698637496},{"type":"absolute","value":1698636473},{"type":"absolute","value":1698636476},{"type":"absolute","value":1698634435},{"type":"absolute","value":1698634438},{"type":"absolute","value":1698635463},{"type":"absolute","value":1698637510},{"type":"absolute","value":1698637513},{"type":"absolute","value":1698635466},{"type":"absolute","value":1698636490},{"type":"absolute","value":1698636493},{"type":"absolute","value":1698635480},{"type":"absolute","value":1698635483},{"type":"absolute","value":1698634468},{"type":"absolute","value":1698634471},{"type":"absolute","value":1698637546},{"type":"absolute","value":1698637549},{"type":"absolute","value":1698636528},{"type":"absolute","value":1698636531},{"type":"absolute","value":1698634485},{"type":"absolute","value":1698635509},{"type":"absolute","value":1698635512},{"type":"absolute","value":1698634488},{"type":"absolute","value":1698637563},{"type":"absolute","value":1698637566},{"type":"absolute","value":1698636545},{"type":"absolute","value":1698636548},{"type":"absolute","value":1698635526},{"type":"absolute","value":1698635529},{"type":"absolute","value":1698634514},{"type":"absolute","value":1698634517},{"type":"absolute","value":1698637595},{"type":"absolute","value":1698637598},{"type":"absolute","value":1698634531},{"type":"absolute","value":1698634534},{"type":"absolute","value":1698636582},{"type":"absolute","value":1698636585},{"type":"absolute","value":1698635564},{"type":"absolute","value":1698637612},{"type":"absolute","value":1698635567},{"type":"absolute","value":1698637615},{"type":"absolute","value":1698636599},{"type":"absolute","value":1698636602},{"type":"absolute","value":1698635581},{"type":"absolute","value":1698635584},{"type":"absolute","value":1698634566},{"type":"absolute","value":1698634569},{"type":"absolute","value":1698637650},{"type":"absolute","value":1698637653},{"type":"absolute","value":1698634583},{"type":"absolute","value":1698634586},{"type":"absolute","value":1698636635},{"type":"absolute","value":1698636638},{"type":"absolute","value":1698635618},{"type":"absolute","value":1698637667},{"type":"absolute","value":1698635621},{"type":"absolute","value":1698637670},{"type":"absolute","value":1698636652},{"type":"absolute","value":1698636655},{"type":"absolute","value":1698635635},{"type":"absolute","value":1698635638},{"type":"absolute","value":1698634617},{"type":"absolute","value":1698634620},{"type":"absolute","value":1698637704},{"type":"absolute","value":1698634634},{"type":"absolute","value":1698637707},{"type":"absolute","value":1698636684},{"type":"absolute","value":1698634637},{"type":"absolute","value":1698636687},{"type":"absolute","value":1698635671},{"type":"absolute","value":1698637721},{"type":"absolute","value":1698635674},{"type":"absolute","value":1698637724},{"type":"absolute","value":1698636701},{"type":"absolute","value":1698636704},{"type":"absolute","value":1698635688},{"type":"absolute","value":1698634667},{"type":"absolute","value":1698635691},{"type":"absolute","value":1698634670},{"type":"absolute","value":1698634684},{"type":"absolute","value":1698637757},{"type":"absolute","value":1698634687},{"type":"absolute","value":1698637760},{"type":"absolute","value":1698636739},{"type":"absolute","value":1698636742},{"type":"absolute","value":1698635720},{"type":"absolute","value":1698635723},{"type":"absolute","value":1698637774},{"type":"absolute","value":1698637777},{"type":"absolute","value":1698636756},{"type":"absolute","value":1698636759},{"type":"absolute","value":1698634713},{"type":"absolute","value":1698635737},{"type":"absolute","value":1698634716},{"type":"absolute","value":1698635740},{"type":"absolute","value":1698634730},{"type":"absolute","value":1698634733},{"type":"absolute","value":1698637806},{"type":"absolute","value":1698637809},{"type":"absolute","value":1698637815},{"type":"absolute","value":1698636793},{"type":"absolute","value":1698636796},{"type":"absolute","value":1698637821},{"type":"absolute","value":1698635775}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698634597}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698635444}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698635649}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698634300}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698634499}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698634346},{"type":"absolute","value":1698634086},{"type":"absolute","value":1698636231}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698634081},{"type":"absolute","value":1698634250},{"type":"absolute","value":1698636236}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698634199}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698638088},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698641921},{"type":"absolute","value":1698641924},{"type":"absolute","value":1698638343},{"type":"absolute","value":1698638855},{"type":"absolute","value":1698638346},{"type":"absolute","value":1698638858},{"type":"absolute","value":1698639884},{"type":"absolute","value":1698640906},{"type":"absolute","value":1698640909},{"type":"absolute","value":1698639887},{"type":"absolute","value":1698641938},{"type":"absolute","value":1698641941},{"type":"absolute","value":1698639383},{"type":"absolute","value":1698639386},{"type":"absolute","value":1698639901},{"type":"absolute","value":1698640413},{"type":"absolute","value":1698639904},{"type":"absolute","value":1698640416},{"type":"absolute","value":1698641444},{"type":"absolute","value":1698641447},{"type":"absolute","value":1698638376},{"type":"absolute","value":1698638889},{"type":"absolute","value":1698639400},{"type":"absolute","value":1698638379},{"type":"absolute","value":1698638892},{"type":"absolute","value":1698639403},{"type":"absolute","value":1698640430},{"type":"absolute","value":1698640942},{"type":"absolute","value":1698640433},{"type":"absolute","value":1698640945},{"type":"absolute","value":1698641461},{"type":"absolute","value":1698641975},{"type":"absolute","value":1698641464},{"type":"absolute","value":1698638393},{"type":"absolute","value":1698638906},{"type":"absolute","value":1698641978},{"type":"absolute","value":1698638396},{"type":"absolute","value":1698638909},{"type":"absolute","value":1698639934},{"type":"absolute","value":1698640959},{"type":"absolute","value":1698639937},{"type":"absolute","value":1698640962},{"type":"absolute","value":1698641992},{"type":"absolute","value":1698639435},{"type":"absolute","value":1698641995},{"type":"absolute","value":1698639438},{"type":"absolute","value":1698639951},{"type":"absolute","value":1698639954},{"type":"absolute","value":1698640467},{"type":"absolute","value":1698640470},{"type":"absolute","value":1698638939},{"type":"absolute","value":1698639452},{"type":"absolute","value":1698641499},{"type":"absolute","value":1698638942},{"type":"absolute","value":1698638431},{"type":"absolute","value":1698639455},{"type":"absolute","value":1698640991},{"type":"absolute","value":1698638434},{"type":"absolute","value":1698640994},{"type":"absolute","value":1698640484},{"type":"absolute","value":1698641502},{"type":"absolute","value":1698640487},{"type":"absolute","value":1698638956},{"type":"absolute","value":1698639980},{"type":"absolute","value":1698641516},{"type":"absolute","value":1698638959},{"type":"absolute","value":1698638448},{"type":"absolute","value":1698639983},{"type":"absolute","value":1698641008},{"type":"absolute","value":1698638451},{"type":"absolute","value":1698641011},{"type":"absolute","value":1698639989},{"type":"absolute","value":1698641519},{"type":"absolute","value":1698642031},{"type":"absolute","value":1698642045},{"type":"absolute","value":1698639486},{"type":"absolute","value":1698639998},{"type":"absolute","value":1698642048},{"type":"absolute","value":1698639489},{"type":"absolute","value":1698640007},{"type":"absolute","value":1698640520},{"type":"absolute","value":1698638985},{"type":"absolute","value":1698640010},{"type":"absolute","value":1698640523},{"type":"absolute","value":1698638988},{"type":"absolute","value":1698640013},{"type":"absolute","value":1698639503},{"type":"absolute","value":1698641553},{"type":"absolute","value":1698639506},{"type":"absolute","value":1698641556},{"type":"absolute","value":1698638485},{"type":"absolute","value":1698640022},{"type":"absolute","value":1698641046},{"type":"absolute","value":1698638488},{"type":"absolute","value":1698640537},{"type":"absolute","value":1698639002},{"type":"absolute","value":1698641049},{"type":"absolute","value":1698640540},{"type":"absolute","value":1698639005},{"type":"absolute","value":1698641570},{"type":"absolute","value":1698641573},{"type":"absolute","value":1698638502},{"type":"absolute","value":1698641063},{"type":"absolute","value":1698638505},{"type":"absolute","value":1698641066},{"type":"absolute","value":1698639536},{"type":"absolute","value":1698639539},{"type":"absolute","value":1698640051},{"type":"absolute","value":1698640054},{"type":"absolute","value":1698640569},{"type":"absolute","value":1698640060},{"type":"absolute","value":1698639037},{"type":"absolute","value":1698640572},{"type":"absolute","value":1698639040},{"type":"absolute","value":1698639553},{"type":"absolute","value":1698639556},{"type":"absolute","value":1698640069},{"type":"absolute","value":1698641606},{"type":"absolute","value":1698641609},{"type":"absolute","value":1698638538},{"type":"absolute","value":1698640586},{"type":"absolute","value":1698641100},{"type":"absolute","value":1698638541},{"type":"absolute","value":1698639054},{"type":"absolute","value":1698640589},{"type":"absolute","value":1698641103},{"type":"absolute","value":1698639057},{"type":"absolute","value":1698640084},{"type":"absolute","value":1698640087},{"type":"absolute","value":1698641623},{"type":"absolute","value":1698640090},{"type":"absolute","value":1698638555},{"type":"absolute","value":1698641626},{"type":"absolute","value":1698641117},{"type":"absolute","value":1698638558},{"type":"absolute","value":1698639582},{"type":"absolute","value":1698641120},{"type":"absolute","value":1698639585},{"type":"absolute","value":1698640099},{"type":"absolute","value":1698639599},{"type":"absolute","value":1698639088},{"type":"absolute","value":1698640624},{"type":"absolute","value":1698639602},{"type":"absolute","value":1698639091},{"type":"absolute","value":1698640627},{"type":"absolute","value":1698641655},{"type":"absolute","value":1698641658},{"type":"absolute","value":1698638587},{"type":"absolute","value":1698638590},{"type":"absolute","value":1698639105},{"type":"absolute","value":1698640641},{"type":"absolute","value":1698641153},{"type":"absolute","value":1698639108},{"type":"absolute","value":1698640133},{"type":"absolute","value":1698640644},{"type":"absolute","value":1698641156},{"type":"absolute","value":1698640136},{"type":"absolute","value":1698641672},{"type":"absolute","value":1698641675},{"type":"absolute","value":1698638604},{"type":"absolute","value":1698640142},{"type":"absolute","value":1698638607},{"type":"absolute","value":1698639634},{"type":"absolute","value":1698641170},{"type":"absolute","value":1698639637},{"type":"absolute","value":1698641173},{"type":"absolute","value":1698640151},{"type":"absolute","value":1698639138},{"type":"absolute","value":1698639651},{"type":"absolute","value":1698639141},{"type":"absolute","value":1698639654},{"type":"absolute","value":1698640166},{"type":"absolute","value":1698640678},{"type":"absolute","value":1698640169},{"type":"absolute","value":1698640681},{"type":"absolute","value":1698640172},{"type":"absolute","value":1698641710},{"type":"absolute","value":1698638639},{"type":"absolute","value":1698641713},{"type":"absolute","value":1698638642},{"type":"absolute","value":1698639155},{"type":"absolute","value":1698641202},{"type":"absolute","value":1698640181},{"type":"absolute","value":1698639158},{"type":"absolute","value":1698641205},{"type":"absolute","value":1698640695},{"type":"absolute","value":1698640698},{"type":"absolute","value":1698638841},{"type":"absolute","value":1698641727},{"type":"absolute","value":1698638656},{"type":"absolute","value":1698641730},{"type":"absolute","value":1698638659},{"type":"absolute","value":1698641219},{"type":"absolute","value":1698639685},{"type":"absolute","value":1698641222},{"type":"absolute","value":1698639688},{"type":"absolute","value":1698639184},{"type":"absolute","value":1698639187},{"type":"absolute","value":1698638164},{"type":"absolute","value":1698640213},{"type":"absolute","value":1698639702},{"type":"absolute","value":1698638167},{"type":"absolute","value":1698640216},{"type":"absolute","value":1698639705},{"type":"absolute","value":1698640731},{"type":"absolute","value":1698640222},{"type":"absolute","value":1698640734},{"type":"absolute","value":1698639201},{"type":"absolute","value":1698638690},{"type":"absolute","value":1698640375},{"type":"absolute","value":1698639204},{"type":"absolute","value":1698638181},{"type":"absolute","value":1698638693},{"type":"absolute","value":1698640231},{"type":"absolute","value":1698638184},{"type":"absolute","value":1698641257},{"type":"absolute","value":1698641764},{"type":"absolute","value":1698641767},{"type":"absolute","value":1698640748},{"type":"absolute","value":1698641260},{"type":"absolute","value":1698640751},{"type":"absolute","value":1698640378},{"type":"absolute","value":1698638707},{"type":"absolute","value":1698640245},{"type":"absolute","value":1698638710},{"type":"absolute","value":1698639735},{"type":"absolute","value":1698640248},{"type":"absolute","value":1698641781},{"type":"absolute","value":1698639738},{"type":"absolute","value":1698640251},{"type":"absolute","value":1698641274},{"type":"absolute","value":1698641277},{"type":"absolute","value":1698640889},{"type":"absolute","value":1698641784},{"type":"absolute","value":1698639236},{"type":"absolute","value":1698640260},{"type":"absolute","value":1698639239},{"type":"absolute","value":1698639752},{"type":"absolute","value":1698638219},{"type":"absolute","value":1698639755},{"type":"absolute","value":1698640780},{"type":"absolute","value":1698638222},{"type":"absolute","value":1698640783},{"type":"absolute","value":1698638740},{"type":"absolute","value":1698639253},{"type":"absolute","value":1698638743},{"type":"absolute","value":1698639256},{"type":"absolute","value":1698641817},{"type":"absolute","value":1698638236},{"type":"absolute","value":1698640797},{"type":"absolute","value":1698641820},{"type":"absolute","value":1698638239},{"type":"absolute","value":1698641311},{"type":"absolute","value":1698640800},{"type":"absolute","value":1698641314},{"type":"absolute","value":1698638757},{"type":"absolute","value":1698639781},{"type":"absolute","value":1698638760},{"type":"absolute","value":1698639784},{"type":"absolute","value":1698641834},{"type":"absolute","value":1698641837},{"type":"absolute","value":1698641328},{"type":"absolute","value":1698641331},{"type":"absolute","value":1698639798},{"type":"absolute","value":1698639287},{"type":"absolute","value":1698639801},{"type":"absolute","value":1698639290},{"type":"absolute","value":1698638273},{"type":"absolute","value":1698638786},{"type":"absolute","value":1698640835},{"type":"absolute","value":1698638276},{"type":"absolute","value":1698638789},{"type":"absolute","value":1698640838},{"type":"absolute","value":1698639304},{"type":"absolute","value":1698641866},{"type":"absolute","value":1698639307},{"type":"absolute","value":1698641869},{"type":"absolute","value":1698638290},{"type":"absolute","value":1698638803},{"type":"absolute","value":1698640852},{"type":"absolute","value":1698638293},{"type":"absolute","value":1698638806},{"type":"absolute","value":1698641364},{"type":"absolute","value":1698640855},{"type":"absolute","value":1698639833},{"type":"absolute","value":1698641367},{"type":"absolute","value":1698641883},{"type":"absolute","value":1698639836},{"type":"absolute","value":1698641886},{"type":"absolute","value":1698642028},{"type":"absolute","value":1698641381},{"type":"absolute","value":1698640358},{"type":"absolute","value":1698641384},{"type":"absolute","value":1698639337},{"type":"absolute","value":1698639850},{"type":"absolute","value":1698640361},{"type":"absolute","value":1698639340},{"type":"absolute","value":1698639853},{"type":"absolute","value":1698638326},{"type":"absolute","value":1698638838},{"type":"absolute","value":1698638329},{"type":"absolute","value":1698639354},{"type":"absolute","value":1698640892},{"type":"absolute","value":1698639357}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698639567}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698638721}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698638516}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698639864}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698639665}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698639613},{"type":"absolute","value":1698638110},{"type":"absolute","value":1698640303}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698638105},{"type":"absolute","value":1698639915},{"type":"absolute","value":1698640308}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698639965}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698659472},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698659472}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698663425},{"type":"absolute","value":1698662402},{"type":"absolute","value":1698663433},{"type":"absolute","value":1698662413},{"type":"absolute","value":1698663437},{"type":"absolute","value":1698663441},{"type":"absolute","value":1698663450},{"type":"absolute","value":1698662427},{"type":"absolute","value":1698662431},{"type":"absolute","value":1698663458},{"type":"absolute","value":1698663462},{"type":"absolute","value":1698662439},{"type":"absolute","value":1698663466},{"type":"absolute","value":1698662443},{"type":"absolute","value":1698663475},{"type":"absolute","value":1698662452},{"type":"absolute","value":1698662456},{"type":"absolute","value":1698663483},{"type":"absolute","value":1698663487},{"type":"absolute","value":1698661440},{"type":"absolute","value":1698661444},{"type":"absolute","value":1698661449},{"type":"absolute","value":1698662473},{"type":"absolute","value":1698661453},{"type":"absolute","value":1698663503},{"type":"absolute","value":1698662484},{"type":"absolute","value":1698663512},{"type":"absolute","value":1698662491},{"type":"absolute","value":1698661468},{"type":"absolute","value":1698663516},{"type":"absolute","value":1698660448},{"type":"absolute","value":1698661472},{"type":"absolute","value":1698660452},{"type":"absolute","value":1698663524},{"type":"absolute","value":1698663528},{"type":"absolute","value":1698660461},{"type":"absolute","value":1698661485},{"type":"absolute","value":1698663536},{"type":"absolute","value":1698660478},{"type":"absolute","value":1698663552},{"type":"absolute","value":1698660482},{"type":"absolute","value":1698663556},{"type":"absolute","value":1698660486},{"type":"absolute","value":1698661512},{"type":"absolute","value":1698660493},{"type":"absolute","value":1698661517},{"type":"absolute","value":1698663565},{"type":"absolute","value":1698663569},{"type":"absolute","value":1698661522},{"type":"absolute","value":1698660503},{"type":"absolute","value":1698663577},{"type":"absolute","value":1698663581},{"type":"absolute","value":1698660516},{"type":"absolute","value":1698663589},{"type":"absolute","value":1698660520},{"type":"absolute","value":1698660524},{"type":"absolute","value":1698660531},{"type":"absolute","value":1698662585},{"type":"absolute","value":1698662590},{"type":"absolute","value":1698661571},{"type":"absolute","value":1698660548},{"type":"absolute","value":1698660556},{"type":"absolute","value":1698661580},{"type":"absolute","value":1698662609},{"type":"absolute","value":1698662613},{"type":"absolute","value":1698662617},{"type":"absolute","value":1698662621},{"type":"absolute","value":1698660575},{"type":"absolute","value":1698662625},{"type":"absolute","value":1698659556},{"type":"absolute","value":1698659559},{"type":"absolute","value":1698660583},{"type":"absolute","value":1698662634},{"type":"absolute","value":1698662638},{"type":"absolute","value":1698659571},{"type":"absolute","value":1698661619},{"type":"absolute","value":1698659575},{"type":"absolute","value":1698662647},{"type":"absolute","value":1698661628},{"type":"absolute","value":1698662656},{"type":"absolute","value":1698662660},{"type":"absolute","value":1698662664},{"type":"absolute","value":1698659597},{"type":"absolute","value":1698659601},{"type":"absolute","value":1698662673},{"type":"absolute","value":1698662681},{"type":"absolute","value":1698662685},{"type":"absolute","value":1698659614},{"type":"absolute","value":1698662689},{"type":"absolute","value":1698661667},{"type":"absolute","value":1698661676},{"type":"absolute","value":1698662702},{"type":"absolute","value":1698662707},{"type":"absolute","value":1698660662},{"type":"absolute","value":1698659641},{"type":"absolute","value":1698660667},{"type":"absolute","value":1698659646},{"type":"absolute","value":1698659651},{"type":"absolute","value":1698662723},{"type":"absolute","value":1698662727},{"type":"absolute","value":1698660684},{"type":"absolute","value":1698660688},{"type":"absolute","value":1698662736},{"type":"absolute","value":1698661715},{"type":"absolute","value":1698660692},{"type":"absolute","value":1698662740},{"type":"absolute","value":1698660696},{"type":"absolute","value":1698662745},{"type":"absolute","value":1698660700},{"type":"absolute","value":1698661724},{"type":"absolute","value":1698660708},{"type":"absolute","value":1698662758},{"type":"absolute","value":1698660712},{"type":"absolute","value":1698662762},{"type":"absolute","value":1698660717},{"type":"absolute","value":1698662766},{"type":"absolute","value":1698659700},{"type":"absolute","value":1698662775},{"type":"absolute","value":1698660729},{"type":"absolute","value":1698659709},{"type":"absolute","value":1698660738},{"type":"absolute","value":1698661763},{"type":"absolute","value":1698662787},{"type":"absolute","value":1698660746},{"type":"absolute","value":1698661772},{"type":"absolute","value":1698662796},{"type":"absolute","value":1698660758},{"type":"absolute","value":1698662808},{"type":"absolute","value":1698662813},{"type":"absolute","value":1698660770},{"type":"absolute","value":1698659748},{"type":"absolute","value":1698662823},{"type":"absolute","value":1698659757},{"type":"absolute","value":1698660782},{"type":"absolute","value":1698662831},{"type":"absolute","value":1698661811},{"type":"absolute","value":1698662835},{"type":"absolute","value":1698660796},{"type":"absolute","value":1698662844},{"type":"absolute","value":1698660800},{"type":"absolute","value":1698662848},{"type":"absolute","value":1698660808},{"type":"absolute","value":1698662856},{"type":"absolute","value":1698660812},{"type":"absolute","value":1698662860},{"type":"absolute","value":1698662864},{"type":"absolute","value":1698661843},{"type":"absolute","value":1698659796},{"type":"absolute","value":1698660821},{"type":"absolute","value":1698661847},{"type":"absolute","value":1698660825},{"type":"absolute","value":1698662873},{"type":"absolute","value":1698659805},{"type":"absolute","value":1698660833},{"type":"absolute","value":1698662881},{"type":"absolute","value":1698661860},{"type":"absolute","value":1698660837},{"type":"absolute","value":1698662885},{"type":"absolute","value":1698661864},{"type":"absolute","value":1698662889},{"type":"absolute","value":1698661868},{"type":"absolute","value":1698661873},{"type":"absolute","value":1698662898},{"type":"absolute","value":1698660853},{"type":"absolute","value":1698662906},{"type":"absolute","value":1698661885},{"type":"absolute","value":1698662910},{"type":"absolute","value":1698660862},{"type":"absolute","value":1698659844},{"type":"absolute","value":1698660874},{"type":"absolute","value":1698659853},{"type":"absolute","value":1698662926},{"type":"absolute","value":1698660883},{"type":"absolute","value":1698662935},{"type":"absolute","value":1698662939},{"type":"absolute","value":1698661916},{"type":"absolute","value":1698661920},{"type":"absolute","value":1698662947},{"type":"absolute","value":1698661925},{"type":"absolute","value":1698662951},{"type":"absolute","value":1698662959},{"type":"absolute","value":1698659892},{"type":"absolute","value":1698659901},{"type":"absolute","value":1698662975},{"type":"absolute","value":1698660931},{"type":"absolute","value":1698662979},{"type":"absolute","value":1698660936},{"type":"absolute","value":1698662988},{"type":"absolute","value":1698662992},{"type":"absolute","value":1698660945},{"type":"absolute","value":1698660951},{"type":"absolute","value":1698663000},{"type":"absolute","value":1698663004},{"type":"absolute","value":1698661981},{"type":"absolute","value":1698663012},{"type":"absolute","value":1698661989},{"type":"absolute","value":1698659966},{"type":"absolute","value":1698659971},{"type":"absolute","value":1698659975},{"type":"absolute","value":1698662026},{"type":"absolute","value":1698659980},{"type":"absolute","value":1698661008},{"type":"absolute","value":1698662034},{"type":"absolute","value":1698663060},{"type":"absolute","value":1698661013},{"type":"absolute","value":1698663065},{"type":"absolute","value":1698659998},{"type":"absolute","value":1698661022},{"type":"absolute","value":1698663074},{"type":"absolute","value":1698661028},{"type":"absolute","value":1698660007},{"type":"absolute","value":1698663080},{"type":"absolute","value":1698661034},{"type":"absolute","value":1698660011},{"type":"absolute","value":1698661039},{"type":"absolute","value":1698662071},{"type":"absolute","value":1698662079},{"type":"absolute","value":1698661056},{"type":"absolute","value":1698661060},{"type":"absolute","value":1698660038},{"type":"absolute","value":1698661064},{"type":"absolute","value":1698660043},{"type":"absolute","value":1698661068},{"type":"absolute","value":1698660048},{"type":"absolute","value":1698661072},{"type":"absolute","value":1698661080},{"type":"absolute","value":1698661084},{"type":"absolute","value":1698663136},{"type":"absolute","value":1698661089},{"type":"absolute","value":1698662116},{"type":"absolute","value":1698663141},{"type":"absolute","value":1698662124},{"type":"absolute","value":1698661101},{"type":"absolute","value":1698663150},{"type":"absolute","value":1698663156},{"type":"absolute","value":1698661110},{"type":"absolute","value":1698663162},{"type":"absolute","value":1698661118},{"type":"absolute","value":1698663167},{"type":"absolute","value":1698660097},{"type":"absolute","value":1698660106},{"type":"absolute","value":1698661130},{"type":"absolute","value":1698663186},{"type":"absolute","value":1698661142},{"type":"absolute","value":1698663190},{"type":"absolute","value":1698663194},{"type":"absolute","value":1698662171},{"type":"absolute","value":1698663198},{"type":"absolute","value":1698662175},{"type":"absolute","value":1698661154},{"type":"absolute","value":1698663202},{"type":"absolute","value":1698663211},{"type":"absolute","value":1698663215},{"type":"absolute","value":1698661168},{"type":"absolute","value":1698660145},{"type":"absolute","value":1698661172},{"type":"absolute","value":1698663224},{"type":"absolute","value":1698660154},{"type":"absolute","value":1698661180},{"type":"absolute","value":1698661184},{"type":"absolute","value":1698663233},{"type":"absolute","value":1698663237},{"type":"absolute","value":1698661193},{"type":"absolute","value":1698663241},{"type":"absolute","value":1698661197},{"type":"absolute","value":1698663250},{"type":"absolute","value":1698661205},{"type":"absolute","value":1698661209},{"type":"absolute","value":1698663258},{"type":"absolute","value":1698663262},{"type":"absolute","value":1698660193},{"type":"absolute","value":1698663266},{"type":"absolute","value":1698661225},{"type":"absolute","value":1698660202},{"type":"absolute","value":1698663279},{"type":"absolute","value":1698662257},{"type":"absolute","value":1698661234},{"type":"absolute","value":1698663284},{"type":"absolute","value":1698662262},{"type":"absolute","value":1698661246},{"type":"absolute","value":1698662270},{"type":"absolute","value":1698663300},{"type":"absolute","value":1698661255},{"type":"absolute","value":1698663304},{"type":"absolute","value":1698662287},{"type":"absolute","value":1698660241},{"type":"absolute","value":1698662290},{"type":"absolute","value":1698663313},{"type":"absolute","value":1698663317},{"type":"absolute","value":1698662294},{"type":"absolute","value":1698660250},{"type":"absolute","value":1698663322},{"type":"absolute","value":1698662301},{"type":"absolute","value":1698662305},{"type":"absolute","value":1698663335},{"type":"absolute","value":1698662314},{"type":"absolute","value":1698663339},{"type":"absolute","value":1698662318},{"type":"absolute","value":1698663343},{"type":"absolute","value":1698662325},{"type":"absolute","value":1698663352},{"type":"absolute","value":1698662329},{"type":"absolute","value":1698663364},{"type":"absolute","value":1698660293},{"type":"absolute","value":1698662341},{"type":"absolute","value":1698660298},{"type":"absolute","value":1698663373},{"type":"absolute","value":1698662354},{"type":"absolute","value":1698662357},{"type":"absolute","value":1698660310},{"type":"absolute","value":1698663385},{"type":"absolute","value":1698662365},{"type":"absolute","value":1698663390},{"type":"absolute","value":1698662369},{"type":"absolute","value":1698663400},{"type":"absolute","value":1698662378},{"type":"absolute","value":1698662382},{"type":"absolute","value":1698663408},{"type":"absolute","value":1698663412},{"type":"absolute","value":1698662389},{"type":"absolute","value":1698662393},{"type":"absolute","value":1698663421}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698660218},{"type":"absolute","value":1698661692},{"type":"absolute","value":1698659821},{"type":"absolute","value":1698662094}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698660416},{"type":"absolute","value":1698660611},{"type":"absolute","value":1698662534},{"type":"absolute","value":1698662247}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698662840},{"type":"absolute","value":1698663417},{"type":"absolute","value":1698661619}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698659507},{"type":"absolute","value":1698661309}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698662585},{"type":"absolute","value":1698663162},{"type":"absolute","value":1698661843}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698662808},{"type":"absolute","value":1698663385},{"type":"absolute","value":1698662026}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698714000},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698714000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698714693},{"type":"absolute","value":1698714087}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698715395}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698715607}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698714396}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698714633}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698714594}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698714427}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698714418}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698811216},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698812165},{"type":"absolute","value":1698812298},{"type":"absolute","value":1698812171},{"type":"absolute","value":1698811916},{"type":"absolute","value":1698811985},{"type":"absolute","value":1698812241},{"type":"absolute","value":1698812115},{"type":"absolute","value":1698811862},{"type":"absolute","value":1698811927},{"type":"absolute","value":1698812313},{"type":"absolute","value":1698812063},{"type":"absolute","value":1698812191},{"type":"absolute","value":1698811999},{"type":"absolute","value":1698812257},{"type":"absolute","value":1698812323},{"type":"absolute","value":1698811940},{"type":"absolute","value":1698812070},{"type":"absolute","value":1698812141},{"type":"absolute","value":1698812015},{"type":"absolute","value":1698812144},{"type":"absolute","value":1698811830},{"type":"absolute","value":1698811898},{"type":"absolute","value":1698812283},{"type":"absolute","value":1698812029}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698813161},{"type":"absolute","value":1698812811},{"type":"absolute","value":1698813198}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698813238},{"type":"absolute","value":1698813421},{"type":"absolute","value":1698811454}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698813329},{"type":"absolute","value":1698813396},{"type":"absolute","value":1698811645}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698812770},{"type":"absolute","value":1698812964},{"type":"absolute","value":1698812903},{"type":"absolute","value":1698813337},{"type":"absolute","value":1698813614}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698813033},{"type":"absolute","value":1698812467},{"type":"absolute","value":1698813180},{"type":"absolute","value":1698813015}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698813041},{"type":"absolute","value":1698813094},{"type":"absolute","value":1698813038},{"type":"absolute","value":1698812375}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698812792},{"type":"absolute","value":1698812889},{"type":"absolute","value":1698813619},{"type":"absolute","value":1698812988}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698813506},{"type":"absolute","value":1698813021},{"type":"absolute","value":1698811677},{"type":"absolute","value":1698812871}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698813712},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698815234},{"type":"absolute","value":1698815245},{"type":"absolute","value":1698814618},{"type":"absolute","value":1698815388},{"type":"absolute","value":1698814753},{"type":"absolute","value":1698814883},{"type":"absolute","value":1698815018},{"type":"absolute","value":1698815406},{"type":"absolute","value":1698814641},{"type":"absolute","value":1698815158},{"type":"absolute","value":1698814777},{"type":"absolute","value":1698814651},{"type":"absolute","value":1698814917},{"type":"absolute","value":1698814791},{"type":"absolute","value":1698814920},{"type":"absolute","value":1698815047},{"type":"absolute","value":1698814668},{"type":"absolute","value":1698815053},{"type":"absolute","value":1698814799},{"type":"absolute","value":1698814928},{"type":"absolute","value":1698815312},{"type":"absolute","value":1698815187},{"type":"absolute","value":1698814679},{"type":"absolute","value":1698815193},{"type":"absolute","value":1698815067},{"type":"absolute","value":1698814689},{"type":"absolute","value":1698815329},{"type":"absolute","value":1698814820},{"type":"absolute","value":1698815207},{"type":"absolute","value":1698814830},{"type":"absolute","value":1698814962},{"type":"absolute","value":1698815092},{"type":"absolute","value":1698815350},{"type":"absolute","value":1698814968},{"type":"absolute","value":1698815098},{"type":"absolute","value":1698815358}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698815504},{"type":"absolute","value":1698816250},{"type":"absolute","value":1698816371},{"type":"absolute","value":1698816423}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698816649},{"type":"absolute","value":1698816478},{"type":"absolute","value":1698813830}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698816642},{"type":"absolute","value":1698816754},{"type":"absolute","value":1698814039}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698817196},{"type":"absolute","value":1698815927},{"type":"absolute","value":1698813738},{"type":"absolute","value":1698816091},{"type":"absolute","value":1698816314},{"type":"absolute","value":1698816890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698816297},{"type":"absolute","value":1698816203},{"type":"absolute","value":1698814276},{"type":"absolute","value":1698816293}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698813944},{"type":"absolute","value":1698816288},{"type":"absolute","value":1698816614},{"type":"absolute","value":1698815943}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698817200},{"type":"absolute","value":1698816055},{"type":"absolute","value":1698813741},{"type":"absolute","value":1698815948},{"type":"absolute","value":1698816221}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698816245},{"type":"absolute","value":1698814343},{"type":"absolute","value":1698813752},{"type":"absolute","value":1698816411},{"type":"absolute","value":1698815918},{"type":"absolute","value":1698816254}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698817344},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698819076},{"type":"absolute","value":1698819333},{"type":"absolute","value":1698818314},{"type":"absolute","value":1698818570},{"type":"absolute","value":1698817804},{"type":"absolute","value":1698818829},{"type":"absolute","value":1698817551},{"type":"absolute","value":1698819088},{"type":"absolute","value":1698818321},{"type":"absolute","value":1698818578},{"type":"absolute","value":1698818325},{"type":"absolute","value":1698817559},{"type":"absolute","value":1698819355},{"type":"absolute","value":1698818850},{"type":"absolute","value":1698819110},{"type":"absolute","value":1698818091},{"type":"absolute","value":1698818347},{"type":"absolute","value":1698818610},{"type":"absolute","value":1698817591},{"type":"absolute","value":1698817850},{"type":"absolute","value":1698818107},{"type":"absolute","value":1698818874},{"type":"absolute","value":1698819389},{"type":"absolute","value":1698818368},{"type":"absolute","value":1698817857},{"type":"absolute","value":1698817860},{"type":"absolute","value":1698819396},{"type":"absolute","value":1698819400},{"type":"absolute","value":1698818124},{"type":"absolute","value":1698819151},{"type":"absolute","value":1698817619},{"type":"absolute","value":1698818131},{"type":"absolute","value":1698818644},{"type":"absolute","value":1698818390},{"type":"absolute","value":1698819158},{"type":"absolute","value":1698817881},{"type":"absolute","value":1698819162},{"type":"absolute","value":1698817628},{"type":"absolute","value":1698818653},{"type":"absolute","value":1698819422},{"type":"absolute","value":1698817631},{"type":"absolute","value":1698818657},{"type":"absolute","value":1698818922},{"type":"absolute","value":1698817901},{"type":"absolute","value":1698818158},{"type":"absolute","value":1698819184},{"type":"absolute","value":1698817393},{"type":"absolute","value":1698817652},{"type":"absolute","value":1698818165},{"type":"absolute","value":1698818676},{"type":"absolute","value":1698818932},{"type":"absolute","value":1698818936},{"type":"absolute","value":1698818684},{"type":"absolute","value":1698818430},{"type":"absolute","value":1698817921},{"type":"absolute","value":1698817411},{"type":"absolute","value":1698819205},{"type":"absolute","value":1698819461},{"type":"absolute","value":1698817673},{"type":"absolute","value":1698818443},{"type":"absolute","value":1698819469},{"type":"absolute","value":1698818958},{"type":"absolute","value":1698818451},{"type":"absolute","value":1698817429},{"type":"absolute","value":1698817432},{"type":"absolute","value":1698817691},{"type":"absolute","value":1698817947},{"type":"absolute","value":1698818716},{"type":"absolute","value":1698819227},{"type":"absolute","value":1698817954},{"type":"absolute","value":1698818211},{"type":"absolute","value":1698818979},{"type":"absolute","value":1698818471},{"type":"absolute","value":1698818218},{"type":"absolute","value":1698817453},{"type":"absolute","value":1698817967},{"type":"absolute","value":1698818479},{"type":"absolute","value":1698818232},{"type":"absolute","value":1698819001},{"type":"absolute","value":1698817981},{"type":"absolute","value":1698817475},{"type":"absolute","value":1698817731},{"type":"absolute","value":1698818246},{"type":"absolute","value":1698817738},{"type":"absolute","value":1698818511},{"type":"absolute","value":1698819280},{"type":"absolute","value":1698818002},{"type":"absolute","value":1698818258},{"type":"absolute","value":1698817751},{"type":"absolute","value":1698819287},{"type":"absolute","value":1698819291},{"type":"absolute","value":1698818781},{"type":"absolute","value":1698819038},{"type":"absolute","value":1698819042},{"type":"absolute","value":1698818020},{"type":"absolute","value":1698817765},{"type":"absolute","value":1698818790},{"type":"absolute","value":1698818538},{"type":"absolute","value":1698817516},{"type":"absolute","value":1698818286},{"type":"absolute","value":1698819313},{"type":"absolute","value":1698818547},{"type":"absolute","value":1698818804},{"type":"absolute","value":1698817526},{"type":"absolute","value":1698818551},{"type":"absolute","value":1698819064},{"type":"absolute","value":1698817786},{"type":"absolute","value":1698817531}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698818039}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698818731}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698818896}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698817511}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698817706}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698817713}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698817471}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698817609}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698819552},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698820610},{"type":"absolute","value":1698821122},{"type":"absolute","value":1698819846},{"type":"absolute","value":1698820102},{"type":"absolute","value":1698821384},{"type":"absolute","value":1698820105},{"type":"absolute","value":1698820873},{"type":"absolute","value":1698821643},{"type":"absolute","value":1698819855},{"type":"absolute","value":1698820367},{"type":"absolute","value":1698821391},{"type":"absolute","value":1698819858},{"type":"absolute","value":1698821395},{"type":"absolute","value":1698819604},{"type":"absolute","value":1698820631},{"type":"absolute","value":1698820126},{"type":"absolute","value":1698820384},{"type":"absolute","value":1698819879},{"type":"absolute","value":1698820391},{"type":"absolute","value":1698821417},{"type":"absolute","value":1698819626},{"type":"absolute","value":1698820907},{"type":"absolute","value":1698821164},{"type":"absolute","value":1698820653},{"type":"absolute","value":1698820146},{"type":"absolute","value":1698821682},{"type":"absolute","value":1698820916},{"type":"absolute","value":1698821174},{"type":"absolute","value":1698820920},{"type":"absolute","value":1698821178},{"type":"absolute","value":1698821690},{"type":"absolute","value":1698819644},{"type":"absolute","value":1698819900},{"type":"absolute","value":1698821438},{"type":"absolute","value":1698819647},{"type":"absolute","value":1698820418},{"type":"absolute","value":1698820166},{"type":"absolute","value":1698820425},{"type":"absolute","value":1698820939},{"type":"absolute","value":1698819918},{"type":"absolute","value":1698821200},{"type":"absolute","value":1698820947},{"type":"absolute","value":1698819668},{"type":"absolute","value":1698820693},{"type":"absolute","value":1698821460},{"type":"absolute","value":1698820192},{"type":"absolute","value":1698820706},{"type":"absolute","value":1698821221},{"type":"absolute","value":1698820199},{"type":"absolute","value":1698820714},{"type":"absolute","value":1698819693},{"type":"absolute","value":1698820979},{"type":"absolute","value":1698820212},{"type":"absolute","value":1698820474},{"type":"absolute","value":1698821243},{"type":"absolute","value":1698819964},{"type":"absolute","value":1698821501},{"type":"absolute","value":1698820734},{"type":"absolute","value":1698820481},{"type":"absolute","value":1698820226},{"type":"absolute","value":1698819971},{"type":"absolute","value":1698820351},{"type":"absolute","value":1698821508},{"type":"absolute","value":1698820742},{"type":"absolute","value":1698821512},{"type":"absolute","value":1698820495},{"type":"absolute","value":1698819984},{"type":"absolute","value":1698820247},{"type":"absolute","value":1698819740},{"type":"absolute","value":1698820509},{"type":"absolute","value":1698819998},{"type":"absolute","value":1698821277},{"type":"absolute","value":1698821534},{"type":"absolute","value":1698821281},{"type":"absolute","value":1698819750},{"type":"absolute","value":1698820774},{"type":"absolute","value":1698820265},{"type":"absolute","value":1698820521},{"type":"absolute","value":1698819755},{"type":"absolute","value":1698821035},{"type":"absolute","value":1698821554},{"type":"absolute","value":1698820019},{"type":"absolute","value":1698821044},{"type":"absolute","value":1698821303},{"type":"absolute","value":1698819775},{"type":"absolute","value":1698820801},{"type":"absolute","value":1698821058},{"type":"absolute","value":1698821315},{"type":"absolute","value":1698820037},{"type":"absolute","value":1698820549},{"type":"absolute","value":1698819783},{"type":"absolute","value":1698821576},{"type":"absolute","value":1698820810},{"type":"absolute","value":1698820814},{"type":"absolute","value":1698821327},{"type":"absolute","value":1698821080},{"type":"absolute","value":1698820577},{"type":"absolute","value":1698820833},{"type":"absolute","value":1698821349},{"type":"absolute","value":1698819815},{"type":"absolute","value":1698820584},{"type":"absolute","value":1698820841},{"type":"absolute","value":1698821610},{"type":"absolute","value":1698820588},{"type":"absolute","value":1698821101},{"type":"absolute","value":1698821617},{"type":"absolute","value":1698821621},{"type":"absolute","value":1698820095}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698821073}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698820432}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698820302}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698821706}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698821478}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698821475}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698821494}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698821491}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698821760},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698822147},{"type":"absolute","value":1698822662},{"type":"absolute","value":1698822154},{"type":"absolute","value":1698824205},{"type":"absolute","value":1698823696},{"type":"absolute","value":1698824209},{"type":"absolute","value":1698822674},{"type":"absolute","value":1698822167},{"type":"absolute","value":1698823703},{"type":"absolute","value":1698823707},{"type":"absolute","value":1698823197},{"type":"absolute","value":1698822181},{"type":"absolute","value":1698823206},{"type":"absolute","value":1698824231},{"type":"absolute","value":1698822702},{"type":"absolute","value":1698823729},{"type":"absolute","value":1698824243},{"type":"absolute","value":1698823220},{"type":"absolute","value":1698822202},{"type":"absolute","value":1698824255},{"type":"absolute","value":1698823749},{"type":"absolute","value":1698822220},{"type":"absolute","value":1698822733},{"type":"absolute","value":1698823245},{"type":"absolute","value":1698822737},{"type":"absolute","value":1698824277},{"type":"absolute","value":1698823771},{"type":"absolute","value":1698823266},{"type":"absolute","value":1698822759},{"type":"absolute","value":1698822771},{"type":"absolute","value":1698823799},{"type":"absolute","value":1698822266},{"type":"absolute","value":1698823290},{"type":"absolute","value":1698823806},{"type":"absolute","value":1698822784},{"type":"absolute","value":1698822273},{"type":"absolute","value":1698823810},{"type":"absolute","value":1698822276},{"type":"absolute","value":1698824330},{"type":"absolute","value":1698824337},{"type":"absolute","value":1698824341},{"type":"absolute","value":1698822806},{"type":"absolute","value":1698823832},{"type":"absolute","value":1698822297},{"type":"absolute","value":1698823338},{"type":"absolute","value":1698824363},{"type":"absolute","value":1698822317},{"type":"absolute","value":1698823853},{"type":"absolute","value":1698821809},{"type":"absolute","value":1698823348},{"type":"absolute","value":1698823352},{"type":"absolute","value":1698824384},{"type":"absolute","value":1698822337},{"type":"absolute","value":1698821827},{"type":"absolute","value":1698823875},{"type":"absolute","value":1698822855},{"type":"absolute","value":1698822861},{"type":"absolute","value":1698823374},{"type":"absolute","value":1698822867},{"type":"absolute","value":1698821845},{"type":"absolute","value":1698824406},{"type":"absolute","value":1698821848},{"type":"absolute","value":1698822363},{"type":"absolute","value":1698822370},{"type":"absolute","value":1698823395},{"type":"absolute","value":1698822887},{"type":"absolute","value":1698821869},{"type":"absolute","value":1698822383},{"type":"absolute","value":1698822895},{"type":"absolute","value":1698824434},{"type":"absolute","value":1698824441},{"type":"absolute","value":1698823417},{"type":"absolute","value":1698824445},{"type":"absolute","value":1698822397},{"type":"absolute","value":1698823938},{"type":"absolute","value":1698821891},{"type":"absolute","value":1698823942},{"type":"absolute","value":1698822927},{"type":"absolute","value":1698822418},{"type":"absolute","value":1698824467},{"type":"absolute","value":1698823962},{"type":"absolute","value":1698823454},{"type":"absolute","value":1698823458},{"type":"absolute","value":1698822436},{"type":"absolute","value":1698824487},{"type":"absolute","value":1698822954},{"type":"absolute","value":1698821932},{"type":"absolute","value":1698822963},{"type":"absolute","value":1698821942},{"type":"absolute","value":1698822967},{"type":"absolute","value":1698823480},{"type":"absolute","value":1698821947},{"type":"absolute","value":1698823996},{"type":"absolute","value":1698824509},{"type":"absolute","value":1698823492},{"type":"absolute","value":1698822986},{"type":"absolute","value":1698821967},{"type":"absolute","value":1698823504},{"type":"absolute","value":1698824017},{"type":"absolute","value":1698822994},{"type":"absolute","value":1698821975},{"type":"absolute","value":1698824035},{"type":"absolute","value":1698823526},{"type":"absolute","value":1698822507},{"type":"absolute","value":1698824556},{"type":"absolute","value":1698823026},{"type":"absolute","value":1698824563},{"type":"absolute","value":1698822007},{"type":"absolute","value":1698824567},{"type":"absolute","value":1698822523},{"type":"absolute","value":1698822540},{"type":"absolute","value":1698824589},{"type":"absolute","value":1698823567},{"type":"absolute","value":1698822035},{"type":"absolute","value":1698822547},{"type":"absolute","value":1698823060},{"type":"absolute","value":1698823574},{"type":"absolute","value":1698824083},{"type":"absolute","value":1698823578},{"type":"absolute","value":1698822044},{"type":"absolute","value":1698823069},{"type":"absolute","value":1698822047},{"type":"absolute","value":1698823073},{"type":"absolute","value":1698824105},{"type":"absolute","value":1698824109},{"type":"absolute","value":1698822574},{"type":"absolute","value":1698823600},{"type":"absolute","value":1698822068},{"type":"absolute","value":1698822581},{"type":"absolute","value":1698823092},{"type":"absolute","value":1698824628},{"type":"absolute","value":1698823100},{"type":"absolute","value":1698824636},{"type":"absolute","value":1698824131},{"type":"absolute","value":1698823621},{"type":"absolute","value":1698822089},{"type":"absolute","value":1698824152},{"type":"absolute","value":1698822107},{"type":"absolute","value":1698823132},{"type":"absolute","value":1698823643},{"type":"absolute","value":1698822627},{"type":"absolute","value":1698822634},{"type":"absolute","value":1698824174},{"type":"absolute","value":1698822648}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698822455}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698823147}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698823312}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698821927}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698822122}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698822129}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698821887}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698822025}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698824720},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698825729},{"type":"absolute","value":1698827268},{"type":"absolute","value":1698826248},{"type":"absolute","value":1698826257},{"type":"absolute","value":1698826770},{"type":"absolute","value":1698826271},{"type":"absolute","value":1698825760},{"type":"absolute","value":1698825764},{"type":"absolute","value":1698826792},{"type":"absolute","value":1698827309},{"type":"absolute","value":1698825263},{"type":"absolute","value":1698827316},{"type":"absolute","value":1698826293},{"type":"absolute","value":1698825270},{"type":"absolute","value":1698827320},{"type":"absolute","value":1698825273},{"type":"absolute","value":1698825786},{"type":"absolute","value":1698824772},{"type":"absolute","value":1698826820},{"type":"absolute","value":1698825798},{"type":"absolute","value":1698826314},{"type":"absolute","value":1698826827},{"type":"absolute","value":1698825294},{"type":"absolute","value":1698826831},{"type":"absolute","value":1698827342},{"type":"absolute","value":1698825811},{"type":"absolute","value":1698824794},{"type":"absolute","value":1698826335},{"type":"absolute","value":1698825314},{"type":"absolute","value":1698827363},{"type":"absolute","value":1698826853},{"type":"absolute","value":1698825833},{"type":"absolute","value":1698824812},{"type":"absolute","value":1698824815},{"type":"absolute","value":1698825334},{"type":"absolute","value":1698827385},{"type":"absolute","value":1698826874},{"type":"absolute","value":1698824836},{"type":"absolute","value":1698826380},{"type":"absolute","value":1698825360},{"type":"absolute","value":1698826896},{"type":"absolute","value":1698827413},{"type":"absolute","value":1698826390},{"type":"absolute","value":1698825367},{"type":"absolute","value":1698826394},{"type":"absolute","value":1698827420},{"type":"absolute","value":1698824861},{"type":"absolute","value":1698827424},{"type":"absolute","value":1698825380},{"type":"absolute","value":1698825894},{"type":"absolute","value":1698825900},{"type":"absolute","value":1698826416},{"type":"absolute","value":1698825394},{"type":"absolute","value":1698825906},{"type":"absolute","value":1698827446},{"type":"absolute","value":1698826947},{"type":"absolute","value":1698826437},{"type":"absolute","value":1698825926},{"type":"absolute","value":1698825415},{"type":"absolute","value":1698826951},{"type":"absolute","value":1698827466},{"type":"absolute","value":1698824908},{"type":"absolute","value":1698825934},{"type":"absolute","value":1698824918},{"type":"absolute","value":1698826968},{"type":"absolute","value":1698825433},{"type":"absolute","value":1698824923},{"type":"absolute","value":1698826459},{"type":"absolute","value":1698827488},{"type":"absolute","value":1698825966},{"type":"absolute","value":1698824943},{"type":"absolute","value":1698826999},{"type":"absolute","value":1698824951},{"type":"absolute","value":1698826493},{"type":"absolute","value":1698826497},{"type":"absolute","value":1698825993},{"type":"absolute","value":1698827529},{"type":"absolute","value":1698827020},{"type":"absolute","value":1698827536},{"type":"absolute","value":1698826002},{"type":"absolute","value":1698827540},{"type":"absolute","value":1698826006},{"type":"absolute","value":1698824983},{"type":"absolute","value":1698826519},{"type":"absolute","value":1698827038},{"type":"absolute","value":1698826531},{"type":"absolute","value":1698826025},{"type":"absolute","value":1698827562},{"type":"absolute","value":1698825519},{"type":"absolute","value":1698826543},{"type":"absolute","value":1698826033},{"type":"absolute","value":1698825014},{"type":"absolute","value":1698825023},{"type":"absolute","value":1698825026},{"type":"absolute","value":1698825538},{"type":"absolute","value":1698826565},{"type":"absolute","value":1698827080},{"type":"absolute","value":1698826065},{"type":"absolute","value":1698827601},{"type":"absolute","value":1698825555},{"type":"absolute","value":1698825047},{"type":"absolute","value":1698827096},{"type":"absolute","value":1698827609},{"type":"absolute","value":1698825562},{"type":"absolute","value":1698827100},{"type":"absolute","value":1698826600},{"type":"absolute","value":1698825068},{"type":"absolute","value":1698826607},{"type":"absolute","value":1698827122},{"type":"absolute","value":1698826611},{"type":"absolute","value":1698825589},{"type":"absolute","value":1698826105},{"type":"absolute","value":1698825596},{"type":"absolute","value":1698825086},{"type":"absolute","value":1698826114},{"type":"absolute","value":1698826118},{"type":"absolute","value":1698827143},{"type":"absolute","value":1698826633},{"type":"absolute","value":1698826137},{"type":"absolute","value":1698827165},{"type":"absolute","value":1698826654},{"type":"absolute","value":1698826145},{"type":"absolute","value":1698825132},{"type":"absolute","value":1698825139},{"type":"absolute","value":1698826676},{"type":"absolute","value":1698825654},{"type":"absolute","value":1698827196},{"type":"absolute","value":1698825661},{"type":"absolute","value":1698825152},{"type":"absolute","value":1698826177},{"type":"absolute","value":1698827200},{"type":"absolute","value":1698825675},{"type":"absolute","value":1698825166},{"type":"absolute","value":1698827222},{"type":"absolute","value":1698825689},{"type":"absolute","value":1698826717},{"type":"absolute","value":1698827234},{"type":"absolute","value":1698825187},{"type":"absolute","value":1698826724},{"type":"absolute","value":1698825701},{"type":"absolute","value":1698826728},{"type":"absolute","value":1698827246},{"type":"absolute","value":1698825205},{"type":"absolute","value":1698826750}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698826975}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698826343}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698826212}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698827625}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698827297}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698827303}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698827509}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698827506}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698827680},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1698815234},{"type":"absolute","value":1698812165},{"type":"absolute","value":1698812298},{"type":"absolute","value":1698812171},{"type":"absolute","value":1698811916},{"type":"absolute","value":1698815245},{"type":"absolute","value":1698811927},{"type":"absolute","value":1698812313},{"type":"absolute","value":1698814618},{"type":"absolute","value":1698815388},{"type":"absolute","value":1698812063},{"type":"absolute","value":1698812191},{"type":"absolute","value":1698814753},{"type":"absolute","value":1698812323},{"type":"absolute","value":1698811940},{"type":"absolute","value":1698814883},{"type":"absolute","value":1698812070},{"type":"absolute","value":1698815018},{"type":"absolute","value":1698815406},{"type":"absolute","value":1698814641},{"type":"absolute","value":1698811830},{"type":"absolute","value":1698815158},{"type":"absolute","value":1698814777},{"type":"absolute","value":1698814651},{"type":"absolute","value":1698814917},{"type":"absolute","value":1698815098},{"type":"absolute","value":1698814791},{"type":"absolute","value":1698814920},{"type":"absolute","value":1698815047},{"type":"absolute","value":1698814668},{"type":"absolute","value":1698815053},{"type":"absolute","value":1698814799},{"type":"absolute","value":1698814928},{"type":"absolute","value":1698811985},{"type":"absolute","value":1698812241},{"type":"absolute","value":1698812115},{"type":"absolute","value":1698815312},{"type":"absolute","value":1698815187},{"type":"absolute","value":1698811862},{"type":"absolute","value":1698814679},{"type":"absolute","value":1698815193},{"type":"absolute","value":1698815067},{"type":"absolute","value":1698811999},{"type":"absolute","value":1698812257},{"type":"absolute","value":1698814689},{"type":"absolute","value":1698815329},{"type":"absolute","value":1698814820},{"type":"absolute","value":1698815207},{"type":"absolute","value":1698812141},{"type":"absolute","value":1698814830},{"type":"absolute","value":1698812015},{"type":"absolute","value":1698812144},{"type":"absolute","value":1698814962},{"type":"absolute","value":1698815092},{"type":"absolute","value":1698815350},{"type":"absolute","value":1698814968},{"type":"absolute","value":1698811898},{"type":"absolute","value":1698812283},{"type":"absolute","value":1698812029},{"type":"absolute","value":1698815358}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698815504},{"type":"absolute","value":1698816371},{"type":"absolute","value":1698816423},{"type":"absolute","value":1698813161},{"type":"absolute","value":1698816250},{"type":"absolute","value":1698812811},{"type":"absolute","value":1698813198}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698816478},{"type":"absolute","value":1698813238},{"type":"absolute","value":1698813830},{"type":"absolute","value":1698816649},{"type":"absolute","value":1698813421},{"type":"absolute","value":1698811454}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698813329},{"type":"absolute","value":1698816642},{"type":"absolute","value":1698816754},{"type":"absolute","value":1698813396},{"type":"absolute","value":1698814039},{"type":"absolute","value":1698811645}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698812770},{"type":"absolute","value":1698812964},{"type":"absolute","value":1698812903},{"type":"absolute","value":1698813738},{"type":"absolute","value":1698817196},{"type":"absolute","value":1698813614},{"type":"absolute","value":1698815927},{"type":"absolute","value":1698813337},{"type":"absolute","value":1698816314},{"type":"absolute","value":1698816091},{"type":"absolute","value":1698816890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698814276},{"type":"absolute","value":1698816293},{"type":"absolute","value":1698813033},{"type":"absolute","value":1698816297},{"type":"absolute","value":1698816203},{"type":"absolute","value":1698812467},{"type":"absolute","value":1698813015},{"type":"absolute","value":1698813180}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698816288},{"type":"absolute","value":1698813094},{"type":"absolute","value":1698816614},{"type":"absolute","value":1698815943},{"type":"absolute","value":1698817287},{"type":"absolute","value":1698813038},{"type":"absolute","value":1698813041},{"type":"absolute","value":1698812375},{"type":"absolute","value":1698813944},{"type":"absolute","value":1698817308}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698815948},{"type":"absolute","value":1698813741},{"type":"absolute","value":1698817200},{"type":"absolute","value":1698813619},{"type":"absolute","value":1698816055},{"type":"absolute","value":1698812792},{"type":"absolute","value":1698812889},{"type":"absolute","value":1698812988},{"type":"absolute","value":1698816221}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698813506},{"type":"absolute","value":1698812871},{"type":"absolute","value":1698814343},{"type":"absolute","value":1698811677},{"type":"absolute","value":1698815918},{"type":"absolute","value":1698816245},{"type":"absolute","value":1698813752},{"type":"absolute","value":1698816411},{"type":"absolute","value":1698813021},{"type":"absolute","value":1698816254}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698960344},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698960344}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"strcmp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.PE.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1698964280},{"type":"absolute","value":1698963138},{"type":"absolute","value":1698964267},{"type":"absolute","value":1698963151}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":120,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698963202},{"type":"absolute","value":1698963215}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":136,"description":"offset to IMAGE_DATA_DIRECTORY[IMAGE_DIRECTORY_ENTRY_EXPORT]"}},"children":[],"locations":[{"type":"absolute","value":1698962312},{"type":"absolute","value":1698962287}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":3}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698964168},{"type":"absolute","value":1698964155},{"type":"absolute","value":1698962484},{"type":"absolute","value":1698962471}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":36,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals"}},"children":[],"locations":[{"type":"absolute","value":1698962801},{"type":"absolute","value":1698964164},{"type":"absolute","value":1698964177},{"type":"absolute","value":1698962814}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698964096},{"type":"absolute","value":1698964315},{"type":"absolute","value":1698964039},{"type":"absolute","value":1698963080},{"type":"absolute","value":1698964108},{"type":"absolute","value":1698964301},{"type":"absolute","value":1698962798},{"type":"absolute","value":1698960724},{"type":"absolute","value":1698960502},{"type":"absolute","value":1698960694},{"type":"absolute","value":1698960440},{"type":"absolute","value":1698960598},{"type":"absolute","value":1698962811},{"type":"absolute","value":1698963455}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"IMAGE_EXPORT_DIRECTORY.NumberOfNames"}},"children":[],"locations":[{"type":"absolute","value":1698964224},{"type":"absolute","value":1698962474},{"type":"absolute","value":1698964237},{"type":"absolute","value":1698962487}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"IMAGE_EXPORT_DIRECTORY.AddressOfFunctions"}},"children":[],"locations":[{"type":"absolute","value":1698964286},{"type":"absolute","value":1698964273},{"type":"absolute","value":1698962491},{"type":"absolute","value":1698962478}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"decrypt data using AES via x86 extensions":{"meta":{"name":"decrypt data using AES via x86 extensions","namespace":"data-manipulation/encryption/aes","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Deobfuscate/Decode Files or Information"],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","subtechnique":"","id":"T1140"}],"mbc":[{"parts":["Cryptography","Decrypt Data","AES"],"objective":"Cryptography","behavior":"Decrypt Data","method":"AES","id":"C0031.001"}],"references":[],"examples":["66602B5FAB602CB4E6F754748D249542:0x4097D0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: decrypt data using AES via x86 extensions\n    namespace: data-manipulation/encryption/aes\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    att&ck:\n      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]\n    mbc:\n      - Cryptography::Decrypt Data::AES [C0031.001]\n    examples:\n      - 66602B5FAB602CB4E6F754748D249542:0x4097D0\n  features:\n    - or:\n      - mnemonic: aesdec = Perform One Round of an AES Decryption Flow\n      - mnemonic: vaesdec\n      - mnemonic: aesdeclast = Perform Last Round of an AES Decryption Flow\n      - mnemonic: vaesdeclast\n","matches":[[{"type":"absolute","value":1698652656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdec","description":"Perform One Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652737},{"type":"absolute","value":1698652707},{"type":"absolute","value":1698652804},{"type":"absolute","value":1698652773},{"type":"absolute","value":1698652835},{"type":"absolute","value":1698652791},{"type":"absolute","value":1698652747},{"type":"absolute","value":1698652717},{"type":"absolute","value":1698652687},{"type":"absolute","value":1698652822},{"type":"absolute","value":1698652727},{"type":"absolute","value":1698652760},{"type":"absolute","value":1698652697}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdeclast","description":"Perform Last Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698652848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdeclast"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698653760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdec","description":"Perform One Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698653958},{"type":"absolute","value":1698654472},{"type":"absolute","value":1698653963},{"type":"absolute","value":1698653968},{"type":"absolute","value":1698654097},{"type":"absolute","value":1698653973},{"type":"absolute","value":1698654102},{"type":"absolute","value":1698654486},{"type":"absolute","value":1698654107},{"type":"absolute","value":1698653983},{"type":"absolute","value":1698654112},{"type":"absolute","value":1698653858},{"type":"absolute","value":1698653988},{"type":"absolute","value":1698653863},{"type":"absolute","value":1698653993},{"type":"absolute","value":1698654458},{"type":"absolute","value":1698654505},{"type":"absolute","value":1698653868},{"type":"absolute","value":1698654125},{"type":"absolute","value":1698653998},{"type":"absolute","value":1698653873},{"type":"absolute","value":1698654130},{"type":"absolute","value":1698654135},{"type":"absolute","value":1698654008},{"type":"absolute","value":1698654392},{"type":"absolute","value":1698654519},{"type":"absolute","value":1698653883},{"type":"absolute","value":1698654140},{"type":"absolute","value":1698654013},{"type":"absolute","value":1698653888},{"type":"absolute","value":1698654018},{"type":"absolute","value":1698654403},{"type":"absolute","value":1698653893},{"type":"absolute","value":1698654023},{"type":"absolute","value":1698653898},{"type":"absolute","value":1698654538},{"type":"absolute","value":1698654158},{"type":"absolute","value":1698654414},{"type":"absolute","value":1698654163},{"type":"absolute","value":1698653908},{"type":"absolute","value":1698654036},{"type":"absolute","value":1698654168},{"type":"absolute","value":1698653913},{"type":"absolute","value":1698654041},{"type":"absolute","value":1698654425},{"type":"absolute","value":1698654552},{"type":"absolute","value":1698654173},{"type":"absolute","value":1698653918},{"type":"absolute","value":1698654046},{"type":"absolute","value":1698653923},{"type":"absolute","value":1698654051},{"type":"absolute","value":1698654436},{"type":"absolute","value":1698654186},{"type":"absolute","value":1698653933},{"type":"absolute","value":1698654191},{"type":"absolute","value":1698654064},{"type":"absolute","value":1698654447},{"type":"absolute","value":1698653938},{"type":"absolute","value":1698654196},{"type":"absolute","value":1698654069},{"type":"absolute","value":1698653943},{"type":"absolute","value":1698654201},{"type":"absolute","value":1698654074},{"type":"absolute","value":1698653948},{"type":"absolute","value":1698654079}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdeclast","description":"Perform Last Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698654224},{"type":"absolute","value":1698654229},{"type":"absolute","value":1698654214},{"type":"absolute","value":1698654566},{"type":"absolute","value":1698654219}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdeclast"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698654656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdec","description":"Perform One Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698655233},{"type":"absolute","value":1698655745},{"type":"absolute","value":1698655750},{"type":"absolute","value":1698656266},{"type":"absolute","value":1698655243},{"type":"absolute","value":1698655755},{"type":"absolute","value":1698655253},{"type":"absolute","value":1698655765},{"type":"absolute","value":1698656279},{"type":"absolute","value":1698655770},{"type":"absolute","value":1698655263},{"type":"absolute","value":1698655775},{"type":"absolute","value":1698655780},{"type":"absolute","value":1698655273},{"type":"absolute","value":1698656297},{"type":"absolute","value":1698655790},{"type":"absolute","value":1698655283},{"type":"absolute","value":1698655795},{"type":"absolute","value":1698656310},{"type":"absolute","value":1698655800},{"type":"absolute","value":1698655293},{"type":"absolute","value":1698655805},{"type":"absolute","value":1698656328},{"type":"absolute","value":1698655306},{"type":"absolute","value":1698655818},{"type":"absolute","value":1698655823},{"type":"absolute","value":1698655828},{"type":"absolute","value":1698656341},{"type":"absolute","value":1698655319},{"type":"absolute","value":1698655833},{"type":"absolute","value":1698655846},{"type":"absolute","value":1698655337},{"type":"absolute","value":1698655851},{"type":"absolute","value":1698655856},{"type":"absolute","value":1698655861},{"type":"absolute","value":1698655350},{"type":"absolute","value":1698655879},{"type":"absolute","value":1698655368},{"type":"absolute","value":1698655884},{"type":"absolute","value":1698655889},{"type":"absolute","value":1698655381},{"type":"absolute","value":1698655894},{"type":"absolute","value":1698655640},{"type":"absolute","value":1698655645},{"type":"absolute","value":1698655650},{"type":"absolute","value":1698655907},{"type":"absolute","value":1698655655},{"type":"absolute","value":1698655912},{"type":"absolute","value":1698655917},{"type":"absolute","value":1698655665},{"type":"absolute","value":1698655922},{"type":"absolute","value":1698655670},{"type":"absolute","value":1698655675},{"type":"absolute","value":1698655680},{"type":"absolute","value":1698656193},{"type":"absolute","value":1698655940},{"type":"absolute","value":1698655945},{"type":"absolute","value":1698655690},{"type":"absolute","value":1698656203},{"type":"absolute","value":1698655950},{"type":"absolute","value":1698655695},{"type":"absolute","value":1698655955},{"type":"absolute","value":1698655700},{"type":"absolute","value":1698656213},{"type":"absolute","value":1698655705},{"type":"absolute","value":1698656223},{"type":"absolute","value":1698655968},{"type":"absolute","value":1698655715},{"type":"absolute","value":1698655973},{"type":"absolute","value":1698655720},{"type":"absolute","value":1698656233},{"type":"absolute","value":1698655978},{"type":"absolute","value":1698655725},{"type":"absolute","value":1698655983},{"type":"absolute","value":1698655730},{"type":"absolute","value":1698656243},{"type":"absolute","value":1698655740},{"type":"absolute","value":1698656253}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"aesdeclast","description":"Perform Last Round of an AES Decryption Flow"}},"children":[],"locations":[{"type":"absolute","value":1698656001},{"type":"absolute","value":1698655394},{"type":"absolute","value":1698656354},{"type":"absolute","value":1698656006},{"type":"absolute","value":1698656011},{"type":"absolute","value":1698655996}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"vaesdeclast"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using RC4 PRGA":{"meta":{"name":"encrypt data using RC4 PRGA","namespace":"data-manipulation/encryption/rc4","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Cryptography","Encrypt Data","RC4"],"objective":"Cryptography","behavior":"Encrypt Data","method":"RC4","id":"C0027.009"},{"parts":["Cryptography","Generate Pseudo-random Sequence","RC4 PRGA"],"objective":"Cryptography","behavior":"Generate Pseudo-random Sequence","method":"RC4 PRGA","id":"C0021.004"}],"references":[],"examples":["34404A3FB9804977C6AB86CB991FB130:0x403DB0","34404A3FB9804977C6AB86CB991FB130:0x403E50","9324D1A8AE37A36AE560C37448C9705A:0x4049F0","73CE04892E5F39EC82B00C02FC04C70F:0x4064C6"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using RC4 PRGA\n    namespace: data-manipulation/encryption/rc4\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic, mnemonic, basicblock features\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Cryptography::Encrypt Data::RC4 [C0027.009]\n      - Cryptography::Generate Pseudo-random Sequence::RC4 PRGA [C0021.004]\n    examples:\n      - 34404A3FB9804977C6AB86CB991FB130:0x403DB0\n      - 34404A3FB9804977C6AB86CB991FB130:0x403E50\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049F0\n      - 73CE04892E5F39EC82B00C02FC04C70F:0x4064C6\n  features:\n    - and:\n      # TODO: maybe add characteristic for nzxor reg size\n      - count(characteristic(nzxor)): 1\n      - or:\n        - match: calculate modulo 256 via x86 assembly\n        # compiler may do this via zero-extended mov from 8-bit register\n        - count(mnemonic(movzx)): 4 or more\n      # should not call (many) functions\n      - count(characteristic(calls from)): (0, 4)\n      # should not be too simple or too complex (50 is picked by intuition)\n      - count(basic blocks): (4, 50)\n      - match: contain loop\n      - optional:\n        - or:\n          - number: 0xFF\n          - number: 0x100\n","matches":[[{"type":"absolute","value":1698804848},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[{"type":"absolute","value":1698804848}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698804848}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698805111}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":4,"child":{"type":"characteristic","characteristic":"calls from"}}},"children":[],"locations":[{"type":"absolute","value":1698804848},{"type":"absolute","value":1698444688},{"type":"absolute","value":1698804144},{"type":"absolute","value":1698804512}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":50,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698804992},{"type":"absolute","value":1698805632},{"type":"absolute","value":1698804995},{"type":"absolute","value":1698804932},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805133},{"type":"absolute","value":1698805200},{"type":"absolute","value":1698804952},{"type":"absolute","value":1698804889},{"type":"absolute","value":1698805307},{"type":"absolute","value":1698805088},{"type":"absolute","value":1698804961},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805283},{"type":"absolute","value":1698805611},{"type":"absolute","value":1698804908},{"type":"absolute","value":1698805039},{"type":"absolute","value":1698804848},{"type":"absolute","value":1698805104},{"type":"absolute","value":1698805487},{"type":"absolute","value":1698805107},{"type":"absolute","value":1698805363},{"type":"absolute","value":1698805427},{"type":"absolute","value":1698805551},{"type":"absolute","value":1698805177},{"type":"absolute","value":1698804922},{"type":"absolute","value":1698805179}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"calculate modulo 256 via x86 assembly"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"movzx"}}},"children":[],"locations":[{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805122},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805029},{"type":"absolute","value":1698804999},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805066},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805069},{"type":"absolute","value":1698805006},{"type":"absolute","value":1698805009},{"type":"absolute","value":1698805119}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":256}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1698805664},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":1698805664}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1698805664}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"characteristic","characteristic":"nzxor"}}},"children":[],"locations":[{"type":"absolute","value":1698805111}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":0,"max":4,"child":{"type":"characteristic","characteristic":"calls from"}}},"children":[],"locations":[{"type":"absolute","value":1698804848},{"type":"absolute","value":1698444688},{"type":"absolute","value":1698804144},{"type":"absolute","value":1698804512}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":50,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1698804992},{"type":"absolute","value":1698805632},{"type":"absolute","value":1698804995},{"type":"absolute","value":1698804932},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805133},{"type":"absolute","value":1698805200},{"type":"absolute","value":1698804952},{"type":"absolute","value":1698804889},{"type":"absolute","value":1698805307},{"type":"absolute","value":1698805088},{"type":"absolute","value":1698804961},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805283},{"type":"absolute","value":1698805664},{"type":"absolute","value":1698805611},{"type":"absolute","value":1698804908},{"type":"absolute","value":1698805039},{"type":"absolute","value":1698804848},{"type":"absolute","value":1698805104},{"type":"absolute","value":1698805487},{"type":"absolute","value":1698805107},{"type":"absolute","value":1698805363},{"type":"absolute","value":1698805427},{"type":"absolute","value":1698805551},{"type":"absolute","value":1698805177},{"type":"absolute","value":1698804922},{"type":"absolute","value":1698805179}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"calculate modulo 256 via x86 assembly"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"movzx"}}},"children":[],"locations":[{"type":"absolute","value":1698805152},{"type":"absolute","value":1698805026},{"type":"absolute","value":1698805122},{"type":"absolute","value":1698805155},{"type":"absolute","value":1698805029},{"type":"absolute","value":1698804999},{"type":"absolute","value":1698804935},{"type":"absolute","value":1698805066},{"type":"absolute","value":1698805644},{"type":"absolute","value":1698805069},{"type":"absolute","value":1698805006},{"type":"absolute","value":1698805009},{"type":"absolute","value":1698805119}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":256}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encrypt data using Salsa20 or ChaCha":{"meta":{"name":"encrypt data using Salsa20 or ChaCha","namespace":"data-manipulation/encryption/salsa20","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[],"references":["http://cr.yp.to/snuffle/ecrypt.c"],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encrypt data using Salsa20 or ChaCha\n    namespace: data-manipulation/encryption/salsa20\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    references:\n      - http://cr.yp.to/snuffle/ecrypt.c\n  features:\n    # The constant words spell \"expand 32-byte k\" in ASCII (i.e. the 4 words are \"expa\", \"nd 3\", \"2-by\", and \"te k\")\n    - or:\n      - description: part of key setup\n      - string: \"expand 32-byte k\"\n        description: sigma\n      - string: \"expand 16-byte k\"\n        description: tau\n      # if sigma and tau are in contiguous memory, may result in concatenated string\n      - string: \"expand 32-byte kexpand 16-byte k\"\n      - bytes: 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B = \"expand 32-byte k\"\n      - bytes: 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B = \"expand 16-byte k\"\n      - and:\n        - string: \"expa\"\n        - string: \"nd 3\"\n        - string: \"2-by\"\n        - string: \"te k\"\n      - and:\n        - number: 0x61707865 = \"apxe\"\n        - number: 0x3320646E = \"3 dn\"\n        - number: 0x79622D32 = \"yb-2\"\n        - number: 0x6B206574 = \"k et\"\n","matches":[[{"type":"absolute","value":1698960128},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"part of key setup"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expand 32-byte k","description":"sigma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expand 16-byte k","description":"tau"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expand 32-byte kexpand 16-byte k"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"657870616e642033322d62797465206b","description":"\"expand 32-byte k\""}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"657870616e642031362d62797465206b","description":"\"expand 16-byte k\""}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"expa"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"nd 3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"2-by"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"te k"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1634760805,"description":"\"apxe\""}},"children":[],"locations":[{"type":"absolute","value":1698960192},{"type":"absolute","value":1698960259}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":857760878,"description":"\"3 dn\""}},"children":[],"locations":[{"type":"absolute","value":1698960199}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2036477234,"description":"\"yb-2\""}},"children":[],"locations":[{"type":"absolute","value":1698960206}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1797285236,"description":"\"k et\""}},"children":[],"locations":[{"type":"absolute","value":1698960280},{"type":"absolute","value":1698960213}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data with CRC32":{"meta":{"name":"hash data with CRC32","namespace":"data-manipulation/checksum/crc32","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Data","Checksum","CRC32"],"objective":"Data","behavior":"Checksum","method":"CRC32","id":"C0032.001"}],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403CBD","7D28CB106CB54876B2A5C111724A07CD:0x402350","7EFF498DE13CC734262F87E6B3EF38AB:0x100084A6"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data with CRC32\n    namespace: data-manipulation/checksum/crc32\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires operand[1].number, characteristic, bytes, mnemonic features\n    mbc:\n      - Data::Checksum::CRC32 [C0032.001]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403CBD\n      - 7D28CB106CB54876B2A5C111724A07CD:0x402350  # RtlComputeCrc32\n      - 7EFF498DE13CC734262F87E6B3EF38AB:0x100084A6\n  features:\n    - or:\n      - and:\n        - number: 1 = bits in a byte\n        - instruction:\n          - description: is bit set?\n          - or:\n            - mnemonic: and\n            - mnemonic: test\n          - operand[1].number: 1\n        - instruction:\n          - mnemonic: shr\n          - number: 1\n        - characteristic: nzxor\n        - operand[1].number: 0xEDB88320\n      - and:\n        - number: 0x8320\n        - number: 0xEDB8\n        - characteristic: nzxor\n      - api: RtlComputeCrc32\n      - bytes: 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E = crc32_tab\n","matches":[[{"type":"absolute","value":1699058032},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlComputeCrc32"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"00000000963007772c610eeeba51099919c46d078ff46a7035a563e9a395649e","description":"crc32_tab"}},"children":[],"locations":[{"type":"absolute","value":1699058483},{"type":"absolute","value":1699058467},{"type":"absolute","value":1699058087}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":33568}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":60856}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059200},{"type":"absolute","value":1699058433},{"type":"absolute","value":1699058178},{"type":"absolute","value":1699058186},{"type":"absolute","value":1699059856},{"type":"absolute","value":1699058194},{"type":"absolute","value":1699059219},{"type":"absolute","value":1699059092},{"type":"absolute","value":1699059351},{"type":"absolute","value":1699059096},{"type":"absolute","value":1699058337},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059882},{"type":"absolute","value":1699059243},{"type":"absolute","value":1699058223},{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058229},{"type":"absolute","value":1699059583},{"type":"absolute","value":1699058237},{"type":"absolute","value":1699059646},{"type":"absolute","value":1699059392},{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059650},{"type":"absolute","value":1699059907},{"type":"absolute","value":1699060035},{"type":"absolute","value":1699058245},{"type":"absolute","value":1699059269},{"type":"absolute","value":1699058375},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699058123},{"type":"absolute","value":1699058379},{"type":"absolute","value":1699058129},{"type":"absolute","value":1699059027},{"type":"absolute","value":1699059670},{"type":"absolute","value":1699058137},{"type":"absolute","value":1699059674},{"type":"absolute","value":1699058395},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059808},{"type":"absolute","value":1699058145},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059431},{"type":"absolute","value":1699058295},{"type":"absolute","value":1699058283},{"type":"absolute","value":1699059694},{"type":"absolute","value":1699058287},{"type":"absolute","value":1699059952},{"type":"absolute","value":1699059698},{"type":"absolute","value":1699058423},{"type":"absolute","value":1699059832},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059196},{"type":"absolute","value":1699058175}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"bits in a byte"}},"children":[],"locations":[{"type":"absolute","value":1699058034},{"type":"absolute","value":1699060003},{"type":"absolute","value":1699059396},{"type":"absolute","value":1699059317},{"type":"absolute","value":1699059973},{"type":"absolute","value":1699059596},{"type":"absolute","value":1699058414}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand number","index":1,"operand_number":1}},"children":[],"locations":[{"type":"absolute","value":1699058034}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"test"}},"children":[],"locations":[{"type":"absolute","value":1699058034}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699058034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with CRC32/1ce2c6266bb045708cd58b24ae7ea9c3"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[{"type":"absolute","value":1699059200},{"type":"absolute","value":1699058433},{"type":"absolute","value":1699058178},{"type":"absolute","value":1699058186},{"type":"absolute","value":1699059856},{"type":"absolute","value":1699058194},{"type":"absolute","value":1699059219},{"type":"absolute","value":1699059092},{"type":"absolute","value":1699059351},{"type":"absolute","value":1699059096},{"type":"absolute","value":1699058337},{"type":"absolute","value":1699059492},{"type":"absolute","value":1699059496},{"type":"absolute","value":1699059882},{"type":"absolute","value":1699059243},{"type":"absolute","value":1699058223},{"type":"absolute","value":1699058096},{"type":"absolute","value":1699058229},{"type":"absolute","value":1699059583},{"type":"absolute","value":1699058237},{"type":"absolute","value":1699059646},{"type":"absolute","value":1699059392},{"type":"absolute","value":1699059521},{"type":"absolute","value":1699059650},{"type":"absolute","value":1699059907},{"type":"absolute","value":1699060035},{"type":"absolute","value":1699058245},{"type":"absolute","value":1699059269},{"type":"absolute","value":1699058375},{"type":"absolute","value":1699059525},{"type":"absolute","value":1699058123},{"type":"absolute","value":1699058379},{"type":"absolute","value":1699058129},{"type":"absolute","value":1699059027},{"type":"absolute","value":1699059670},{"type":"absolute","value":1699058137},{"type":"absolute","value":1699059674},{"type":"absolute","value":1699058395},{"type":"absolute","value":1699059550},{"type":"absolute","value":1699059808},{"type":"absolute","value":1699058145},{"type":"absolute","value":1699059554},{"type":"absolute","value":1699059431},{"type":"absolute","value":1699058295},{"type":"absolute","value":1699058283},{"type":"absolute","value":1699059694},{"type":"absolute","value":1699058287},{"type":"absolute","value":1699059952},{"type":"absolute","value":1699059698},{"type":"absolute","value":1699058423},{"type":"absolute","value":1699059832},{"type":"absolute","value":1699059579},{"type":"absolute","value":1699059196},{"type":"absolute","value":1699058175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand number","index":1,"operand_number":3988292384}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using SHA512":{"meta":{"name":"hash data using SHA512","namespace":"data-manipulation/hashing/sha512","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":["https://www.rfc-editor.org/rfc/rfc6234"],"examples":["1195d0d18be9362fb8dd9e1738404c9d:0x404FC0","44d40faf3f1fe4ed969befab7afcd2f0:0x1003D2F0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data using SHA512\n    namespace: data-manipulation/hashing/sha512\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    references:\n      - https://www.rfc-editor.org/rfc/rfc6234\n    examples:\n      - 1195d0d18be9362fb8dd9e1738404c9d:0x404FC0\n      - 44d40faf3f1fe4ed969befab7afcd2f0:0x1003D2F0\n  features:\n    - or:\n      - and:\n        - number: 0x6a09e667f3bcc908 = H(0)0\n        - number: 0xbb67ae8584caa73b = H(0)1\n        - number: 0x3c6ef372fe94f82b = H(0)2\n        - number: 0xa54ff53a5f1d36f1 = H(0)3\n        - number: 0x510e527fade682d1 = H(0)4\n        - number: 0x9b05688c2b3e6c1f = H(0)5\n        - number: 0x1f83d9abfb41bd6b = H(0)6\n        - number: 0x5be0cd19137e2179 = H(0)7\n      - and:\n        - or:\n          - number: 0x428a2f98d728ae22\n          - and:\n            - number: 0x428a2f98\n            - number: 0xd728ae22\n        - or:\n          - number: 0x7137449123ef65cd\n          - and:\n            - number: 0x71374491\n            - number: 0x23ef65cd\n        - or:\n          - number: 0xb5c0fbcfec4d3b2f\n          - and:\n            - number: 0xb5c0fbcf\n            - number: 0xec4d3b2f\n        - or:\n          - number: 0xe9b5dba58189dbbc\n          - and:\n            - number: 0xe9b5dba5\n            - number: 0x8189dbbc\n        - or:\n          - number: 0x3956c25bf348b538\n          - and:\n            - number: 0x3956c25b\n            - number: 0xf348b538\n        - or:\n          - number: 0x59f111f1b605d019\n          - and:\n            - number: 0x59f111f1\n            - number: 0xb605d019\n        - or:\n          - number: 0x923f82a4af194f9b\n          - and:\n            - number: 0x923f82a4\n            - number: 0xaf194f9b\n        - or:\n          - number: 0xab1c5ed5da6d8118\n          - and:\n            - number: 0xab1c5ed5\n            - number: 0xda6d8118\n      - bytes: 08 C9 BC F3 67 E6 09 6A 3B A7 CA 84 85 AE 67 BB 2B F8 94 FE 72 F3 6E 3C F1 36 1D 5F 3A F5 4F A5 D1 82 E6 AD 7F 52 0E 51 1F 6C 3E 2B 8C 68 05 9B 6B BD 41 FB AB D9 83 1F 79 21 7E 13 19 CD E0 5B = H(0)\n","matches":[[{"type":"absolute","value":1699103440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699103453}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[{"type":"absolute","value":1699103494}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[{"type":"absolute","value":1699103463}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[{"type":"absolute","value":1699103515}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[{"type":"absolute","value":1699103532}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[{"type":"absolute","value":1699103549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[{"type":"absolute","value":1699103566}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[{"type":"absolute","value":1699103583}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699104512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[{"type":"absolute","value":1699105467}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[{"type":"absolute","value":1699104961}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[{"type":"absolute","value":1699104986}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[{"type":"absolute","value":1699105449}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[{"type":"absolute","value":1699105423}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[{"type":"absolute","value":1699105405}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[{"type":"absolute","value":1699105387}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[{"type":"absolute","value":1699105369}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699167664},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699168178}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[{"type":"absolute","value":1699168188}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[{"type":"absolute","value":1699168417}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[{"type":"absolute","value":1699168509}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[{"type":"absolute","value":1699168050}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[{"type":"absolute","value":1699168235}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[{"type":"absolute","value":1699168382}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[{"type":"absolute","value":1699168493}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180672},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180679}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180686}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180912},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180919}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180926}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699181159}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699181166}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699181399}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699181406}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699183344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"08c9bcf367e6096a3ba7ca8485ae67bb2bf894fe72f36e3cf1361d5f3af54fa5d182e6ad7f520e511f6c3e2b8c68059b6bbd41fbabd9831f79217e1319cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699183666},{"type":"absolute","value":1699183454}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7640891576956012808,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699183946},{"type":"absolute","value":1699183365},{"type":"absolute","value":1699184223}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13503953896175478587,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4354685564936845355,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11912009170470909681,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":5840696475078001361,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":11170449401992604703,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2270897969802886507,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6620516959819538809,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4794697086780616226}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8158064640168781261}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13096744586834688815}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3964484399}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16840607885511220156}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2173295548}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4131703408338449720}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4081628472}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6480981068601479193}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3053834265}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":10538285296894168987}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2937671579}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12329834152419229976}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3664609560}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using SHA384":{"meta":{"name":"hash data using SHA384","namespace":"data-manipulation/hashing/sha384","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":["https://www.rfc-editor.org/rfc/rfc6234"],"examples":["44d40faf3f1fe4ed969befab7afcd2f0:0x1003D970"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data using SHA384\n    namespace: data-manipulation/hashing/sha384\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    references:\n      - https://www.rfc-editor.org/rfc/rfc6234\n    examples:\n      - 44d40faf3f1fe4ed969befab7afcd2f0:0x1003D970\n  features:\n    - or:\n      - and:\n        - number: 0xcbbb9d5dc1059ed8 = H(0)0\n        - number: 0x629a292a367cd507 = H(0)1\n        - number: 0x9159015a3070dd17 = H(0)2\n        - number: 0x152fecd8f70e5939 = H(0)3\n        - number: 0x67332667ffc00b31 = H(0)4\n        - number: 0x8eb44a8768581511 = H(0)5\n        - number: 0xdb0c2e0d64f98fa7 = H(0)6\n        - number: 0x47b5481dbefa4fa4 = H(0)7\n      - bytes: D8 9E 05 C1 5D 9D BB CB 07 D5 7C 36 2A 29 9A 62 17 DD 70 30 5A 01 59 91 39 59 0E F7 D8 EC 2F 15 31 0B C0 FF 67 26 33 67 11 15 58 68 87 4A B4 8E A7 8F F9 64 0D 2E 0C DB A4 4F FA BE 1D 48 B5 47 = H(0)\n","matches":[[{"type":"absolute","value":1699103728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"bytes","bytes":"d89e05c15d9dbbcb07d57c362a299a6217dd70305a01599139590ef7d8ec2f15310bc0ff6726336711155868874ab48ea78ff9640d2e0cdba44ffabe1d48b547","description":"H(0)"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":14680500436340154072,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699103741}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7105036623409894663,"description":"H(0)1"}},"children":[],"locations":[{"type":"absolute","value":1699103782}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":10473403895298186519,"description":"H(0)2"}},"children":[],"locations":[{"type":"absolute","value":1699103751}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1526699215303891257,"description":"H(0)3"}},"children":[],"locations":[{"type":"absolute","value":1699103803}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":7436329637833083697,"description":"H(0)4"}},"children":[],"locations":[{"type":"absolute","value":1699103820}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":10282925794625328401,"description":"H(0)5"}},"children":[],"locations":[{"type":"absolute","value":1699103837}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":15784041429090275239,"description":"H(0)6"}},"children":[],"locations":[{"type":"absolute","value":1699103854}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5167115440072839076,"description":"H(0)7"}},"children":[],"locations":[{"type":"absolute","value":1699103871}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using Base64":{"meta":{"name":"encode data using Base64","namespace":"data-manipulation/encoding/base64","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Standard Algorithm","id":"E1027.m02"},{"parts":["Data","Encode Data","Base64"],"objective":"Data","behavior":"Encode Data","method":"Base64","id":"C0026.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C","074072B261FC27B65C72671F13510C05:0x100049B2","5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30","08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encode data using Base64\n    namespace: data-manipulation/encoding/base64\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]\n      - Data::Encode Data::Base64 [C0026.001]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C\n      - 074072B261FC27B65C72671F13510C05:0x100049B2\n      - 5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - and:\n        - mnemonic: shl\n        - mnemonic: shr\n        - number: 0x3F = modulo 64\n        - or:\n          - number: 0x3D = '='\n          - number: 0x3D3D = '=='\n        - match: contain loop\n        - optional:\n          - number: 2\n          - number: 3\n          - number: 4\n          - number: 6\n          - number: 0xF\n          - string: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"\n      - api: System.Convert::ToBase64String\n      - api: System.Convert::ToBase64CharArray\n      - api: System.Convert::TryToBase64Chars\n","matches":[[{"type":"absolute","value":1699164368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[{"type":"absolute","value":1699164409},{"type":"absolute","value":1699164451},{"type":"absolute","value":1699164417}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[{"type":"absolute","value":1699164413},{"type":"absolute","value":1699164455}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[{"type":"absolute","value":1699164778},{"type":"absolute","value":1699164495}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[{"type":"absolute","value":1699164455}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":1699164528},{"type":"absolute","value":1699164704},{"type":"absolute","value":1699164608},{"type":"absolute","value":1699164787},{"type":"absolute","value":1699164848},{"type":"absolute","value":1699164928}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699164368}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"absolute","value":1699164451}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"absolute","value":1699164409},{"type":"absolute","value":1699164417}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data using SHA256":{"meta":{"name":"hash data using SHA256","namespace":"data-manipulation/hashing/sha256","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","SHA256"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"SHA256","id":"C0029.003"}],"references":["https://www.rfc-editor.org/rfc/rfc6234"],"examples":["C0CFFCF211035A839E28D542DE300298:0x180011400","6CC148363200798A12091B97A17181A1:0x140120240","44d40faf3f1fe4ed969befab7afcd2f0:0x10033570"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data using SHA256\n    namespace: data-manipulation/hashing/sha256\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Cryptography::Cryptographic Hash::SHA256 [C0029.003]\n    references:\n      - https://www.rfc-editor.org/rfc/rfc6234\n    examples:\n      - C0CFFCF211035A839E28D542DE300298:0x180011400\n      - 6CC148363200798A12091B97A17181A1:0x140120240\n      - 44d40faf3f1fe4ed969befab7afcd2f0:0x10033570\n  features:\n    - or:\n      - and:\n        - number: 0x6A09E667 = H(0)0\n        - number: 0xBB67AE85 = H(0)1\n        - number: 0x3C6EF372 = H(0)2\n        - number: 0xA54FF53A = H(0)3\n        - number: 0x510E527F = H(0)4\n        - number: 0x9B05688C = H(0)5\n        - number: 0x1F83D9AB = H(0)6\n        - number: 0x5BE0CD19 = H(0)7\n      - bytes: 67 E6 09 6A 85 AE 67 BB 72 F3 6E 3C 3A F5 4F A5 7F 52 0E 51 8C 68 05 9B AB D9 83 1F 19 CD E0 5B = H(0)\n      - and:\n        # there are 64 constants but we'll only include 8 here for simplicity\n        - number: 0x428a2f98\n        - number: 0x71374491\n        - number: 0xb5c0fbcf\n        - number: 0xe9b5dba5\n        - number: 0x3956c25b\n        - number: 0x59f111f1\n        - number: 0x923f82a4\n        - number: 0xab1c5ed5\n        - not:\n          - or:\n            - number: 0xd728ae22 = lower half of SHA512 constant, 0x428a2f98d728ae22\n            - number: 0x23ef65cd = lower half of SHA512 constant, 0x7137449123ef65cd\n      - and:\n        - format: dotnet\n        - or:\n          - api: System.Security.Cryptography.SHA256Managed::Initialize\n          - api: System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize\n          - api: System.Security.Cryptography.SHA256::Create\n          - api: System.Security.Cryptography.SHA256Managed::ctor\n        - api: System.Security.Cryptography.HashAlgorithm::ComputeHash\n","matches":[[{"type":"absolute","value":1699179840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699179853}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699179847}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180061}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180055}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180256},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180269}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180263}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699180464},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699180477}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699180471}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699181632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b","description":"H(0)"}},"children":[],"locations":[{"type":"absolute","value":1699181896},{"type":"absolute","value":1699181655}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.SHA256Managed::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1779033703,"description":"H(0)0"}},"children":[],"locations":[{"type":"absolute","value":1699182449},{"type":"absolute","value":1699182133},{"type":"absolute","value":1699181735}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3144134277,"description":"H(0)1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1013904242,"description":"H(0)2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2773480762,"description":"H(0)3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1359893119,"description":"H(0)4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2600822924,"description":"H(0)5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":528734635,"description":"H(0)6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1541459225,"description":"H(0)7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1116352408}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1899447441}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3049323471}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3921009573}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":961987163}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1508970993}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2453635748}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2870763221}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3609767458,"description":"lower half of SHA512 constant, 0x428a2f98d728ae22"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":602891725,"description":"lower half of SHA512 constant, 0x7137449123ef65cd"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data with MD5":{"meta":{"name":"hash data with MD5","namespace":"data-manipulation/hashing/md5","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","MD5"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"MD5","id":"C0029.001"}],"references":["https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x100108ED"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data with MD5\n    namespace: data-manipulation/hashing/md5\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Cryptography::Cryptographic Hash::MD5 [C0029.001]\n    references:\n      - https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x100108ED\n  features:\n    - or:\n      - and:\n        - description: magic initialization constants from MD4 and MD5\n        - number: 0x67452301 = A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - number: 0xefcdab89 = B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - number: 0x98badcfe = C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - number: 0x10325476 = D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - not:\n          - number: 0xc3d2e1f0 = likely SHA1 but also used in RIPEMD-160 and RIPEMD-320\n        - optional:\n          - description: specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\n          - and:\n            - offset: -0x28955B88\n            - offset: -0x173848AA\n      - basic block:\n        - and:\n          - number: 0x8003 = CALG_MD5\n          - api: advapi32.CryptCreateHash\n      - call:\n        - and:\n          - number: 0x8003 = CALG_MD5\n          - api: advapi32.CryptCreateHash\n      - and:\n        - format: dotnet\n        - or:\n          - api: System.Security.Cryptography.MD5::Create\n          - api: System.Security.Cryptography.MD5CryptoServiceProvider::ctor\n        - optional:\n          - api: System.Security.Cryptography.HashAlgorithm::ComputeHash\n","matches":[[{"type":"absolute","value":1699227920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/dbb535ceb9c740369f1b0bfbe3b22a97"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/62df64d4453044639ee23ad3e036fd38"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5CryptoServiceProvider::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"magic initialization constants from MD4 and MD5"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1732584193,"description":"A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227939}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4023233417,"description":"B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227946}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2562383102,"description":"C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227953}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":271733878,"description":"D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[{"type":"absolute","value":1699227960}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3285377520,"description":"likely SHA1 but also used in RIPEMD-160 and RIPEMD-320"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-680876936}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-389564586}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query environment variable":{"meta":{"name":"query environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com","@_re_fox"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x401880","0761142efbda6c4b1e801223de723578:0x65483490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query environment variable\n    namespace: host-interaction/environment-variable\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@_re_fox\"\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - Practical Malware Analysis Lab 14-02.exe_:0x401880\n      - 0761142efbda6c4b1e801223de723578:0x65483490\n  features:\n    - or:\n      - api: kernel32.GetEnvironmentVariable\n      - api: kernel32.GetEnvironmentStrings\n      - api: kernel32.ExpandEnvironmentStrings\n      - api: msvcr90.getenv\n      - api: msvcrt.getenv\n      - api: System.Environment::GetEnvironmentVariable\n      - api: System.Environment::GetEnvironmentVariables\n      - api: System.Environment::ExpandEnvironmentVariables\n","matches":[[{"type":"absolute","value":1699230864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699230893}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699230893}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699232613}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699232613}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699265392},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699265705}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[{"type":"absolute","value":1699265705}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query or enumerate registry value\n    namespace: host-interaction/registry\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Value [C0036.006]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegGetValue\n        - api: advapi32.RegEnumValue\n        - api: advapi32.RegQueryValue\n        - api: advapi32.RegQueryValueEx\n        - api: advapi32.RegQueryMultipleValues\n        - api: ZwQueryValueKey\n        - api: ZwEnumerateValueKey\n        - api: NtQueryValueKey\n        - api: NtEnumerateValueKey\n        - api: RtlQueryRegistryValues\n        - api: SHGetValue\n        - api: SHEnumValue\n        - api: SHRegGetInt\n        - api: SHRegGetPath\n        - api: SHRegGetValue\n        - api: SHQueryValueEx\n        - api: SHRegGetUSValue\n        - api: SHOpenRegStream\n        - api: SHRegEnumUSValue\n        - api: SHOpenRegStream2\n        - api: SHRegQueryUSValue\n        - api: SHRegGetBoolUSValue\n        - api: SHRegGetValueFromHKCUHKLM\n        - api: SHRegGetBoolValueFromHKCUHKLM\n        - api: Microsoft.Win32.RegistryKey::GetValue\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\n        - api: Microsoft.Win32.Registry::GetValue\n","matches":[[{"type":"absolute","value":1699230864},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":1699231046}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":1699232142}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232109}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":1699232217}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file via mapping":{"meta":{"name":"read file via mapping","namespace":"host-interaction/file-system/read","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.exe_:0x401440"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read file via mapping\n    namespace: host-interaction/file-system/read\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Read File [C0051]\n    examples:\n      - Practical Malware Analysis Lab 01-01.exe_:0x401440\n  features:\n    - or:\n      - and:\n        # static\n        - basic block:\n          - and:\n            - api: kernel32.MapViewOfFile\n            - or:\n              - number: 4 = FILE_MAP_READ\n              - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ\n        - optional:\n          - api: kernel32.UnmapViewOfFile\n          - and:\n            - match: get file size\n          - basic block:\n            - and:\n              - api: kernel32.CreateFileMapping\n              - or:\n                - number: 2 = PAGE_READONLY\n                - number: 4 = PAGE_READWRITE\n      - and:\n        # dynamic\n        - call:\n          - and:\n            - api: kernel32.MapViewOfFile\n            - or:\n              - number: 4 = FILE_MAP_READ\n              - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ\n        - optional:\n          - api: kernel32.UnmapViewOfFile\n          - and:\n            - match: get file size\n          - call:\n            - and:\n              - api: kernel32.CreateFileMapping\n              - or:\n                - number: 2 = PAGE_READONLY\n                - number: 4 = PAGE_READWRITE\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"MapViewOfFile"}},"children":[],"locations":[{"type":"absolute","value":1699231540}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"FILE_MAP_READ"}},"children":[],"locations":[{"type":"absolute","value":1699231523}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"FILE_MAP_WRITE | FILE_MAP_READ"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231517}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"UnmapViewOfFile"}},"children":[],"locations":[{"type":"absolute","value":1699231586}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get file size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read file via mapping/eb5914bcd3094e159821e93d4a87ceae"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read file via mapping/36a2dd986cd941f49806c62be09a225c"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"UnmapViewOfFile"}},"children":[],"locations":[{"type":"absolute","value":1699231586}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get file size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read file via mapping/38ebcdc7c0dd4e8e9931a642fccaf4aa"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: link function at runtime on Windows\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\n  features:\n    - and:\n      - os: windows\n      - or:\n        - api: kernel32.GetProcAddress\n        - api: ntdll.LdrGetProcedureAddress\n      - optional:\n        - characteristic: indirect call\n        - api: kernel32.LoadLibrary\n        - api: kernel32.GetModuleHandle\n        - api: kernel32.GetModuleHandleEx\n        - api: ntdll.LdrLoadDll\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699233219},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232904},{"type":"absolute","value":1699233162},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699233107},{"type":"absolute","value":1699233429},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699231770},{"type":"absolute","value":1699231581},{"type":"absolute","value":1699232478},{"type":"absolute","value":1699231455},{"type":"absolute","value":1699233376},{"type":"absolute","value":1699233696},{"type":"absolute","value":1699231718},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":1699232249}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":1699232725},{"type":"absolute","value":1699232397}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"generate random numbers via RtlGenRandom":{"meta":{"name":"generate random numbers via RtlGenRandom","namespace":"data-manipulation/prng","authors":["william.ballenthin@mandiant.com","richard.weiss@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Generate Pseudo-random Sequence","Use API"],"objective":"Cryptography","behavior":"Generate Pseudo-random Sequence","method":"Use API","id":"C0021.003"}],"references":["https://doxygen.reactos.org/df/d13/sysfunc_8c_source.html","https://blog.gentilkiwi.com/tag/systemfunction036"],"examples":["b7841b9d5dc1f511a93cc7576672ec0c:0x10002B80","0a0882b8da225406cc838991b5f67d11:0x416F35"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: generate random numbers via RtlGenRandom\n    namespace: data-manipulation/prng\n    authors:\n      - william.ballenthin@mandiant.com\n      - richard.weiss@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Cryptography::Generate Pseudo-random Sequence::Use API [C0021.003]\n    references:\n      - https://doxygen.reactos.org/df/d13/sysfunc_8c_source.html\n      - https://blog.gentilkiwi.com/tag/systemfunction036\n    examples:\n      - b7841b9d5dc1f511a93cc7576672ec0c:0x10002B80 # api\n      - 0a0882b8da225406cc838991b5f67d11:0x416F35 # string\n  features:\n    - or:\n      - api: SystemFunction036\n      - and:\n        - match: link function at runtime on Windows\n        - string: \"SystemFunction036\"\n        - optional:\n          - string: /advapi32/i\n          - string: /cryptsp/i\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SystemFunction036"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699233219},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232904},{"type":"absolute","value":1699233162},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699233107},{"type":"absolute","value":1699233429},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699231770},{"type":"absolute","value":1699231581},{"type":"absolute","value":1699232478},{"type":"absolute","value":1699231455},{"type":"absolute","value":1699233376},{"type":"absolute","value":1699233696},{"type":"absolute","value":1699231718},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":1699232249}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":1699232725},{"type":"absolute","value":1699232397}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"SystemFunction036"}},"children":[],"locations":[{"type":"absolute","value":1699232812}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/advapi32/i"}},"children":[],"locations":[{"type":"absolute","value":1699232697}],"captures":{"AdvAPI32.dll":[{"type":"absolute","value":1699232697}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/cryptsp/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get OS version":{"meta":{"name":"get OS version","authors":["@mr-tz"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000","5f66b82558ca92e54e77f216ef4c066c:0x44580A"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get OS version\n    authors:\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: function\n      dynamic: call\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x401000\n      - 5f66b82558ca92e54e77f216ef4c066c:0x44580A\n  features:\n    - or:\n      - api: RtlGetVersion\n      - api: ntoskrnl.PsGetVersion\n      - api: GetVersion\n      - api: GetVersionEx\n      - api: VerifyVersionInfo\n      - api: VerSetConditionMask\n      - api: RtlGetNtVersionNumbers\n      - api: GetProductInfo\n      - and:\n        - match: PEB access\n        - or:\n          - and:\n            - arch: i386\n            - or:\n              - offset: 0xA4 = PEB->OSMajorVersion\n              - offset: 0xA8 = PEB->OSMinorVersion\n              - offset: 0xAC = PEB->OSBuildNumber\n          - and:\n            - arch: amd64\n            - or:\n              - offset: 0x118 = PEB->OSMajorVersion\n              - offset: 0x11C = PEB->OSMinorVersion\n              - offset: 0x120 = PEB->OSBuildNumber\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[{"type":"absolute","value":1699232656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699232676},{"type":"absolute","value":1699232538},{"type":"absolute","value":1699232546}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699233569}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[{"type":"absolute","value":1699232530}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link many functions at runtime":{"meta":{"name":"link many functions at runtime","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["b7b5e1253710d8927cbe07d52d2d2e10:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: link many functions at runtime\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n      - joakim@intezer.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - b7b5e1253710d8927cbe07d52d2d2e10:0x401000\n  features:\n    - or:\n      - and:\n        - os: windows\n        - match: link function at runtime on Windows\n        - or:\n          - count(api(kernel32.GetProcAddress)): 5 or more\n          - count(api(ntdll.LdrGetProcedureAddress)): 5 or more\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - match: link function at runtime on Linux\n        - or:\n          - count(api(dlsym)): 5 or more\n          - count(api(dlvsym)): 5 or more\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699233219},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232904},{"type":"absolute","value":1699233162},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699233107},{"type":"absolute","value":1699233429},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699231770},{"type":"absolute","value":1699231581},{"type":"absolute","value":1699232478},{"type":"absolute","value":1699231455},{"type":"absolute","value":1699233376},{"type":"absolute","value":1699233696},{"type":"absolute","value":1699231718},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232764}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":1699232249}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":1699232725},{"type":"absolute","value":1699232397}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"GetProcAddress"}}},"children":[],"locations":[{"type":"absolute","value":1699232321},{"type":"absolute","value":1699232833},{"type":"absolute","value":1699232455},{"type":"absolute","value":1699232298},{"type":"absolute","value":1699232810},{"type":"absolute","value":1699232432},{"type":"absolute","value":1699232787},{"type":"absolute","value":1699232344},{"type":"absolute","value":1699232764},{"type":"absolute","value":1699232478}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"LdrGetProcedureAddress"}}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"dlsym"}}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"range","min":5,"max":9223372036854775808,"child":{"type":"api","api":"dlvsym"}}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check OS version":{"meta":{"name":"check OS version","namespace":"host-interaction/os/version","authors":["michael.hunhoff@mandiant.com","johnk3r"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check OS version\n    namespace: host-interaction/os/version\n    authors:\n      - michael.hunhoff@mandiant.com\n      - johnk3r\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x401000\n  features:\n    - and:\n      - match: get OS version\n      - or:\n        - and:\n          - instruction:\n            - mnemonic: cmp\n            - number: 5 = Windows 2000\n          - optional:\n            - instruction:\n              - mnemonic: cmp\n              - or:\n                - number: 0\n                - number: 1 = Windows XP\n                - number: 2 = Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2\n        - and:\n          - instruction:\n            - mnemonic: cmp\n            - number: 6 = Windows Vista / Windows Server 2008\n          - optional:\n            - instruction:\n              - mnemonic: cmp\n              - or:\n                - number: 0\n                - number: 1 = Windows Server 2008 R2 / Windows 7\n                - number: 2 = Windows Server 2012 / Windows 8\n                - number: 3 = Windows Server 2012 R2 / Windows 8.1\n        - and:\n          - instruction:\n            - mnemonic: cmp\n            - number: 10 = Windows Server 2016 / Windows Server 2019 / Windows 10\n          - optional:\n            - instruction:\n              - mnemonic: cmp\n              - number: 0\n","matches":[[{"type":"absolute","value":1699231280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"get OS version"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[{"type":"absolute","value":1699232656}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699232676},{"type":"absolute","value":1699232538},{"type":"absolute","value":1699232546}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[{"type":"absolute","value":1699233569}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[{"type":"absolute","value":1699232530}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699231280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232676}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5,"description":"Windows 2000"}},"children":[],"locations":[{"type":"absolute","value":1699232676}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232676}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows XP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows XP 64-bit / Windows Server 2003 / Windows Server 2003 R2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232480},{"type":"absolute","value":1699232864},{"type":"absolute","value":1699232995},{"type":"absolute","value":1699232367},{"type":"absolute","value":1699231601},{"type":"absolute","value":1699232501},{"type":"absolute","value":1699232662},{"type":"absolute","value":1699232854},{"type":"absolute","value":1699232346}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check OS version/d2fa22ccfe5b4f2390400121166cc9db"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[{"type":"absolute","value":1699232662}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"Windows Server 2008 R2 / Windows 7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"Windows Server 2012 / Windows 8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"Windows Server 2012 R2 / Windows 8.1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232480},{"type":"absolute","value":1699232864},{"type":"absolute","value":1699232995},{"type":"absolute","value":1699232367},{"type":"absolute","value":1699231601},{"type":"absolute","value":1699232501},{"type":"absolute","value":1699232662},{"type":"absolute","value":1699232854},{"type":"absolute","value":1699232346}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check OS version/967c5e61ba214df78e148359f5966e7c"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232480}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699231601}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232864}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232995}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232501}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232854}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232346}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":1699232367}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699232480},{"type":"absolute","value":1699231601},{"type":"absolute","value":1699232864},{"type":"absolute","value":1699232995},{"type":"absolute","value":1699232501},{"type":"absolute","value":1699232854},{"type":"absolute","value":1699232346},{"type":"absolute","value":1699232367}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get memory capacity":{"meta":{"name":"get memory capacity","namespace":"host-interaction/hardware/memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get memory capacity\n    namespace: host-interaction/hardware/memory\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n  features:\n    - or:\n      - api: kernel32.GlobalMemoryStatus\n      - api: kernel32.GlobalMemoryStatusEx\n        # TODO kernel32.GetSystemInfo with offset\n","matches":[[{"type":"absolute","value":1699233856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatus"}},"children":[],"locations":[{"type":"absolute","value":1699234179}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatusEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"terminate process":{"meta":{"name":"terminate process","namespace":"host-interaction/process/terminate","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Terminate Process"],"objective":"Process","behavior":"Terminate Process","method":"","id":"C0018"}],"references":[],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x401A77","9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: terminate process\n    namespace: host-interaction/process/terminate\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Process::Terminate Process [C0018]\n    examples:\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\n  features:\n    - or:\n      - api: System.Diagnostics.Process::Kill\n      - api: System.Diagnostics.Process::WaitForExit\n      - api: System.Diagnostics.Process::WaitForExitAsync\n      - api: System.Environment::Exit\n      - api: System.Windows.Forms.Application::Exit\n      - api: exit\n      - api: Exit\n      - and:\n        - optional:\n          - match: open process\n        - or:\n          - api: kernel32.TerminateProcess\n          - api: ntdll.NtTerminateProcess\n          - api: kernel32.ExitProcess\n","matches":[[{"type":"absolute","value":1699277792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[{"type":"absolute","value":1699278002}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get thread local storage value":{"meta":{"name":"get thread local storage value","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get thread local storage value\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n  features:\n    - and:\n      - api: kernel32.TlsGetValue\n","matches":[[{"type":"absolute","value":1699280640},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TlsGetValue"}},"children":[],"locations":[{"type":"absolute","value":1699280690}],"captures":{}}],"locations":[],"captures":{}}]]},"parse PE header":{"meta":{"name":"parse PE header","namespace":"load-code/pe","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403DD0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: parse PE header\n    namespace: load-code/pe\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic, operand[1].offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0\n  features:\n    - and:\n      - os: windows\n      - and:\n        - mnemonic: cmp\n        - or:\n          - number: 0x4550 = IMAGE_NT_SIGNATURE (PE)\n          - and:\n            - number: 0x50\n            - number: 0x45\n        - or:\n          - number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ)\n          - and:\n            - number: 0x4D\n            - number: 0x5A\n        - optional:\n          - and:\n            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n            - or:\n              - and:\n                - arch: i386\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\n                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n              - and:\n                - arch: amd64\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\n                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase\n          - basic block:\n            - and:\n              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n              - 3 or more:\n                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine\n                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\n                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\n                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics\n                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit\n                - or:\n                  - and:\n                    - arch: i386\n                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\n                  - and:\n                    - arch: amd64\n                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\n","matches":[[{"type":"absolute","value":1699281296},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":1699281296},{"type":"absolute","value":1699281273},{"type":"absolute","value":1699281284}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":1699281273}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":1699281296}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281264}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/303ac304a9954095b738a84377f00288"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate PE sections":{"meta":{"name":"enumerate PE sections","namespace":"load-code/pe","authors":["@Ana06","@mr-tz"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Discovery","Code Discovery","Enumerate PE Sections"],"objective":"Discovery","behavior":"Code Discovery","method":"Enumerate PE Sections","id":"B0046.001"}],"references":["https://0x00sec.org/t/reflective-dll-injection/3080","https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection"],"examples":["E4C33AC3638EEF68311F8AC0D72483C7:0x401510"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate PE sections\n    namespace: load-code/pe\n    authors:\n      - \"@Ana06\"\n      - \"@mr-tz\"\n    scopes:\n      static: function\n      dynamic: unsupported  # requires offset, operand[1].offset, characteristic, mnemonic, basicblock features\n    mbc:\n      - Discovery::Code Discovery::Enumerate PE Sections [B0046.001]\n    references:\n      - https://0x00sec.org/t/reflective-dll-injection/3080\n      - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection\n    examples:\n      - E4C33AC3638EEF68311F8AC0D72483C7:0x401510\n  features:\n    - and:\n      - os: windows\n      # there should be some complexity to functions like this\n      - count(basic blocks): 3 or more\n      - optional:\n        - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n      - instruction:\n        - or:\n          - mnemonic: mov\n          - mnemonic: movzx\n        - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\n      - basic block:\n        - or:\n          - and:\n            - description: IMAGE_FIRST_SECTION(nt_header)\n            - instruction:\n              - or:\n                - mnemonic: add\n                - mnemonic: mov\n                - mnemonic: movzx\n              - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\n            - operand[1].offset: 0x18 = FileHeader.SizeOfOptionalHeader\n          - and:\n            - description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i\n            - number: 0x28 = sizeof(IMAGE_SECTION_HEADER)\n            - or:\n              - and:\n                - arch: i386\n                - operand[1].offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)\n              - and:\n                - arch: amd64\n                - operand[1].offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)\n      - 2 or more:\n        - operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress\n        - operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData\n        - operand[1].offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData\n        # there's also offset 0x8 = IMAGE_SECTION_HEADER.Misc.PhysicalAddress, but it's likely too common\n      - not:\n        # non-zeroing XOR was observed in FPs\n        - characteristic: nzxor\n","matches":[[{"type":"absolute","value":1699281328},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699281344}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281344}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281344}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281335}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281335}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281335}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281339}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281328}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699281328},{"type":"absolute","value":1699281376},{"type":"absolute","value":1699281393},{"type":"absolute","value":1699281395},{"type":"absolute","value":1699281364},{"type":"absolute","value":1699281384},{"type":"absolute","value":1699281352}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281328}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699281364}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699281335}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281552},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699281599}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281599}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281599}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281604}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281604}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281604}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281611}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281586}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699281632},{"type":"absolute","value":1699281574},{"type":"absolute","value":1699281644},{"type":"absolute","value":1699281552},{"type":"absolute","value":1699281618},{"type":"absolute","value":1699281586},{"type":"absolute","value":1699281652},{"type":"absolute","value":1699281661},{"type":"absolute","value":1699281663}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281586}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699281632}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699281604}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699281920},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699281977}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281977}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281977}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281982}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699281982}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281982}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699281989}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699281964}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699281920},{"type":"absolute","value":1699281952},{"type":"absolute","value":1699282016},{"type":"absolute","value":1699282052},{"type":"absolute","value":1699282028},{"type":"absolute","value":1699281964},{"type":"absolute","value":1699281996},{"type":"absolute","value":1699282036},{"type":"absolute","value":1699281944},{"type":"absolute","value":1699282045}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699281964}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699282016}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699281982}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":1699282080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":6,"description":"IMAGE_NT_HEADERS.FileHeader.NumberOfSections"}},"children":[],"locations":[{"type":"absolute","value":1699282140}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699282140}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699282140}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"IMAGE_FIRST_SECTION(nt_header)"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699282131}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"mov"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"movzx"}},"children":[],"locations":[{"type":"absolute","value":1699282131}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699282131}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":24,"description":"FileHeader.SizeOfOptionalHeader"}},"children":[],"locations":[{"type":"absolute","value":1699282135}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"(DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":40,"description":"sizeof(IMAGE_SECTION_HEADER)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":248,"description":"sizeof(IMAGE_NT_HEADERS32)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":264,"description":"sizeof(IMAGE_NT_HEADERS64)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":1699282131}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":3,"max":9223372036854775808,"child":{"type":"basic block"}}},"children":[],"locations":[{"type":"absolute","value":1699282080},{"type":"absolute","value":1699282208},{"type":"absolute","value":1699282114},{"type":"absolute","value":1699282148},{"type":"absolute","value":1699282181},{"type":"absolute","value":1699282216},{"type":"absolute","value":1699282190},{"type":"absolute","value":1699282223},{"type":"absolute","value":1699282160},{"type":"absolute","value":1699282131},{"type":"absolute","value":1699282197},{"type":"absolute","value":1699282102},{"type":"absolute","value":1699282230},{"type":"absolute","value":1699282202},{"type":"absolute","value":1699282235},{"type":"absolute","value":1699282172}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":1699282114}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"nzxor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"some","count":2}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":12,"description":"IMAGE_SECTION_HEADER.VirtualAddress"}},"children":[],"locations":[{"type":"absolute","value":1699282160},{"type":"absolute","value":1699282235},{"type":"absolute","value":1699282223}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":20,"description":"IMAGE_SECTION_HEADER.PointerToRawData"}},"children":[],"locations":[{"type":"absolute","value":1699282131},{"type":"absolute","value":1699282212}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":16,"description":"IMAGE_SECTION_HEADER.SizeOfRawData"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain a thread local storage (.tls) section":{"meta":{"name":"contain a thread local storage (.tls) section","namespace":"executable/pe/section/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain a thread local storage (.tls) section\n    namespace: executable/pe/section/tls\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - Practical Malware Analysis Lab 16-02.exe_\n  features:\n    - section: .tls\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"section","section":".tls"}},"children":[],"locations":[{"type":"absolute","value":1699557376}],"captures":{}}]]},"debug build":{"meta":{"name":"debug build","namespace":"executable/pe/debug","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: debug build\n    namespace: executable/pe/debug\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n  features:\n    - or:\n      - string: \"Assertion failed!\"\n      - string: \"Assertion failed:\"\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"Assertion failed!"}},"children":[],"locations":[{"type":"file","value":1053784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Assertion failed:"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
diff --git a/rd/1c444ebeba24dcba8628b7dfe5fec7c6.exe_.json b/rd/1c444ebeba24dcba8628b7dfe5fec7c6.exe_.json
index 7af802e..60719e4 100644
--- a/rd/1c444ebeba24dcba8628b7dfe5fec7c6.exe_.json
+++ b/rd/1c444ebeba24dcba8628b7dfe5fec7c6.exe_.json
@@ -1 +1 @@
-{"meta":{"timestamp":"2024-03-02T04:02:07.132524","version":"7.0.1","argv":["./tests/data/dotnet/1c444ebeba24dcba8628b7dfe5fec7c6.exe_","-j"],"sample":{"md5":"1c444ebeba24dcba8628b7dfe5fec7c6","sha1":"ebdec120fbbdbff28ebd6accc85d05f7ccabf461","sha256":"a9f9e5a30cc858dc135ec428cdd68cb06143732e5c62c4dc4b359c8abc11d74b","path":"C:/Users/HP/Documents/GitHub/capa/tests/data/dotnet/1c444ebeba24dcba8628b7dfe5fec7c6.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"any","os":"any","extractor":"DnfileFeatureExtractor","rules":["C:/Users/HP/Documents/GitHub/capa/rules"],"base_address":{"type":"no address"},"layout":{"functions":[{"address":{"type":"dn token","value":100663316},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663316}}]},{"address":{"type":"dn token","value":100663336},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663336}}]},{"address":{"type":"dn token","value":100663339},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663339}}]},{"address":{"type":"dn token","value":100663343},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663343}}]},{"address":{"type":"dn token","value":100663348},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663348}}]},{"address":{"type":"dn token","value":100663353},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663353}}]},{"address":{"type":"dn token","value":100663358},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663358}}]},{"address":{"type":"dn token","value":100663364},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663364}}]},{"address":{"type":"dn token","value":100663368},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663368}}]},{"address":{"type":"dn token","value":100663373},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663373}}]},{"address":{"type":"dn token","value":100663374},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663374}}]},{"address":{"type":"dn token","value":100663378},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663378}}]},{"address":{"type":"dn token","value":100663379},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663379}}]},{"address":{"type":"dn token","value":100663383},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663383}}]},{"address":{"type":"dn token","value":100663388},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663388}}]},{"address":{"type":"dn token","value":100663393},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663393}}]},{"address":{"type":"dn token","value":100663394},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663394}}]},{"address":{"type":"dn token","value":100663395},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663395}}]},{"address":{"type":"dn token","value":100663398},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663398}}]},{"address":{"type":"dn token","value":100663425},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663425}}]},{"address":{"type":"dn token","value":100663428},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663428}}]},{"address":{"type":"dn token","value":100663429},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663429}}]},{"address":{"type":"dn token","value":100663431},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663431}}]},{"address":{"type":"dn token","value":100663434},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663434}}]},{"address":{"type":"dn token","value":100663436},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663436}}]},{"address":{"type":"dn token","value":100663439},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663439}}]},{"address":{"type":"dn token","value":100663441},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663441}}]},{"address":{"type":"dn token","value":100663444},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663444}}]},{"address":{"type":"dn token","value":100663445},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663445}}]},{"address":{"type":"dn token","value":100663446},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663446}}]},{"address":{"type":"dn token","value":100663450},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663450}}]},{"address":{"type":"dn token","value":100663456},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663456}}]}]},"feature_counts":{"file":1245,"functions":[{"address":{"type":"dn token","value":100663297},"count":8},{"address":{"type":"dn token","value":100663298},"count":8},{"address":{"type":"dn token","value":100663299},"count":28},{"address":{"type":"dn token","value":100663300},"count":17},{"address":{"type":"dn token","value":100663301},"count":15},{"address":{"type":"dn token","value":100663302},"count":40},{"address":{"type":"dn token","value":100663303},"count":5},{"address":{"type":"dn token","value":100663304},"count":15},{"address":{"type":"dn token","value":100663305},"count":15},{"address":{"type":"dn token","value":100663306},"count":15},{"address":{"type":"dn token","value":100663307},"count":15},{"address":{"type":"dn token","value":100663308},"count":15},{"address":{"type":"dn token","value":100663309},"count":15},{"address":{"type":"dn token","value":100663310},"count":15},{"address":{"type":"dn token","value":100663311},"count":9},{"address":{"type":"dn token","value":100663312},"count":32},{"address":{"type":"dn token","value":100663313},"count":14},{"address":{"type":"dn token","value":100663314},"count":13},{"address":{"type":"dn token","value":100663315},"count":13},{"address":{"type":"dn token","value":100663316},"count":15},{"address":{"type":"dn token","value":100663317},"count":10},{"address":{"type":"dn token","value":100663318},"count":13},{"address":{"type":"dn token","value":100663319},"count":10},{"address":{"type":"dn token","value":100663320},"count":10},{"address":{"type":"dn token","value":100663321},"count":9},{"address":{"type":"dn token","value":100663322},"count":8},{"address":{"type":"dn token","value":100663323},"count":29},{"address":{"type":"dn token","value":100663324},"count":15},{"address":{"type":"dn token","value":100663325},"count":28},{"address":{"type":"dn token","value":100663326},"count":8},{"address":{"type":"dn token","value":100663327},"count":14},{"address":{"type":"dn token","value":100663328},"count":269},{"address":{"type":"dn token","value":100663329},"count":8},{"address":{"type":"dn token","value":100663330},"count":19},{"address":{"type":"dn token","value":100663331},"count":18},{"address":{"type":"dn token","value":100663332},"count":16},{"address":{"type":"dn token","value":100663333},"count":11},{"address":{"type":"dn token","value":100663334},"count":10},{"address":{"type":"dn token","value":100663335},"count":11},{"address":{"type":"dn token","value":100663336},"count":34},{"address":{"type":"dn token","value":100663337},"count":14},{"address":{"type":"dn token","value":100663338},"count":24},{"address":{"type":"dn token","value":100663339},"count":33},{"address":{"type":"dn token","value":100663340},"count":22},{"address":{"type":"dn token","value":100663341},"count":9},{"address":{"type":"dn token","value":100663342},"count":11},{"address":{"type":"dn token","value":100663343},"count":34},{"address":{"type":"dn token","value":100663344},"count":12},{"address":{"type":"dn token","value":100663345},"count":15},{"address":{"type":"dn token","value":100663346},"count":9},{"address":{"type":"dn token","value":100663347},"count":11},{"address":{"type":"dn token","value":100663348},"count":34},{"address":{"type":"dn token","value":100663349},"count":13},{"address":{"type":"dn token","value":100663350},"count":15},{"address":{"type":"dn token","value":100663351},"count":9},{"address":{"type":"dn token","value":100663352},"count":11},{"address":{"type":"dn token","value":100663353},"count":34},{"address":{"type":"dn token","value":100663354},"count":12},{"address":{"type":"dn token","value":100663355},"count":15},{"address":{"type":"dn token","value":100663356},"count":9},{"address":{"type":"dn token","value":100663357},"count":11},{"address":{"type":"dn token","value":100663358},"count":34},{"address":{"type":"dn token","value":100663359},"count":12},{"address":{"type":"dn token","value":100663360},"count":15},{"address":{"type":"dn token","value":100663361},"count":13},{"address":{"type":"dn token","value":100663362},"count":12},{"address":{"type":"dn token","value":100663363},"count":15},{"address":{"type":"dn token","value":100663364},"count":16},{"address":{"type":"dn token","value":100663365},"count":15},{"address":{"type":"dn token","value":100663366},"count":9},{"address":{"type":"dn token","value":100663367},"count":11},{"address":{"type":"dn token","value":100663368},"count":34},{"address":{"type":"dn token","value":100663369},"count":12},{"address":{"type":"dn token","value":100663370},"count":15},{"address":{"type":"dn token","value":100663371},"count":9},{"address":{"type":"dn token","value":100663372},"count":11},{"address":{"type":"dn token","value":100663373},"count":12},{"address":{"type":"dn token","value":100663374},"count":34},{"address":{"type":"dn token","value":100663375},"count":14},{"address":{"type":"dn token","value":100663376},"count":15},{"address":{"type":"dn token","value":100663377},"count":9},{"address":{"type":"dn token","value":100663378},"count":23},{"address":{"type":"dn token","value":100663379},"count":30},{"address":{"type":"dn token","value":100663380},"count":15},{"address":{"type":"dn token","value":100663381},"count":9},{"address":{"type":"dn token","value":100663382},"count":11},{"address":{"type":"dn token","value":100663383},"count":23},{"address":{"type":"dn token","value":100663384},"count":16},{"address":{"type":"dn token","value":100663385},"count":16},{"address":{"type":"dn token","value":100663386},"count":15},{"address":{"type":"dn token","value":100663387},"count":9},{"address":{"type":"dn token","value":100663388},"count":23},{"address":{"type":"dn token","value":100663389},"count":12},{"address":{"type":"dn token","value":100663390},"count":8},{"address":{"type":"dn token","value":100663391},"count":15},{"address":{"type":"dn token","value":100663392},"count":9},{"address":{"type":"dn token","value":100663393},"count":23},{"address":{"type":"dn token","value":100663394},"count":14},{"address":{"type":"dn token","value":100663395},"count":41},{"address":{"type":"dn token","value":100663396},"count":22},{"address":{"type":"dn token","value":100663397},"count":9},{"address":{"type":"dn token","value":100663398},"count":23},{"address":{"type":"dn token","value":100663399},"count":12},{"address":{"type":"dn token","value":100663400},"count":14},{"address":{"type":"dn token","value":100663401},"count":13},{"address":{"type":"dn token","value":100663402},"count":14},{"address":{"type":"dn token","value":100663403},"count":13},{"address":{"type":"dn token","value":100663404},"count":23},{"address":{"type":"dn token","value":100663405},"count":18},{"address":{"type":"dn token","value":100663406},"count":13},{"address":{"type":"dn token","value":100663407},"count":15},{"address":{"type":"dn token","value":100663408},"count":9},{"address":{"type":"dn token","value":100663409},"count":4},{"address":{"type":"dn token","value":100663410},"count":11},{"address":{"type":"dn token","value":100663411},"count":31},{"address":{"type":"dn token","value":100663412},"count":9},{"address":{"type":"dn token","value":100663419},"count":8},{"address":{"type":"dn token","value":100663424},"count":8},{"address":{"type":"dn token","value":100663425},"count":81},{"address":{"type":"dn token","value":100663426},"count":17},{"address":{"type":"dn token","value":100663427},"count":20},{"address":{"type":"dn token","value":100663428},"count":41},{"address":{"type":"dn token","value":100663429},"count":41},{"address":{"type":"dn token","value":100663430},"count":17},{"address":{"type":"dn token","value":100663431},"count":34},{"address":{"type":"dn token","value":100663432},"count":24},{"address":{"type":"dn token","value":100663433},"count":21},{"address":{"type":"dn token","value":100663434},"count":61},{"address":{"type":"dn token","value":100663435},"count":9},{"address":{"type":"dn token","value":100663436},"count":36},{"address":{"type":"dn token","value":100663437},"count":10},{"address":{"type":"dn token","value":100663438},"count":9},{"address":{"type":"dn token","value":100663439},"count":12},{"address":{"type":"dn token","value":100663440},"count":39},{"address":{"type":"dn token","value":100663441},"count":34},{"address":{"type":"dn token","value":100663442},"count":9},{"address":{"type":"dn token","value":100663443},"count":9},{"address":{"type":"dn token","value":100663444},"count":26},{"address":{"type":"dn token","value":100663445},"count":26},{"address":{"type":"dn token","value":100663446},"count":114},{"address":{"type":"dn token","value":100663447},"count":35},{"address":{"type":"dn token","value":100663448},"count":35},{"address":{"type":"dn token","value":100663449},"count":15},{"address":{"type":"dn token","value":100663450},"count":31},{"address":{"type":"dn token","value":100663451},"count":39},{"address":{"type":"dn token","value":100663452},"count":10},{"address":{"type":"dn token","value":100663453},"count":9},{"address":{"type":"dn token","value":100663454},"count":14},{"address":{"type":"dn token","value":100663455},"count":19},{"address":{"type":"dn token","value":100663456},"count":40}]},"library_functions":[]}},"rules":{"create process on Windows":{"meta":{"name":"create process on Windows","namespace":"host-interaction/process/create","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x406DB0","Practical Malware Analysis Lab 01-04.exe_:0x4011FC","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create process on Windows\r\n    namespace: host-interaction/process/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Process [C0017]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: kernel32.WinExec\r\n      - api: kernel32.CreateProcess\r\n      - api: shell32.ShellExecute\r\n      - api: shell32.ShellExecuteEx\r\n      - api: advapi32.CreateProcessAsUser\r\n      - api: advapi32.CreateProcessWithLogon\r\n      - api: advapi32.CreateProcessWithToken\r\n      - api: kernel32.CreateProcessInternal\r\n      - api: ntdll.NtCreateUserProcess\r\n      - api: ntdll.NtCreateProcess\r\n      - api: ntdll.NtCreateProcessEx\r\n      - api: ntdll.ZwCreateProcess\r\n      - api: ZwCreateProcessEx\r\n      - api: ntdll.ZwCreateUserProcess\r\n      - api: ntdll.RtlCreateUserProcess\r\n      - api: System.Diagnostics.Process::Start\r\n","matches":[[{"type":"dn token","value":100663364},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663364,6]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,178]}],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open registry key\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Registry::Create Registry Key [C0036.004]\r\n      - Operating System::Registry::Open Registry Key [C0036.003]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\r\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\r\n      - 493167E85E45363D09495D0841C30648:0x404D60\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: advapi32.RegOpenKey\r\n      - api: advapi32.RegOpenKeyEx\r\n      - api: advapi32.RegCreateKey\r\n      - api: advapi32.RegCreateKeyEx\r\n      - api: advapi32.RegOpenCurrentUser\r\n      - api: advapi32.RegOpenKeyTransacted\r\n      - api: advapi32.RegOpenUserClassesRoot\r\n      - api: advapi32.RegCreateKeyTransacted\r\n      - api: ZwOpenKey\r\n      - api: ZwOpenKeyEx\r\n      - api: ZwCreateKey\r\n      - api: ZwOpenKeyTransacted\r\n      - api: ZwOpenKeyTransactedEx\r\n      - api: ZwCreateKeyTransacted\r\n      - api: NtOpenKey\r\n      - api: NtCreateKey\r\n      - api: SHRegOpenUSKey\r\n      - api: SHRegCreateUSKey\r\n      - api: RtlCreateRegistryKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\r\n","matches":[[{"type":"dn token","value":100663394},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663394,11]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create thread\r\n    namespace: host-interaction/thread/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Create Thread [C0038]\r\n    examples:\r\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.CreateThread\r\n          - api: _beginthread\r\n          - api: _beginthreadex\r\n          - api: PsCreateSystemThread\r\n          - api: SHCreateThread\r\n          - api: SHCreateThreadWithHandle\r\n          - api: kernel32.CreateRemoteThread\r\n          - api: kernel32.CreateRemoteThreadEx\r\n          - api: RtlCreateUserThread\r\n          - api: ntdll.NtCreateThread\r\n          - api: ntdll.NtCreateThreadEx\r\n          - api: ntdll.ZwCreateThread\r\n          - api: ntdll.ZwCreateThreadEx\r\n      - and:\r\n        - os: linux\r\n        - api: pthread_create\r\n      - and:\r\n        - api: System.Threading.Thread::Start\r\n        - optional:\r\n          - api: System.Threading.Thread::ctor\r\n","matches":[[{"type":"dn token","value":100663425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,224]},{"type":"dn token offset","value":[100663425,269]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,202]},{"type":"dn token offset","value":[100663425,247]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663431},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663431,74]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663431,58]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663436},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663436,84]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663436,47]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663444},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663444,65]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663444,48]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663445,65]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663445,48]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663450},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663450,80]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663450,48]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"suspend thread":{"meta":{"name":"suspend thread","namespace":"host-interaction/thread/suspend","authors":["0x534a@mailbox.org","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Suspend Thread"],"objective":"Process","behavior":"Suspend Thread","method":"","id":"C0055"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x502f4c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: suspend thread\r\n    namespace: host-interaction/thread/suspend\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Suspend Thread [C0055]\r\n    examples:\r\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x502f4c\r\n  features:\r\n    - or:\r\n      - api: kernel32.SuspendThread\r\n      - api: ntdll.NtSuspendThread\r\n      - api: ntdll.ZwSuspendThread\r\n      - api: System.Threading.Thread::Suspend\r\n      - api: System.Threading.Thread::Sleep\r\n","matches":[[{"type":"dn token","value":100663428},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663428,133]},{"type":"dn token offset","value":[100663428,120]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663429},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663429,120]},{"type":"dn token offset","value":[100663429,133]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663434},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663434,294]},{"type":"dn token offset","value":[100663434,285]},{"type":"dn token offset","value":[100663434,5]},{"type":"dn token offset","value":[100663434,187]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663439},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663439,1]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663441},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663441,105]}],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using Base64":{"meta":{"name":"encode data using Base64","namespace":"data-manipulation/encoding/base64","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Standard Algorithm","id":"E1027.m02"},{"parts":["Data","Encode Data","Base64"],"objective":"Data","behavior":"Encode Data","method":"Base64","id":"C0026.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C","074072B261FC27B65C72671F13510C05:0x100049B2","5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30","08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: encode data using Base64\r\n    namespace: data-manipulation/encoding/base64\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported\r\n    att&ck:\r\n      - Defense Evasion::Obfuscated Files or Information [T1027]\r\n    mbc:\r\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]\r\n      - Data::Encode Data::Base64 [C0026.001]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C\r\n      - 074072B261FC27B65C72671F13510C05:0x100049B2\r\n      - 5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - and:\r\n        - mnemonic: shl\r\n        - mnemonic: shr\r\n        - number: 0x3F = modulo 64\r\n        - or:\r\n          - number: 0x3D = '='\r\n          - number: 0x3D3D = '=='\r\n        - match: contain loop\r\n        - optional:\r\n          - number: 2\r\n          - number: 3\r\n          - number: 4\r\n          - number: 6\r\n          - number: 0xF\r\n          - string: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"\r\n      - api: System.Convert::ToBase64String\r\n      - api: System.Convert::ToBase64CharArray\r\n      - api: System.Convert::TryToBase64Chars\r\n","matches":[[{"type":"dn token","value":100663323},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663323,48]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663340,23]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663343},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663348},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663353},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663358},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663374},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663396},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663396,23]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,62]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,29]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,42]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,50]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data with MD5":{"meta":{"name":"hash data with MD5","namespace":"data-manipulation/hashing/md5","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","MD5"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"MD5","id":"C0029.001"}],"references":["https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x100108ED"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hash data with MD5\r\n    namespace: data-manipulation/hashing/md5\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Cryptography::Cryptographic Hash::MD5 [C0029.001]\r\n    references:\r\n      - https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x100108ED\r\n  features:\r\n    - or:\r\n      - and:\r\n        - description: magic initialization constants from MD4 and MD5\r\n        - number: 0x67452301 = A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - number: 0xefcdab89 = B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - number: 0x98badcfe = C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - number: 0x10325476 = D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\r\n        - not:\r\n          - number: 0xc3d2e1f0 = likely SHA1 but also used in RIPEMD-160 and RIPEMD-320\r\n        - optional:\r\n          - description: specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\r\n          - and:\r\n            - offset: -0x28955B88\r\n            - offset: -0x173848AA\r\n      - basic block:\r\n        - and:\r\n          - number: 0x8003 = CALG_MD5\r\n          - api: advapi32.CryptCreateHash\r\n      - call:\r\n        - and:\r\n          - number: 0x8003 = CALG_MD5\r\n          - api: advapi32.CryptCreateHash\r\n      - and:\r\n        - format: dotnet\r\n        - or:\r\n          - api: System.Security.Cryptography.MD5::Create\r\n          - api: System.Security.Cryptography.MD5CryptoServiceProvider::ctor\r\n        - optional:\r\n          - api: System.Security.Cryptography.HashAlgorithm::ComputeHash\r\n","matches":[[{"type":"dn token","value":100663325},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/e95cc69a3c214f429bf6b65124ab15ce"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/df8e90902d8c4a0096a53bcf79b56221"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5::Create"}},"children":[],"locations":[{"type":"dn token offset","value":[100663325,0]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5CryptoServiceProvider::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[{"type":"dn token offset","value":[100663325,20]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"magic initialization constants from MD4 and MD5"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1732584193,"description":"A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4023233417,"description":"B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2562383102,"description":"C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":271733878,"description":"D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3285377520,"description":"likely SHA1 but also used in RIPEMD-160 and RIPEMD-320"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-680876936}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-389564586}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"decode data using Base64 in .NET":{"meta":{"name":"decode data using Base64 in .NET","namespace":"data-manipulation/encoding/base64","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Deobfuscate/Decode Files or Information"],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","subtechnique":"","id":"T1140"}],"mbc":[{"parts":["Data","Decode Data","Base64"],"objective":"Data","behavior":"Decode Data","method":"Base64","id":"C0053.001"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: decode data using Base64 in .NET\r\n    namespace: data-manipulation/encoding/base64\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]\r\n    mbc:\r\n      - Data::Decode Data::Base64 [C0053.001]\r\n  features:\r\n    - or:\r\n      - api: System.Convert::FromBase64String\r\n      - api: System.Convert::FromBase64CharArray\r\n      - api: System.Convert::TryFromBase64Chars\r\n      - api: System.Convert::TryFromBase64String\r\n","matches":[[{"type":"dn token","value":100663331},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::FromBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663331,12]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::FromBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryFromBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryFromBase64String"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate files in .NET":{"meta":{"name":"enumerate files in .NET","namespace":"host-interaction/file-system/files/list","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":["https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b"],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate files in .NET\r\n    namespace: host-interaction/file-system/files/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    references:\r\n      - https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b\r\n  features:\r\n    - or:\r\n      - api: System.IO.DirectoryInfo::GetFiles\r\n      - api: System.IO.DirectoryInfo::EnumerateFiles\r\n      - api: System.IO.Directory::GetFiles\r\n      - api: System.IO.Directory::EnumerateFiles\r\n      - api: System.IO.Directory::EnumerateFileSystemEntries\r\n      - api: System.IO.DirectoryInfo::GetDirectories\r\n      - api: System.IO.DirectoryInfo::EnumerateDirectories\r\n      - api: System.IO.Directory::GetDirectories\r\n      - api: System.IO.Directory::EnumerateDirectories\r\n","matches":[[{"type":"dn token","value":100663338},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFileSystemEntries"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetDirectories"}},"children":[],"locations":[{"type":"dn token offset","value":[100663338,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663339},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetFiles"}},"children":[],"locations":[{"type":"dn token offset","value":[100663339,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFileSystemEntries"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file size":{"meta":{"name":"get file size","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["mimikatz.exe_:0x40630D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get file size\r\n    namespace: host-interaction/file-system/meta\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - mimikatz.exe_:0x40630D\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetFileSize\r\n      - api: kernel32.GetFileSizeEx\r\n      - property/read: System.IO.FileInfo::Length\r\n","matches":[[{"type":"dn token","value":100663339},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSizeEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileInfo::Length"}},"children":[],"locations":[{"type":"dn token offset","value":[100663339,64]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSizeEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileInfo::Length"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,599]}],"captures":{}}],"locations":[],"captures":{}}]]},"delete file":{"meta":{"name":"delete file","namespace":"host-interaction/file-system/delete","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Delete File"],"objective":"File System","behavior":"Delete File","method":"","id":"C0047"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x100015F0","31600AD0D1A7EA615690DF111AE36C73:0x401A15","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delete file\r\n    namespace: host-interaction/file-system/delete\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Delete File [C0047]\r\n    examples:\r\n      - 946A99F36A46D335DEC080D9A4371940:0x100015F0\r\n      # MoveFileEx\r\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401A15\r\n      # NtDeleteFile\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04\r\n  features:\r\n    - or:\r\n      - api: kernel32.DeleteFile\r\n      - api: DeleteFileTransacted\r\n      - api: NtDeleteFile\r\n      - api: ZwDeleteFile\r\n      - api: remove\r\n      - api: _wremove\r\n      - api: System.IO.File::Delete\r\n      - api: System.IO.FileSystemInfo::Delete\r\n      # static\r\n      - basic block:\r\n        - and:\r\n          - number: 3 = FO_DELETE\r\n          - or:\r\n            - api: kernel32.SHFileOperation\r\n      - basic block:\r\n        - and:\r\n          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT\r\n          - number: 0 = NULL\r\n          - api: MoveFileEx\r\n      # dynamic\r\n      - call:\r\n        - and:\r\n          - number: 3 = FO_DELETE\r\n          - or:\r\n            - api: kernel32.SHFileOperation\r\n      - call:\r\n        - and:\r\n          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT\r\n          - number: 0 = NULL\r\n          - api: MoveFileEx\r\n","matches":[[{"type":"dn token","value":100663344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DeleteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DeleteFileTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDeleteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwDeleteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"remove"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wremove"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Delete"}},"children":[],"locations":[{"type":"dn token offset","value":[100663344,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileSystemInfo::Delete"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/00aad03637c84e94bf55d202a2ee182b"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/151e22d3008641a6a149f42cd6607e2a"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/854ded870b144717becaec50462f13fe"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/a4b2ab1fb6e2462ea549774c9d42e3be"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delete directory":{"meta":{"name":"delete directory","namespace":"host-interaction/file-system/delete","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Delete Directory"],"objective":"File System","behavior":"Delete Directory","method":"","id":"C0048"}],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x10009236","AFB6EC3D721A5CB67863487B0E51A34C167F629CF701F8BC7A038C117B4DDA44:0x429AA0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delete directory\r\n    namespace: host-interaction/file-system/delete\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Delete Directory [C0048]\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x10009236\r\n      - AFB6EC3D721A5CB67863487B0E51A34C167F629CF701F8BC7A038C117B4DDA44:0x429AA0\r\n  features:\r\n    - or:\r\n      - api: RemoveDirectory\r\n      - api: RemoveDirectoryTransacted\r\n      - api: rmdir\r\n      - api: _rmdir\r\n      - api: _wrmdir\r\n      - api: System.IO.DirectoryInfo::Delete\r\n      - api: System.IO.Directory::Delete\r\n","matches":[[{"type":"dn token","value":100663349},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RemoveDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RemoveDirectoryTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"rmdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_rmdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wrmdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::Delete"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::Delete"}},"children":[],"locations":[{"type":"dn token offset","value":[100663349,7]}],"captures":{}}],"locations":[],"captures":{}}]]},"create directory":{"meta":{"name":"create directory","namespace":"host-interaction/file-system/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create Directory"],"objective":"File System","behavior":"Create Directory","method":"","id":"C0046"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x10008f62","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create directory\r\n    namespace: host-interaction/file-system/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Create Directory [C0046]\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x10008f62\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: kernel32.CreateDirectory\r\n      - api: kernel32.CreateDirectoryEx\r\n      - api: kernel32.CreateDirectoryTransacted\r\n      - api: NtCreateDirectoryObject\r\n      - api: ZwCreateDirectoryObject\r\n      - api: SHCreateDirectory\r\n      - api: SHCreateDirectoryEx\r\n      - api: mkdir\r\n      - api: _mkdir\r\n      - api: _wmkdir\r\n      - api: System.IO.Directory::CreateDirectory\r\n      - api: System.IO.DirectoryInfo::Create\r\n      - api: System.IO.DirectoryInfo::CreateSubdirectory\r\n","matches":[[{"type":"dn token","value":100663354},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wmkdir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::CreateDirectory"}},"children":[],"locations":[{"type":"dn token offset","value":[100663354,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::CreateSubdirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663403},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wmkdir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::CreateDirectory"}},"children":[],"locations":[{"type":"dn token offset","value":[100663403,19]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::CreateSubdirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry key":{"meta":{"name":"query or enumerate registry key","namespace":"host-interaction/registry","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Key","id":"C0036.005"}],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x404930","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query or enumerate registry key\r\n    namespace: host-interaction/registry\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Query Registry [T1012]\r\n    mbc:\r\n      - Operating System::Registry::Query Registry Key [C0036.005]\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x404930\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - match: create or open registry key\r\n      - or:\r\n        - api: advapi32.RegEnumKey\r\n        - api: advapi32.RegEnumKeyEx\r\n        - api: advapi32.RegQueryInfoKeyA\r\n        - api: ZwQueryKey\r\n        - api: ZwEnumerateKey\r\n        - api: NtQueryKey\r\n        - api: NtEnumerateKey\r\n        - api: RtlCheckRegistryKey\r\n        - api: SHEnumKeyEx\r\n        - api: SHQueryInfoKey\r\n        - api: SHRegEnumUSKey\r\n        - api: SHRegQueryInfoUSKey\r\n        - api: Microsoft.Win32.RegistryKey::GetSubKeyNames\r\n        - api: Microsoft.Win32.RegistryKey::OpenBaseKey\r\n        - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\r\n        - api: Microsoft.Win32.RegistryKey::OpenSubKey\r\n","matches":[[{"type":"dn token","value":100663394},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663394,11]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663394}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryInfoKeyA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCheckRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryInfoKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryInfoUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetSubKeyNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663394,11]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663395},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663395}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryInfoKeyA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCheckRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryInfoKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryInfoUSKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetSubKeyNames"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query or enumerate registry value\r\n    namespace: host-interaction/registry\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Query Registry [T1012]\r\n    mbc:\r\n      - Operating System::Registry::Query Registry Value [C0036.006]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - match: create or open registry key\r\n      - or:\r\n        - api: advapi32.RegGetValue\r\n        - api: advapi32.RegEnumValue\r\n        - api: advapi32.RegQueryValue\r\n        - api: advapi32.RegQueryValueEx\r\n        - api: advapi32.RegQueryMultipleValues\r\n        - api: ZwQueryValueKey\r\n        - api: ZwEnumerateValueKey\r\n        - api: NtQueryValueKey\r\n        - api: NtEnumerateValueKey\r\n        - api: RtlQueryRegistryValues\r\n        - api: SHGetValue\r\n        - api: SHEnumValue\r\n        - api: SHRegGetInt\r\n        - api: SHRegGetPath\r\n        - api: SHRegGetValue\r\n        - api: SHQueryValueEx\r\n        - api: SHRegGetUSValue\r\n        - api: SHOpenRegStream\r\n        - api: SHRegEnumUSValue\r\n        - api: SHOpenRegStream2\r\n        - api: SHRegQueryUSValue\r\n        - api: SHRegGetBoolUSValue\r\n        - api: SHRegGetValueFromHKCUHKLM\r\n        - api: SHRegGetBoolValueFromHKCUHKLM\r\n        - api: Microsoft.Win32.RegistryKey::GetValue\r\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\r\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\r\n        - api: Microsoft.Win32.Registry::GetValue\r\n","matches":[[{"type":"dn token","value":100663395},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663395}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,117]},{"type":"dn token offset","value":[100663395,141]},{"type":"dn token offset","value":[100663395,69]},{"type":"dn token offset","value":[100663395,93]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get common file path\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\r\n      - 972B219F18379907A045431303F4DA7D:0x404887\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetTempPath\r\n      - api: kernel32.GetTempFileName\r\n      - api: kernel32.GetSystemDirectory\r\n      - api: kernel32.GetWindowsDirectory\r\n      - api: kernel32.GetSystemWow64Directory\r\n      - api: GetAllUsersProfileDirectory\r\n      - api: GetAppContainerFolderPath\r\n      - api: GetCurrentDirectory\r\n      - api: GetDefaultUserProfileDirectory\r\n      - api: GetProfilesDirectory\r\n      - api: GetUserProfileDirectory\r\n      - api: SHGetFolderPathAndSubDir\r\n      - api: shell32.SHGetFolderPath\r\n      - api: shell32.SHGetFolderLocation\r\n      - api: shell32.SHGetKnownFolderPath\r\n      - api: shell32.SHGetSpecialFolderPath\r\n      - api: shell32.SHGetSpecialFolderLocation\r\n      - api: System.IO.Directory::GetCurrentDirectory\r\n      - api: System.Environment::GetFolderPath\r\n      - property/read: System.Environment::SystemDirectory\r\n      - property/read: System.Environment::CurrentDirectory\r\n","matches":[[{"type":"dn token","value":100663401},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[{"type":"dn token offset","value":[100663401,3]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if directory exists":{"meta":{"name":"check if directory exists","namespace":"host-interaction/file-system/exists","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check if directory exists\r\n    namespace: host-interaction/file-system/exists\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n  features:\r\n    - or:\r\n      - api: System.IO.Directory::Exists\r\n","matches":[[{"type":"dn token","value":100663403},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::Exists"}},"children":[],"locations":[{"type":"dn token offset","value":[100663403,6]}],"captures":{}}],"locations":[],"captures":{}}]]},"save image in .NET":{"meta":{"name":"save image in .NET","namespace":"collection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: save image in .NET\r\n    namespace: collection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires class features\r\n  features:\r\n    - and:\r\n      - api: System.Drawing.Image::Save\r\n      - optional:\r\n        - class: System.Drawing.Imaging.ImageFormat\r\n","matches":[[{"type":"dn token","value":100663405},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Drawing.Image::Save"}},"children":[],"locations":[{"type":"dn token offset","value":[100663405,17]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"class","class_":"System.Drawing.Imaging.ImageFormat"}},"children":[],"locations":[{"type":"dn token offset","value":[100663405,12]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"unmanaged call":{"meta":{"name":"unmanaged call","namespace":"runtime","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"managed code calls unmanaged (native) code, often seen in .NET","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: unmanaged call\r\n    namespace: runtime\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    description: managed code calls unmanaged (native) code, often seen in .NET\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported\r\n  features:\r\n    - or:\r\n      - characteristic: unmanaged call\r\n      - match: unmanaged call via dynamic PInvoke in .NET\r\n      - api: System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer\r\n","matches":[[{"type":"dn token","value":100663410},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"unmanaged call"}},"children":[],"locations":[{"type":"dn token offset","value":[100663410,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"unmanaged call via dynamic PInvoke in .NET"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663411},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"unmanaged call"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,117]},{"type":"dn token offset","value":[100663411,1]},{"type":"dn token offset","value":[100663411,78]},{"type":"dn token offset","value":[100663411,142]},{"type":"dn token offset","value":[100663411,125]},{"type":"dn token offset","value":[100663411,109]},{"type":"dn token offset","value":[100663411,99]},{"type":"dn token offset","value":[100663411,67]},{"type":"dn token offset","value":[100663411,57]},{"type":"dn token offset","value":[100663411,18]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"unmanaged call via dynamic PInvoke in .NET"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"capture screenshot":{"meta":{"name":"capture screenshot","namespace":"collection/screenshot","authors":["moritz.raabe@mandiant.com","@_re_fox","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Screen Capture"],"tactic":"Collection","technique":"Screen Capture","subtechnique":"","id":"T1113"}],"mbc":[{"parts":["Collection","Screen Capture","WinAPI"],"objective":"Collection","behavior":"Screen Capture","method":"WinAPI","id":"E1113.m01"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A","7204e3efc2434012e13ca939db0d0b02:0x414070","50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: capture screenshot\r\n    namespace: collection/screenshot\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - \"@_re_fox\"\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Collection::Screen Capture [T1113]\r\n    mbc:\r\n      - Collection::Screen Capture::WinAPI [E1113.m01]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A\r\n      - 7204e3efc2434012e13ca939db0d0b02:0x414070\r\n      - 50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07\r\n  features:\r\n    - or:\r\n      - and:\r\n        - or:\r\n          - api: user32.GetWindowDC\r\n          - api: user32.GetDC\r\n          - and:\r\n            - api: gdi32.CreateDC\r\n            - string: \"DISPLAY\"\r\n        - or:\r\n          - api: gdi32.BitBlt\r\n          - api: gdi32.GetDIBits\r\n        - api: gdi32.CreateCompatibleDC\r\n        - api: gdi32.CreateCompatibleBitmap\r\n        - optional:\r\n          - or:\r\n            - api: user32.GetSystemMetrics = fetch screen dimensions\r\n            - api: user32.GetDesktopWindow = get entire desktop\r\n      - basic block:\r\n        - and:\r\n          - api: BitBlt\r\n          - characteristic: tight loop\r\n      - call:\r\n        - and:\r\n          - api: BitBlt\r\n      - api: System.Drawing.Graphics::CopyFromScreen\r\n","matches":[[{"type":"dn token","value":100663411},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"capture screenshot/9ee783c47288450ebeb97bf84d4c54a7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"capture screenshot/4ce7328dc8d44c7790c81fc3ca46c643"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Drawing.Graphics::CopyFromScreen"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowDC"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDC"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDC"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"DISPLAY"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"BitBlt"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,99]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDIBits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateCompatibleDC"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,57]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateCompatibleBitmap"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,67]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemMetrics","description":"fetch screen dimensions"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDesktopWindow","description":"get entire desktop"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create a process with modified I/O handles and window":{"meta":{"name":"create a process with modified I/O handles and window","namespace":"host-interaction/process/create","authors":["matthew.williams@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":["https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa"],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x4011C0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create a process with modified I/O handles and window\r\n    namespace: host-interaction/process/create\r\n    authors:\r\n      - matthew.williams@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires property features\r\n    mbc:\r\n      - Process::Create Process [C0017]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa\r\n    examples:\r\n      - Practical Malware Analysis Lab 14-02.exe_:0x4011C0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - or:\r\n          - description: API functions that accept a pointer to a STARTUPINFO structure\r\n          - api: kernel32.CreateProcess\r\n          - api: kernel32.CreateProcessInternal\r\n          - api: advapi32.CreateProcessAsUser\r\n          - api: advapi32.CreateProcessWithLogon\r\n          - api: advapi32.CreateProcessWithToken\r\n        - number: 0x101 = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW\r\n          # STARTF_USESTDHANDLES indicates the hStdInput, hStdOutput, and hStdError members contain additional information\r\n          # STARTF_USESHOWWINDOW indicates the wShowWindow member contains additional information\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - number: 0x44 = StartupInfo.cb (size)\r\n          - and:\r\n            - arch: amd64\r\n            - number: 0x68 = StartupInfo.cb (size)\r\n          # STARTUPINFOEX size values not currently supported by this rule.\r\n        - optional:\r\n          - api: kernel32.GetStartupInfo\r\n      - and:\r\n        - api: System.Diagnostics.Process::Start\r\n        - or:\r\n          - property/write: System.Diagnostics.ProcessStartInfo::UseShellExecute\r\n          - property/write: System.Diagnostics.ProcessStartInfo::Verb\r\n          - property/write: System.Diagnostics.ProcessStartInfo::WindowStyle\r\n          - property/write: System.Diagnostics.ProcessStartInfo::WorkingDirectory\r\n          - property/write: System.Diagnostics.ProcessStartInfo::FileName\r\n          - property/write: System.Diagnostics.ProcessStartInfo::Arguments\r\n          - property/write: System.Diagnostics.ProcessStartInfo::CreateNoWindow\r\n          - property/write: System.Diagnostics.ProcessStartInfo::RedirectStandardOutput\r\n          - property/write: System.Diagnostics.ProcessStartInfo::RedirectStandardInput\r\n          - property/read: System.Diagnostics.Process::StandardOutput\r\n          - property/read: System.Diagnostics.Process::StandardInput\r\n","matches":[[{"type":"dn token","value":100663425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,178]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::UseShellExecute"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,122]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::Verb"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::WindowStyle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::WorkingDirectory"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,150]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::FileName"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,74]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::Arguments"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::CreateNoWindow"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,134]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::RedirectStandardOutput"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,98]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::RedirectStandardInput"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,86]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::StandardOutput"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::StandardInput"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"API functions that accept a pointer to a STARTUPINFO structure"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":257,"description":"STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"StartupInfo.cb (size)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":104,"description":"StartupInfo.cb (size)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetStartupInfo"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"act as TCP client":{"meta":{"name":"act as TCP client","namespace":"communication/tcp/client","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","TCP Client"],"objective":"Communication","behavior":"Socket Communication","method":"TCP Client","id":"C0001.008"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: act as TCP client\r\n    namespace: communication/tcp/client\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::Socket Communication::TCP Client [C0001.008]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - match: connect TCP socket\r\n      - api: System.Net.Sockets.TcpClient::ctor\r\n","matches":[[{"type":"dn token","value":100663434},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.TcpClient::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663434,38]}],"captures":{}}],"locations":[],"captures":{}}]]},"send request in .NET":{"meta":{"name":"send request in .NET","namespace":"communication/http/client","authors":["anushka.virgaonakr@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Command and Control","Application Layer Protocol","Web Protocols"],"tactic":"Command and Control","technique":"Application Layer Protocol","subtechnique":"Web Protocols","id":"T1071.001"}],"mbc":[{"parts":["Communication","HTTP Communication","Send Request"],"objective":"Communication","behavior":"HTTP Communication","method":"Send Request","id":"C0002.003"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send request in .NET\r\n    namespace: communication/http/client\r\n    authors:\r\n      - anushka.virgaonakr@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Command and Control::Application Layer Protocol::Web Protocols [T1071.001]\r\n    mbc:\r\n      - Communication::HTTP Communication::Send Request [C0002.003]\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: System.Net.WebRequest::GetRequestStream\r\n        - api: System.Net.WebRequest::GetRequestStreamAsync\r\n        - and:\r\n          - api: System.Net.WebRequest::BeginGetRequestStream\r\n          - api: System.Net.WebRequest::EndGetRequestStream\r\n      - api: System.IO.Stream::Write\r\n      - api: System.IO.Stream::Close\r\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Stream::Write"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,833]},{"type":"dn token offset","value":[100663446,788]},{"type":"dn token offset","value":[100663446,688]},{"type":"dn token offset","value":[100663446,1122]},{"type":"dn token offset","value":[100663446,1212]},{"type":"dn token offset","value":[100663446,977]},{"type":"dn token offset","value":[100663446,1108]},{"type":"dn token offset","value":[100663446,802]},{"type":"dn token offset","value":[100663446,847]},{"type":"dn token offset","value":[100663446,1181]},{"type":"dn token offset","value":[100663446,991]},{"type":"dn token offset","value":[100663446,1049]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Stream::Close"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1226]},{"type":"dn token offset","value":[100663446,1279]},{"type":"dn token offset","value":[100663446,1077]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetRequestStream"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,672]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetRequestStreamAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::BeginGetRequestStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::EndGetRequestStream"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send HTTP request":{"meta":{"name":"send HTTP request","namespace":"communication/http/client","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","HTTP Communication","Send Request"],"objective":"Communication","behavior":"HTTP Communication","method":"Send Request","id":"C0002.003"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60","6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100026E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send HTTP request\r\n    namespace: communication/http/client\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::HTTP Communication::Send Request [C0002.003]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\r\n      - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100026E0\r\n  features:\r\n    - or:\r\n      - api: System.Net.WebRequest::GetResponse\r\n      - api: System.Net.WebRequest::GetResponseAsync\r\n      - and:\r\n        - or:\r\n          - api: wininet.HttpOpenRequest\r\n          - api: wininet.InternetConnect\r\n        - or:\r\n          - api: wininet.HttpSendRequest\r\n          - api: wininet.HttpSendRequestEx\r\n      - and:\r\n        - api: winhttp.WinHttpSendRequest\r\n        - api: winhttp.WinHttpWriteData\r\n        - optional:\r\n          - or:\r\n            - api: winhttp.WinHttpOpenRequest\r\n            - api: winhttp.WinHttpConnect\r\n      - and:\r\n        - match: send data on socket\r\n        - string: /HTTP/i\r\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create HTTP request":{"meta":{"name":"create HTTP request","namespace":"communication/http/client","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","HTTP Communication","Create Request"],"objective":"Communication","behavior":"HTTP Communication","method":"Create Request","id":"C0002.012"}],"references":[],"examples":["6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create HTTP request\r\n    namespace: communication/http/client\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::HTTP Communication::Create Request [C0002.012]\r\n    examples:\r\n      - 6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: wininet.InternetOpen\r\n        - api: System.Net.WebRequest::Create\r\n        - api: System.Net.WebRequest::CreateDefault\r\n        - api: System.Net.WebRequest::CreateHttp\r\n      - optional:\r\n        - api: wininet.InternetCloseHandle\r\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetCloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetOpen"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::Create"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,7]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateDefault"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateHttp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetCloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetOpen"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::Create"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,110]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateDefault"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateHttp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send data":{"meta":{"name":"send data","namespace":"communication","authors":["william.ballenthin@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Command and Control","C2 Communication","Send Data"],"objective":"Command and Control","behavior":"C2 Communication","method":"Send Data","id":"B0030.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60"],"description":"all known techniques for sending data to a potential C2 server","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send data\r\n    namespace: communication\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - joakim@intezer.com\r\n    description: all known techniques for sending data to a potential C2 server\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Command and Control::C2 Communication::Send Data [B0030.001]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - match: send HTTP request\r\n          - match: send data on socket\r\n          - match: send file via HTTP\r\n          - match: send data to Internet\r\n      - and:\r\n        - os: linux\r\n        - or: # Require network bound socket.\r\n          - match: create TCP socket\r\n          - match: create UDP socket\r\n        - or:\r\n          - match: send HTTP request\r\n          - match: send data on socket\r\n          - match: send file via HTTP\r\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data to Internet"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create UDP socket"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663451}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data to Internet"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create UDP socket"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663451}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"receive HTTP response":{"meta":{"name":"receive HTTP response","namespace":"communication/http/client","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","HTTP Communication","Get Response"],"objective":"Communication","behavior":"HTTP Communication","method":"Get Response","id":"C0002.017"}],"references":[],"examples":["6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002790"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: receive HTTP response\r\n    namespace: communication/http/client\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::HTTP Communication::Get Response [C0002.017]\r\n    examples:\r\n      - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002790\r\n  features:\r\n    - or:\r\n      - api: System.Net.WebRequest::GetResponse\r\n      - api: winhttp.WinHttpReceiveResponse\r\n      - and:\r\n        - api: winhttp.WinHttpReadData\r\n        - optional:\r\n          - api: winhttp.WinHttpQueryDataAvailable\r\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReceiveResponse"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReadData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpQueryDataAvailable"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReceiveResponse"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReadData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpQueryDataAvailable"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set web proxy in .NET":{"meta":{"name":"set web proxy in .NET","namespace":"communication/http","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set web proxy in .NET\r\n    namespace: communication/http\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires property features\r\n  features:\r\n    - and:\r\n      - property/write: System.Net.WebRequest::Proxy\r\n      - optional:\r\n        - api: System.Net.WebProxy::ctor\r\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Net.WebRequest::Proxy"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,32]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebProxy::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if file exists":{"meta":{"name":"check if file exists","namespace":"host-interaction/file-system/exists","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["31600AD0D1A7EA615690DF111AE36C73:0x401284"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check if file exists\r\n    namespace: host-interaction/file-system/exists\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\r\n  features:\r\n    - or:\r\n      - basic block:\r\n        - and:\r\n          - api: kernel32.GetFileAttributes\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\r\n      - basic block:\r\n        - and:\r\n          - api: kernel32.GetLastError\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 2 = ERROR_FILE_NOT_FOUND\r\n      - api: shlwapi.PathFileExists\r\n      - api: System.IO.File::Exists\r\n      - property/read: System.IO.FileSystemInfo::Exists\r\n","matches":[[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/71a9ac3378a549dd8a00a31dc1eeb180"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/a039fdffa08040fabf99312614f547a5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,82]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"manipulate console buffer":{"meta":{"name":"manipulate console buffer","namespace":"host-interaction/console","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Operating System","Console"],"objective":"Operating System","behavior":"Console","method":"","id":"C0033"}],"references":["https://stackoverflow.com/a/15770935/87207"],"examples":["3aa7ee4d67f562933bc998f352b1f319:0x705413A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: manipulate console buffer\r\n    namespace: host-interaction/console\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Operating System::Console [C0033]\r\n    references:\r\n      - https://stackoverflow.com/a/15770935/87207\r\n    examples:\r\n      - 3aa7ee4d67f562933bc998f352b1f319:0x705413A0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - or:\r\n          - api: kernel32.SetConsoleCursorPosition\r\n          - api: kernel32.ReadConsoleOutputCharacter\r\n          - api: kernel32.WriteConsoleOutputCharacter\r\n          - api: kernel32.WriteConsoleOutput\r\n          - api: kernel32.WriteConsoleInput\r\n        - optional:\r\n          - api: kernel32.GetStdHandle\r\n          - number: 0xfffffff5 = STD_OUTPUT_HANDLE\r\n      - api: System.Console::Write\r\n      - api: System.Console::WriteLine\r\n","matches":[[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Console::Write"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Console::WriteLine"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,44]}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SetConsoleCursorPosition"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadConsoleOutputCharacter"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteConsoleOutputCharacter"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteConsoleOutput"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteConsoleInput"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetStdHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967285,"description":"STD_OUTPUT_HANDLE"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"compiled to the .NET platform":{"meta":{"name":"compiled to the .NET platform","namespace":"runtime/dotnet","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["b9f5bd514485fb06da39beff051b9fdc"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: compiled to the .NET platform\r\n    namespace: runtime/dotnet\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    examples:\r\n      - b9f5bd514485fb06da39beff051b9fdc\r\n  features:\r\n    - or:\r\n      - format: dotnet\r\n      - import: mscoree._CorExeMain\r\n      - import: mscoree._corexemain\r\n      - import: mscoree._CorDllMain\r\n      - import: mscoree._cordllmain\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._CorExeMain"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._corexemain"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._CorDllMain"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._cordllmain"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
+{"meta":{"timestamp":"2024-06-10T17:53:06.351939","version":"7.0.1","argv":["./tests/data/dotnet/1c444ebeba24dcba8628b7dfe5fec7c6.exe_","--json"],"sample":{"md5":"1c444ebeba24dcba8628b7dfe5fec7c6","sha1":"ebdec120fbbdbff28ebd6accc85d05f7ccabf461","sha256":"a9f9e5a30cc858dc135ec428cdd68cb06143732e5c62c4dc4b359c8abc11d74b","path":"/Users/fariss/Desktop/capa/tests/data/dotnet/1c444ebeba24dcba8628b7dfe5fec7c6.exe_"},"flavor":"static","analysis":{"format":"dotnet","arch":"any","os":"any","extractor":"DnfileFeatureExtractor","rules":["/Users/fariss/Desktop/capa/rules"],"base_address":{"type":"no address"},"layout":{"functions":[{"address":{"type":"dn token","value":100663316},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663316}}]},{"address":{"type":"dn token","value":100663336},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663336}}]},{"address":{"type":"dn token","value":100663339},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663339}}]},{"address":{"type":"dn token","value":100663343},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663343}}]},{"address":{"type":"dn token","value":100663348},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663348}}]},{"address":{"type":"dn token","value":100663353},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663353}}]},{"address":{"type":"dn token","value":100663358},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663358}}]},{"address":{"type":"dn token","value":100663364},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663364}}]},{"address":{"type":"dn token","value":100663368},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663368}}]},{"address":{"type":"dn token","value":100663373},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663373}}]},{"address":{"type":"dn token","value":100663374},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663374}}]},{"address":{"type":"dn token","value":100663378},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663378}}]},{"address":{"type":"dn token","value":100663379},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663379}}]},{"address":{"type":"dn token","value":100663383},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663383}}]},{"address":{"type":"dn token","value":100663388},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663388}}]},{"address":{"type":"dn token","value":100663393},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663393}}]},{"address":{"type":"dn token","value":100663394},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663394}}]},{"address":{"type":"dn token","value":100663395},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663395}}]},{"address":{"type":"dn token","value":100663398},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663398}}]},{"address":{"type":"dn token","value":100663425},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663425}}]},{"address":{"type":"dn token","value":100663428},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663428}}]},{"address":{"type":"dn token","value":100663429},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663429}}]},{"address":{"type":"dn token","value":100663431},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663431}}]},{"address":{"type":"dn token","value":100663434},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663434}}]},{"address":{"type":"dn token","value":100663436},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663436}}]},{"address":{"type":"dn token","value":100663439},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663439}}]},{"address":{"type":"dn token","value":100663441},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663441}}]},{"address":{"type":"dn token","value":100663444},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663444}}]},{"address":{"type":"dn token","value":100663445},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663445}}]},{"address":{"type":"dn token","value":100663446},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663446}}]},{"address":{"type":"dn token","value":100663450},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663450}}]},{"address":{"type":"dn token","value":100663456},"matched_basic_blocks":[{"address":{"type":"dn token","value":100663456}}]}]},"feature_counts":{"file":1245,"functions":[{"address":{"type":"dn token","value":100663297},"count":8},{"address":{"type":"dn token","value":100663298},"count":8},{"address":{"type":"dn token","value":100663299},"count":28},{"address":{"type":"dn token","value":100663300},"count":17},{"address":{"type":"dn token","value":100663301},"count":15},{"address":{"type":"dn token","value":100663302},"count":40},{"address":{"type":"dn token","value":100663303},"count":5},{"address":{"type":"dn token","value":100663304},"count":15},{"address":{"type":"dn token","value":100663305},"count":15},{"address":{"type":"dn token","value":100663306},"count":15},{"address":{"type":"dn token","value":100663307},"count":15},{"address":{"type":"dn token","value":100663308},"count":15},{"address":{"type":"dn token","value":100663309},"count":15},{"address":{"type":"dn token","value":100663310},"count":15},{"address":{"type":"dn token","value":100663311},"count":9},{"address":{"type":"dn token","value":100663312},"count":32},{"address":{"type":"dn token","value":100663313},"count":14},{"address":{"type":"dn token","value":100663314},"count":13},{"address":{"type":"dn token","value":100663315},"count":13},{"address":{"type":"dn token","value":100663316},"count":15},{"address":{"type":"dn token","value":100663317},"count":10},{"address":{"type":"dn token","value":100663318},"count":13},{"address":{"type":"dn token","value":100663319},"count":10},{"address":{"type":"dn token","value":100663320},"count":10},{"address":{"type":"dn token","value":100663321},"count":9},{"address":{"type":"dn token","value":100663322},"count":8},{"address":{"type":"dn token","value":100663323},"count":29},{"address":{"type":"dn token","value":100663324},"count":15},{"address":{"type":"dn token","value":100663325},"count":28},{"address":{"type":"dn token","value":100663326},"count":8},{"address":{"type":"dn token","value":100663327},"count":14},{"address":{"type":"dn token","value":100663328},"count":269},{"address":{"type":"dn token","value":100663329},"count":8},{"address":{"type":"dn token","value":100663330},"count":19},{"address":{"type":"dn token","value":100663331},"count":18},{"address":{"type":"dn token","value":100663332},"count":16},{"address":{"type":"dn token","value":100663333},"count":11},{"address":{"type":"dn token","value":100663334},"count":10},{"address":{"type":"dn token","value":100663335},"count":11},{"address":{"type":"dn token","value":100663336},"count":34},{"address":{"type":"dn token","value":100663337},"count":14},{"address":{"type":"dn token","value":100663338},"count":24},{"address":{"type":"dn token","value":100663339},"count":33},{"address":{"type":"dn token","value":100663340},"count":22},{"address":{"type":"dn token","value":100663341},"count":9},{"address":{"type":"dn token","value":100663342},"count":11},{"address":{"type":"dn token","value":100663343},"count":34},{"address":{"type":"dn token","value":100663344},"count":12},{"address":{"type":"dn token","value":100663345},"count":15},{"address":{"type":"dn token","value":100663346},"count":9},{"address":{"type":"dn token","value":100663347},"count":11},{"address":{"type":"dn token","value":100663348},"count":34},{"address":{"type":"dn token","value":100663349},"count":13},{"address":{"type":"dn token","value":100663350},"count":15},{"address":{"type":"dn token","value":100663351},"count":9},{"address":{"type":"dn token","value":100663352},"count":11},{"address":{"type":"dn token","value":100663353},"count":34},{"address":{"type":"dn token","value":100663354},"count":12},{"address":{"type":"dn token","value":100663355},"count":15},{"address":{"type":"dn token","value":100663356},"count":9},{"address":{"type":"dn token","value":100663357},"count":11},{"address":{"type":"dn token","value":100663358},"count":34},{"address":{"type":"dn token","value":100663359},"count":12},{"address":{"type":"dn token","value":100663360},"count":15},{"address":{"type":"dn token","value":100663361},"count":13},{"address":{"type":"dn token","value":100663362},"count":12},{"address":{"type":"dn token","value":100663363},"count":15},{"address":{"type":"dn token","value":100663364},"count":16},{"address":{"type":"dn token","value":100663365},"count":15},{"address":{"type":"dn token","value":100663366},"count":9},{"address":{"type":"dn token","value":100663367},"count":11},{"address":{"type":"dn token","value":100663368},"count":34},{"address":{"type":"dn token","value":100663369},"count":12},{"address":{"type":"dn token","value":100663370},"count":15},{"address":{"type":"dn token","value":100663371},"count":9},{"address":{"type":"dn token","value":100663372},"count":11},{"address":{"type":"dn token","value":100663373},"count":12},{"address":{"type":"dn token","value":100663374},"count":34},{"address":{"type":"dn token","value":100663375},"count":14},{"address":{"type":"dn token","value":100663376},"count":15},{"address":{"type":"dn token","value":100663377},"count":9},{"address":{"type":"dn token","value":100663378},"count":23},{"address":{"type":"dn token","value":100663379},"count":30},{"address":{"type":"dn token","value":100663380},"count":15},{"address":{"type":"dn token","value":100663381},"count":9},{"address":{"type":"dn token","value":100663382},"count":11},{"address":{"type":"dn token","value":100663383},"count":23},{"address":{"type":"dn token","value":100663384},"count":16},{"address":{"type":"dn token","value":100663385},"count":16},{"address":{"type":"dn token","value":100663386},"count":15},{"address":{"type":"dn token","value":100663387},"count":9},{"address":{"type":"dn token","value":100663388},"count":23},{"address":{"type":"dn token","value":100663389},"count":12},{"address":{"type":"dn token","value":100663390},"count":8},{"address":{"type":"dn token","value":100663391},"count":15},{"address":{"type":"dn token","value":100663392},"count":9},{"address":{"type":"dn token","value":100663393},"count":23},{"address":{"type":"dn token","value":100663394},"count":14},{"address":{"type":"dn token","value":100663395},"count":41},{"address":{"type":"dn token","value":100663396},"count":22},{"address":{"type":"dn token","value":100663397},"count":9},{"address":{"type":"dn token","value":100663398},"count":23},{"address":{"type":"dn token","value":100663399},"count":12},{"address":{"type":"dn token","value":100663400},"count":14},{"address":{"type":"dn token","value":100663401},"count":13},{"address":{"type":"dn token","value":100663402},"count":14},{"address":{"type":"dn token","value":100663403},"count":13},{"address":{"type":"dn token","value":100663404},"count":23},{"address":{"type":"dn token","value":100663405},"count":18},{"address":{"type":"dn token","value":100663406},"count":13},{"address":{"type":"dn token","value":100663407},"count":15},{"address":{"type":"dn token","value":100663408},"count":9},{"address":{"type":"dn token","value":100663409},"count":4},{"address":{"type":"dn token","value":100663410},"count":11},{"address":{"type":"dn token","value":100663411},"count":31},{"address":{"type":"dn token","value":100663412},"count":9},{"address":{"type":"dn token","value":100663419},"count":8},{"address":{"type":"dn token","value":100663424},"count":8},{"address":{"type":"dn token","value":100663425},"count":81},{"address":{"type":"dn token","value":100663426},"count":17},{"address":{"type":"dn token","value":100663427},"count":20},{"address":{"type":"dn token","value":100663428},"count":41},{"address":{"type":"dn token","value":100663429},"count":41},{"address":{"type":"dn token","value":100663430},"count":17},{"address":{"type":"dn token","value":100663431},"count":34},{"address":{"type":"dn token","value":100663432},"count":24},{"address":{"type":"dn token","value":100663433},"count":21},{"address":{"type":"dn token","value":100663434},"count":61},{"address":{"type":"dn token","value":100663435},"count":9},{"address":{"type":"dn token","value":100663436},"count":36},{"address":{"type":"dn token","value":100663437},"count":10},{"address":{"type":"dn token","value":100663438},"count":9},{"address":{"type":"dn token","value":100663439},"count":12},{"address":{"type":"dn token","value":100663440},"count":39},{"address":{"type":"dn token","value":100663441},"count":34},{"address":{"type":"dn token","value":100663442},"count":9},{"address":{"type":"dn token","value":100663443},"count":9},{"address":{"type":"dn token","value":100663444},"count":26},{"address":{"type":"dn token","value":100663445},"count":26},{"address":{"type":"dn token","value":100663446},"count":114},{"address":{"type":"dn token","value":100663447},"count":35},{"address":{"type":"dn token","value":100663448},"count":35},{"address":{"type":"dn token","value":100663449},"count":15},{"address":{"type":"dn token","value":100663450},"count":31},{"address":{"type":"dn token","value":100663451},"count":39},{"address":{"type":"dn token","value":100663452},"count":10},{"address":{"type":"dn token","value":100663453},"count":9},{"address":{"type":"dn token","value":100663454},"count":14},{"address":{"type":"dn token","value":100663455},"count":19},{"address":{"type":"dn token","value":100663456},"count":40}]},"library_functions":[],"apicall_count":442,"import_count":184}},"rules":{"create process on Windows":{"meta":{"name":"create process on Windows","namespace":"host-interaction/process/create","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x406DB0","Practical Malware Analysis Lab 01-04.exe_:0x4011FC","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create process on Windows\n    namespace: host-interaction/process/create\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Create Process [C0017]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: kernel32.WinExec\n      - api: kernel32.CreateProcess\n      - api: shell32.ShellExecute\n      - api: shell32.ShellExecuteEx\n      - api: advapi32.CreateProcessAsUser\n      - api: advapi32.CreateProcessWithLogon\n      - api: advapi32.CreateProcessWithToken\n      - api: kernel32.CreateProcessInternal\n      - api: ntdll.NtCreateUserProcess\n      - api: ntdll.NtCreateProcess\n      - api: ntdll.NtCreateProcessEx\n      - api: ntdll.ZwCreateProcess\n      - api: ZwCreateProcessEx\n      - api: ntdll.ZwCreateUserProcess\n      - api: ntdll.RtlCreateUserProcess\n      - api: System.Diagnostics.Process::Start\n","matches":[[{"type":"dn token","value":100663364},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663364,6]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,178]}],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open registry key\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Operating System::Registry::Create Registry Key [C0036.004]\n      - Operating System::Registry::Open Registry Key [C0036.003]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\n      - 493167E85E45363D09495D0841C30648:0x404D60\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: advapi32.RegOpenKey\n      - api: advapi32.RegOpenKeyEx\n      - api: advapi32.RegCreateKey\n      - api: advapi32.RegCreateKeyEx\n      - api: advapi32.RegOpenCurrentUser\n      - api: advapi32.RegOpenKeyTransacted\n      - api: advapi32.RegOpenUserClassesRoot\n      - api: advapi32.RegCreateKeyTransacted\n      - api: ZwOpenKey\n      - api: ZwOpenKeyEx\n      - api: ZwCreateKey\n      - api: ZwOpenKeyTransacted\n      - api: ZwOpenKeyTransactedEx\n      - api: ZwCreateKeyTransacted\n      - api: NtOpenKey\n      - api: NtCreateKey\n      - api: SHRegOpenUSKey\n      - api: SHRegCreateUSKey\n      - api: RtlCreateRegistryKey\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\n","matches":[[{"type":"dn token","value":100663394},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663394,11]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create thread\n    namespace: host-interaction/thread/create\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Create Thread [C0038]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.CreateThread\n          - api: _beginthread\n          - api: _beginthreadex\n          - api: PsCreateSystemThread\n          - api: SHCreateThread\n          - api: SHCreateThreadWithHandle\n          - api: kernel32.CreateRemoteThread\n          - api: kernel32.CreateRemoteThreadEx\n          - api: RtlCreateUserThread\n          - api: ntdll.NtCreateThread\n          - api: ntdll.NtCreateThreadEx\n          - api: ntdll.ZwCreateThread\n          - api: ntdll.ZwCreateThreadEx\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - api: pthread_create\n      - and:\n        - api: System.Threading.Thread::Start\n        - optional:\n          - api: System.Threading.Thread::ctor\n","matches":[[{"type":"dn token","value":100663425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[{"type":"no address"}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,224]},{"type":"dn token offset","value":[100663425,269]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,202]},{"type":"dn token offset","value":[100663425,247]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663431},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[{"type":"no address"}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663431,74]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663431,58]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663436},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[{"type":"no address"}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663436,84]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663436,47]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663444},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[{"type":"no address"}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663444,65]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663444,48]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[{"type":"no address"}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663445,65]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663445,48]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663450},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[{"type":"no address"}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663450,80]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663450,48]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"suspend thread":{"meta":{"name":"suspend thread","namespace":"host-interaction/thread/suspend","authors":["0x534a@mailbox.org","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Suspend Thread"],"objective":"Process","behavior":"Suspend Thread","method":"","id":"C0055"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x502f4c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: suspend thread\n    namespace: host-interaction/thread/suspend\n    authors:\n      - 0x534a@mailbox.org\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Suspend Thread [C0055]\n    examples:\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x502f4c\n  features:\n    - or:\n      - api: kernel32.SuspendThread\n      - api: ntdll.NtSuspendThread\n      - api: ntdll.ZwSuspendThread\n      - api: System.Threading.Thread::Suspend\n      - api: System.Threading.Thread::Sleep\n","matches":[[{"type":"dn token","value":100663428},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663428,133]},{"type":"dn token offset","value":[100663428,120]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663429},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663429,120]},{"type":"dn token offset","value":[100663429,133]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663434},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663434,294]},{"type":"dn token offset","value":[100663434,285]},{"type":"dn token offset","value":[100663434,5]},{"type":"dn token offset","value":[100663434,187]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663439},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663439,1]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663441},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSuspendThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Suspend"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Sleep"}},"children":[],"locations":[{"type":"dn token offset","value":[100663441,105]}],"captures":{}}],"locations":[],"captures":{}}]]},"encode data using Base64":{"meta":{"name":"encode data using Base64","namespace":"data-manipulation/encoding/base64","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Defense Evasion","Obfuscated Files or Information"],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","subtechnique":"","id":"T1027"}],"mbc":[{"parts":["Defense Evasion","Obfuscated Files or Information","Encoding-Standard Algorithm"],"objective":"Defense Evasion","behavior":"Obfuscated Files or Information","method":"Encoding-Standard Algorithm","id":"E1027.m02"},{"parts":["Data","Encode Data","Base64"],"objective":"Data","behavior":"Encode Data","method":"Base64","id":"C0026.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C","074072B261FC27B65C72671F13510C05:0x100049B2","5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30","08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: encode data using Base64\n    namespace: data-manipulation/encoding/base64\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported\n    att&ck:\n      - Defense Evasion::Obfuscated Files or Information [T1027]\n    mbc:\n      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]\n      - Data::Encode Data::Base64 [C0026.001]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C\n      - 074072B261FC27B65C72671F13510C05:0x100049B2\n      - 5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - and:\n        - mnemonic: shl\n        - mnemonic: shr\n        - number: 0x3F = modulo 64\n        - or:\n          - number: 0x3D = '='\n          - number: 0x3D3D = '=='\n        - match: contain loop\n        - optional:\n          - number: 2\n          - number: 3\n          - number: 4\n          - number: 6\n          - number: 0xF\n          - string: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"\n      - api: System.Convert::ToBase64String\n      - api: System.Convert::ToBase64CharArray\n      - api: System.Convert::TryToBase64Chars\n","matches":[[{"type":"dn token","value":100663323},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663323,48]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663336,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663340,23]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663343},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663343,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663348},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663348,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663353},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663353,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663358},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663358,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663368,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663374},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,64]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,30]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,47]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[{"type":"dn token offset","value":[100663374,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663396},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663396,23]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,62]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::ToBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryToBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shl"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"shr"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":63,"description":"modulo 64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":61,"description":"'='"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15677,"description":"'=='"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,29]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,42]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4}},"children":[],"locations":[{"type":"dn token offset","value":[100663456,50]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":6}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"hash data with MD5":{"meta":{"name":"hash data with MD5","namespace":"data-manipulation/hashing/md5","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Cryptography","Cryptographic Hash","MD5"],"objective":"Cryptography","behavior":"Cryptographic Hash","method":"MD5","id":"C0029.001"}],"references":["https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x100108ED"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hash data with MD5\n    namespace: data-manipulation/hashing/md5\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Cryptography::Cryptographic Hash::MD5 [C0029.001]\n    references:\n      - https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x100108ED\n  features:\n    - or:\n      - and:\n        - description: magic initialization constants from MD4 and MD5\n        - number: 0x67452301 = A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - number: 0xefcdab89 = B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - number: 0x98badcfe = C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - number: 0x10325476 = D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320\n        - not:\n          - number: 0xc3d2e1f0 = likely SHA1 but also used in RIPEMD-160 and RIPEMD-320\n        - optional:\n          - description: specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp\n          - and:\n            - offset: -0x28955B88\n            - offset: -0x173848AA\n      - basic block:\n        - and:\n          - number: 0x8003 = CALG_MD5\n          - api: advapi32.CryptCreateHash\n      - call:\n        - and:\n          - number: 0x8003 = CALG_MD5\n          - api: advapi32.CryptCreateHash\n      - and:\n        - format: dotnet\n        - or:\n          - api: System.Security.Cryptography.MD5::Create\n          - api: System.Security.Cryptography.MD5CryptoServiceProvider::ctor\n        - optional:\n          - api: System.Security.Cryptography.HashAlgorithm::ComputeHash\n","matches":[[{"type":"dn token","value":100663325},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/dbb535ceb9c740369f1b0bfbe3b22a97"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"hash data with MD5/62df64d4453044639ee23ad3e036fd38"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5::Create"}},"children":[],"locations":[{"type":"dn token offset","value":[100663325,0]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.MD5CryptoServiceProvider::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Security.Cryptography.HashAlgorithm::ComputeHash"}},"children":[],"locations":[{"type":"dn token offset","value":[100663325,20]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"magic initialization constants from MD4 and MD5"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1732584193,"description":"A, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4023233417,"description":"B, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2562383102,"description":"C, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":271733878,"description":"D, also used in SHA1, RIPEMD-128, RIPEMD-160, RIPEMD-256, and RIPEMD-320"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":3285377520,"description":"likely SHA1 but also used in RIPEMD-160 and RIPEMD-320"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional","description":"specific compilation from https://github.com/rwfpl/rewolf-x86-virtualizer/blob/master/src/test_app/main.cpp"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-680876936}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":-389564586}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"decode data using Base64 in .NET":{"meta":{"name":"decode data using Base64 in .NET","namespace":"data-manipulation/encoding/base64","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Deobfuscate/Decode Files or Information"],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","subtechnique":"","id":"T1140"}],"mbc":[{"parts":["Data","Decode Data","Base64"],"objective":"Data","behavior":"Decode Data","method":"Base64","id":"C0053.001"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: decode data using Base64 in .NET\n    namespace: data-manipulation/encoding/base64\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]\n    mbc:\n      - Data::Decode Data::Base64 [C0053.001]\n  features:\n    - or:\n      - api: System.Convert::FromBase64String\n      - api: System.Convert::FromBase64CharArray\n      - api: System.Convert::TryFromBase64Chars\n      - api: System.Convert::TryFromBase64String\n","matches":[[{"type":"dn token","value":100663331},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::FromBase64String"}},"children":[],"locations":[{"type":"dn token offset","value":[100663331,12]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::FromBase64CharArray"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryFromBase64Chars"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Convert::TryFromBase64String"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate files in .NET":{"meta":{"name":"enumerate files in .NET","namespace":"host-interaction/file-system/files/list","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":["https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b"],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate files in .NET\n    namespace: host-interaction/file-system/files/list\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    references:\n      - https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b\n  features:\n    - or:\n      - api: System.IO.DirectoryInfo::GetFiles\n      - api: System.IO.DirectoryInfo::EnumerateFiles\n      - api: System.IO.Directory::GetFiles\n      - api: System.IO.Directory::EnumerateFiles\n      - api: System.IO.Directory::EnumerateFileSystemEntries\n      - api: System.IO.DirectoryInfo::GetDirectories\n      - api: System.IO.DirectoryInfo::EnumerateDirectories\n      - api: System.IO.Directory::GetDirectories\n      - api: System.IO.Directory::EnumerateDirectories\n","matches":[[{"type":"dn token","value":100663338},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFileSystemEntries"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetDirectories"}},"children":[],"locations":[{"type":"dn token offset","value":[100663338,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663339},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetFiles"}},"children":[],"locations":[{"type":"dn token offset","value":[100663339,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFiles"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateFileSystemEntries"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::GetDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetDirectories"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::EnumerateDirectories"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file size":{"meta":{"name":"get file size","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["mimikatz.exe_:0x40630D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get file size\n    namespace: host-interaction/file-system/meta\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - mimikatz.exe_:0x40630D\n  features:\n    - or:\n      - api: kernel32.GetFileSize\n      - api: kernel32.GetFileSizeEx\n      - property/read: System.IO.FileInfo::Length\n","matches":[[{"type":"dn token","value":100663339},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSizeEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileInfo::Length"}},"children":[],"locations":[{"type":"dn token offset","value":[100663339,64]}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSizeEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileInfo::Length"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,599]}],"captures":{}}],"locations":[],"captures":{}}]]},"delete file":{"meta":{"name":"delete file","namespace":"host-interaction/file-system/delete","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Delete File"],"objective":"File System","behavior":"Delete File","method":"","id":"C0047"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x100015F0","31600AD0D1A7EA615690DF111AE36C73:0x401A15","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delete file\n    namespace: host-interaction/file-system/delete\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Delete File [C0047]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x100015F0\n      # MoveFileEx\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401A15\n      # NtDeleteFile\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04\n  features:\n    - or:\n      - api: kernel32.DeleteFile\n      - api: DeleteFileTransacted\n      - api: NtDeleteFile\n      - api: ZwDeleteFile\n      - api: remove\n      - api: _wremove\n      - api: System.IO.File::Delete\n      - api: System.IO.FileSystemInfo::Delete\n      # static\n      - basic block:\n        - and:\n          - number: 3 = FO_DELETE\n          - or:\n            - api: kernel32.SHFileOperation\n      - basic block:\n        - and:\n          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT\n          - number: 0 = NULL\n          - api: MoveFileEx\n      # dynamic\n      - call:\n        - and:\n          - number: 3 = FO_DELETE\n          - or:\n            - api: kernel32.SHFileOperation\n      - call:\n        - and:\n          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT\n          - number: 0 = NULL\n          - api: MoveFileEx\n","matches":[[{"type":"dn token","value":100663344},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DeleteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DeleteFileTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDeleteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwDeleteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"remove"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wremove"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Delete"}},"children":[],"locations":[{"type":"dn token offset","value":[100663344,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileSystemInfo::Delete"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/8c2077ffcfc84eb49c7d6450ab473b5e"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/aba93d8242924b23aaf3cd8f456519d4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/75d52d9cd49742a6aa690552852b0c6d"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"delete file/4e0e4820afa24bca9a81002740c0f904"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delete directory":{"meta":{"name":"delete directory","namespace":"host-interaction/file-system/delete","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Delete Directory"],"objective":"File System","behavior":"Delete Directory","method":"","id":"C0048"}],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x10009236","AFB6EC3D721A5CB67863487B0E51A34C167F629CF701F8BC7A038C117B4DDA44:0x429AA0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delete directory\n    namespace: host-interaction/file-system/delete\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - File System::Delete Directory [C0048]\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x10009236\n      - AFB6EC3D721A5CB67863487B0E51A34C167F629CF701F8BC7A038C117B4DDA44:0x429AA0\n  features:\n    - or:\n      - api: RemoveDirectory\n      - api: RemoveDirectoryTransacted\n      - api: rmdir\n      - api: _rmdir\n      - api: _wrmdir\n      - api: System.IO.DirectoryInfo::Delete\n      - api: System.IO.Directory::Delete\n","matches":[[{"type":"dn token","value":100663349},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RemoveDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RemoveDirectoryTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"rmdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_rmdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wrmdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::Delete"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::Delete"}},"children":[],"locations":[{"type":"dn token offset","value":[100663349,7]}],"captures":{}}],"locations":[],"captures":{}}]]},"create directory":{"meta":{"name":"create directory","namespace":"host-interaction/file-system/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create Directory"],"objective":"File System","behavior":"Create Directory","method":"","id":"C0046"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x10008f62","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create directory\n    namespace: host-interaction/file-system/create\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - File System::Create Directory [C0046]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x10008f62\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: kernel32.CreateDirectory\n      - api: kernel32.CreateDirectoryEx\n      - api: kernel32.CreateDirectoryTransacted\n      - api: NtCreateDirectoryObject\n      - api: ZwCreateDirectoryObject\n      - api: SHCreateDirectory\n      - api: SHCreateDirectoryEx\n      - api: mkdir\n      - api: _mkdir\n      - api: _wmkdir\n      - api: System.IO.Directory::CreateDirectory\n      - api: System.IO.DirectoryInfo::Create\n      - api: System.IO.DirectoryInfo::CreateSubdirectory\n","matches":[[{"type":"dn token","value":100663354},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wmkdir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::CreateDirectory"}},"children":[],"locations":[{"type":"dn token offset","value":[100663354,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::CreateSubdirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663403},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDirectoryTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateDirectoryObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateDirectoryEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_mkdir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_wmkdir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::CreateDirectory"}},"children":[],"locations":[{"type":"dn token offset","value":[100663403,19]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::Create"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.DirectoryInfo::CreateSubdirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry key":{"meta":{"name":"query or enumerate registry key","namespace":"host-interaction/registry","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Key","id":"C0036.005"}],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x404930","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query or enumerate registry key\n    namespace: host-interaction/registry\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Key [C0036.005]\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x404930\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegEnumKey\n        - api: advapi32.RegEnumKeyEx\n        - api: advapi32.RegQueryInfoKeyA\n        - api: ZwQueryKey\n        - api: ZwEnumerateKey\n        - api: NtQueryKey\n        - api: NtEnumerateKey\n        - api: RtlCheckRegistryKey\n        - api: SHEnumKeyEx\n        - api: SHQueryInfoKey\n        - api: SHRegEnumUSKey\n        - api: SHRegQueryInfoUSKey\n        - api: Microsoft.Win32.RegistryKey::GetSubKeyNames\n        - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n        - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n        - api: Microsoft.Win32.RegistryKey::OpenSubKey\n","matches":[[{"type":"dn token","value":100663394},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663394,11]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663394}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryInfoKeyA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCheckRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryInfoKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryInfoUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetSubKeyNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663394,11]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663395},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663395}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryInfoKeyA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCheckRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryInfoKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryInfoUSKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetSubKeyNames"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,6]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query or enumerate registry value\n    namespace: host-interaction/registry\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Value [C0036.006]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegGetValue\n        - api: advapi32.RegEnumValue\n        - api: advapi32.RegQueryValue\n        - api: advapi32.RegQueryValueEx\n        - api: advapi32.RegQueryMultipleValues\n        - api: ZwQueryValueKey\n        - api: ZwEnumerateValueKey\n        - api: NtQueryValueKey\n        - api: NtEnumerateValueKey\n        - api: RtlQueryRegistryValues\n        - api: SHGetValue\n        - api: SHEnumValue\n        - api: SHRegGetInt\n        - api: SHRegGetPath\n        - api: SHRegGetValue\n        - api: SHQueryValueEx\n        - api: SHRegGetUSValue\n        - api: SHOpenRegStream\n        - api: SHRegEnumUSValue\n        - api: SHOpenRegStream2\n        - api: SHRegQueryUSValue\n        - api: SHRegGetBoolUSValue\n        - api: SHRegGetValueFromHKCUHKLM\n        - api: SHRegGetBoolValueFromHKCUHKLM\n        - api: Microsoft.Win32.RegistryKey::GetValue\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\n        - api: Microsoft.Win32.Registry::GetValue\n","matches":[[{"type":"dn token","value":100663395},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663395}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[{"type":"dn token offset","value":[100663395,117]},{"type":"dn token offset","value":[100663395,141]},{"type":"dn token offset","value":[100663395,69]},{"type":"dn token offset","value":[100663395,93]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get common file path\n    namespace: host-interaction/file-system\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\n      - 972B219F18379907A045431303F4DA7D:0x404887\n  features:\n    - or:\n      - api: kernel32.GetTempPath\n      - api: kernel32.GetTempFileName\n      - api: kernel32.GetSystemDirectory\n      - api: kernel32.GetWindowsDirectory\n      - api: kernel32.GetSystemWow64Directory\n      - api: GetAllUsersProfileDirectory\n      - api: GetAppContainerFolderPath\n      - api: GetCurrentDirectory\n      - api: GetDefaultUserProfileDirectory\n      - api: GetProfilesDirectory\n      - api: GetUserProfileDirectory\n      - api: SHGetFolderPathAndSubDir\n      - api: shell32.SHGetFolderPath\n      - api: shell32.SHGetFolderLocation\n      - api: shell32.SHGetKnownFolderPath\n      - api: shell32.SHGetSpecialFolderPath\n      - api: shell32.SHGetSpecialFolderLocation\n      - api: System.IO.Directory::GetCurrentDirectory\n      - api: System.Environment::GetFolderPath\n      - property/read: System.Environment::SystemDirectory\n      - property/read: System.Environment::CurrentDirectory\n","matches":[[{"type":"dn token","value":100663401},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[{"type":"dn token offset","value":[100663401,3]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if directory exists":{"meta":{"name":"check if directory exists","namespace":"host-interaction/file-system/exists","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check if directory exists\n    namespace: host-interaction/file-system/exists\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n  features:\n    - or:\n      - api: System.IO.Directory::Exists\n","matches":[[{"type":"dn token","value":100663403},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::Exists"}},"children":[],"locations":[{"type":"dn token offset","value":[100663403,6]}],"captures":{}}],"locations":[],"captures":{}}]]},"save image in .NET":{"meta":{"name":"save image in .NET","namespace":"collection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: save image in .NET\n    namespace: collection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires class features\n  features:\n    - and:\n      - api: System.Drawing.Image::Save\n      - optional:\n        - class: System.Drawing.Imaging.ImageFormat\n","matches":[[{"type":"dn token","value":100663405},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Drawing.Image::Save"}},"children":[],"locations":[{"type":"dn token offset","value":[100663405,17]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"class","class_":"System.Drawing.Imaging.ImageFormat"}},"children":[],"locations":[{"type":"dn token offset","value":[100663405,12]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"unmanaged call":{"meta":{"name":"unmanaged call","namespace":"runtime","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"managed code calls unmanaged (native) code, often seen in .NET","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: unmanaged call\n    namespace: runtime\n    authors:\n      - michael.hunhoff@mandiant.com\n    description: managed code calls unmanaged (native) code, often seen in .NET\n    scopes:\n      static: function\n      dynamic: unsupported\n  features:\n    - or:\n      - characteristic: unmanaged call\n      - match: unmanaged call via dynamic PInvoke in .NET\n      - api: System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer\n","matches":[[{"type":"dn token","value":100663410},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"unmanaged call"}},"children":[],"locations":[{"type":"dn token offset","value":[100663410,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"unmanaged call via dynamic PInvoke in .NET"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663411},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"unmanaged call"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,117]},{"type":"dn token offset","value":[100663411,1]},{"type":"dn token offset","value":[100663411,78]},{"type":"dn token offset","value":[100663411,142]},{"type":"dn token offset","value":[100663411,125]},{"type":"dn token offset","value":[100663411,109]},{"type":"dn token offset","value":[100663411,99]},{"type":"dn token offset","value":[100663411,67]},{"type":"dn token offset","value":[100663411,57]},{"type":"dn token offset","value":[100663411,18]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"unmanaged call via dynamic PInvoke in .NET"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"capture screenshot":{"meta":{"name":"capture screenshot","namespace":"collection/screenshot","authors":["moritz.raabe@mandiant.com","@_re_fox","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Screen Capture"],"tactic":"Collection","technique":"Screen Capture","subtechnique":"","id":"T1113"}],"mbc":[{"parts":["Collection","Screen Capture","WinAPI"],"objective":"Collection","behavior":"Screen Capture","method":"WinAPI","id":"E1113.m01"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A","7204e3efc2434012e13ca939db0d0b02:0x414070","50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: capture screenshot\n    namespace: collection/screenshot\n    authors:\n      - moritz.raabe@mandiant.com\n      - \"@_re_fox\"\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Screen Capture [T1113]\n    mbc:\n      - Collection::Screen Capture::WinAPI [E1113.m01]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A\n      - 7204e3efc2434012e13ca939db0d0b02:0x414070\n      - 50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07\n  features:\n    - or:\n      - and:\n        - or:\n          - api: user32.GetWindowDC\n          - api: user32.GetDC\n          - and:\n            - api: gdi32.CreateDC\n            - string: \"DISPLAY\"\n        - or:\n          - api: gdi32.BitBlt\n          - api: gdi32.GetDIBits\n        - api: gdi32.CreateCompatibleDC\n        - api: gdi32.CreateCompatibleBitmap\n        - optional:\n          - or:\n            - api: user32.GetSystemMetrics = fetch screen dimensions\n            - api: user32.GetDesktopWindow = get entire desktop\n      - basic block:\n        - and:\n          - api: BitBlt\n          - characteristic: tight loop\n      - call:\n        - and:\n          - api: BitBlt\n      - api: System.Drawing.Graphics::CopyFromScreen\n","matches":[[{"type":"dn token","value":100663411},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"capture screenshot/3aa5a9d1b0394744bc940a2697cee009"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"capture screenshot/232c124d98b94b2dba305ee15f365ec4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Drawing.Graphics::CopyFromScreen"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowDC"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,1]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDC"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateDC"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"DISPLAY"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"BitBlt"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,99]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDIBits"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateCompatibleDC"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,57]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateCompatibleBitmap"}},"children":[],"locations":[{"type":"dn token offset","value":[100663411,67]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemMetrics","description":"fetch screen dimensions"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDesktopWindow","description":"get entire desktop"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create a process with modified I/O handles and window":{"meta":{"name":"create a process with modified I/O handles and window","namespace":"host-interaction/process/create","authors":["matthew.williams@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":["https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa"],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x4011C0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create a process with modified I/O handles and window\n    namespace: host-interaction/process/create\n    authors:\n      - matthew.williams@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires property features\n    mbc:\n      - Process::Create Process [C0017]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa\n    examples:\n      - Practical Malware Analysis Lab 14-02.exe_:0x4011C0\n  features:\n    - or:\n      - and:\n        - or:\n          - description: API functions that accept a pointer to a STARTUPINFO structure\n          - api: kernel32.CreateProcess\n          - api: kernel32.CreateProcessInternal\n          - api: advapi32.CreateProcessAsUser\n          - api: advapi32.CreateProcessWithLogon\n          - api: advapi32.CreateProcessWithToken\n        - number: 0x101 = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW\n          # STARTF_USESTDHANDLES indicates the hStdInput, hStdOutput, and hStdError members contain additional information\n          # STARTF_USESHOWWINDOW indicates the wShowWindow member contains additional information\n        - or:\n          - and:\n            - arch: i386\n            - number: 0x44 = StartupInfo.cb (size)\n          - and:\n            - arch: amd64\n            - number: 0x68 = StartupInfo.cb (size)\n          # STARTUPINFOEX size values not currently supported by this rule.\n        - optional:\n          - api: kernel32.GetStartupInfo\n      - and:\n        - api: System.Diagnostics.Process::Start\n        - or:\n          - property/write: System.Diagnostics.ProcessStartInfo::UseShellExecute\n          - property/write: System.Diagnostics.ProcessStartInfo::Verb\n          - property/write: System.Diagnostics.ProcessStartInfo::WindowStyle\n          - property/write: System.Diagnostics.ProcessStartInfo::WorkingDirectory\n          - property/write: System.Diagnostics.ProcessStartInfo::FileName\n          - property/write: System.Diagnostics.ProcessStartInfo::Arguments\n          - property/write: System.Diagnostics.ProcessStartInfo::CreateNoWindow\n          - property/write: System.Diagnostics.ProcessStartInfo::RedirectStandardOutput\n          - property/write: System.Diagnostics.ProcessStartInfo::RedirectStandardInput\n          - property/read: System.Diagnostics.Process::StandardOutput\n          - property/read: System.Diagnostics.Process::StandardInput\n","matches":[[{"type":"dn token","value":100663425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,178]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::UseShellExecute"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,122]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::Verb"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::WindowStyle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::WorkingDirectory"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,150]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::FileName"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,74]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::Arguments"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::CreateNoWindow"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,134]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::RedirectStandardOutput"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,98]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Diagnostics.ProcessStartInfo::RedirectStandardInput"}},"children":[],"locations":[{"type":"dn token offset","value":[100663425,86]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::StandardOutput"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::StandardInput"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"API functions that accept a pointer to a STARTUPINFO structure"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":257,"description":"STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"StartupInfo.cb (size)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":104,"description":"StartupInfo.cb (size)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetStartupInfo"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"act as TCP client":{"meta":{"name":"act as TCP client","namespace":"communication/tcp/client","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","TCP Client"],"objective":"Communication","behavior":"Socket Communication","method":"TCP Client","id":"C0001.008"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: act as TCP client\n    namespace: communication/tcp/client\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::Socket Communication::TCP Client [C0001.008]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - match: connect TCP socket\n      - api: System.Net.Sockets.TcpClient::ctor\n","matches":[[{"type":"dn token","value":100663434},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.TcpClient::ctor"}},"children":[],"locations":[{"type":"dn token offset","value":[100663434,38]}],"captures":{}}],"locations":[],"captures":{}}]]},"create HTTP request":{"meta":{"name":"create HTTP request","namespace":"communication/http/client","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","HTTP Communication","Create Request"],"objective":"Communication","behavior":"HTTP Communication","method":"Create Request","id":"C0002.012"}],"references":[],"examples":["6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create HTTP request\n    namespace: communication/http/client\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::HTTP Communication::Create Request [C0002.012]\n    examples:\n      - 6f99a2c8944cb02ff28c6f9ced59b161:0x40E2F0\n  features:\n    - and:\n      - or:\n        - api: wininet.InternetOpen\n        - api: System.Net.WebRequest::Create\n        - api: System.Net.WebRequest::CreateDefault\n        - api: System.Net.WebRequest::CreateHttp\n      - optional:\n        - api: wininet.InternetCloseHandle\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetCloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetOpen"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::Create"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,7]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateDefault"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateHttp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetCloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetOpen"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::Create"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,110]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateDefault"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::CreateHttp"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"receive HTTP response":{"meta":{"name":"receive HTTP response","namespace":"communication/http/client","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","HTTP Communication","Get Response"],"objective":"Communication","behavior":"HTTP Communication","method":"Get Response","id":"C0002.017"}],"references":[],"examples":["6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002790"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: receive HTTP response\n    namespace: communication/http/client\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::HTTP Communication::Get Response [C0002.017]\n    examples:\n      - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10002790\n  features:\n    - or:\n      - api: System.Net.WebRequest::GetResponse\n      - api: winhttp.WinHttpReceiveResponse\n      - and:\n        - api: winhttp.WinHttpReadData\n        - optional:\n          - api: winhttp.WinHttpQueryDataAvailable\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReceiveResponse"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReadData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpQueryDataAvailable"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReceiveResponse"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpReadData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpQueryDataAvailable"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send HTTP request":{"meta":{"name":"send HTTP request","namespace":"communication/http/client","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","HTTP Communication","Send Request"],"objective":"Communication","behavior":"HTTP Communication","method":"Send Request","id":"C0002.003"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60","6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100026E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send HTTP request\n    namespace: communication/http/client\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::HTTP Communication::Send Request [C0002.003]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\n      - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100026E0\n  features:\n    - or:\n      - api: System.Net.WebRequest::GetResponse\n      - api: System.Net.WebRequest::GetResponseAsync\n      - and:\n        - or:\n          - api: wininet.HttpOpenRequest\n          - api: wininet.InternetConnect\n        - or:\n          - api: wininet.HttpSendRequest\n          - api: wininet.HttpSendRequestEx\n      - and:\n        - api: winhttp.WinHttpSendRequest\n        - api: winhttp.WinHttpWriteData\n        - optional:\n          - or:\n            - api: winhttp.WinHttpOpenRequest\n            - api: winhttp.WinHttpConnect\n      - and:\n        - match: send data on socket\n        - string: /HTTP/i\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set web proxy in .NET":{"meta":{"name":"set web proxy in .NET","namespace":"communication/http","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set web proxy in .NET\n    namespace: communication/http\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires property features\n  features:\n    - and:\n      - property/write: System.Net.WebRequest::Proxy\n      - optional:\n        - api: System.Net.WebProxy::ctor\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.Net.WebRequest::Proxy"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,32]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebProxy::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send request in .NET":{"meta":{"name":"send request in .NET","namespace":"communication/http/client","authors":["anushka.virgaonakr@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Command and Control","Application Layer Protocol","Web Protocols"],"tactic":"Command and Control","technique":"Application Layer Protocol","subtechnique":"Web Protocols","id":"T1071.001"}],"mbc":[{"parts":["Communication","HTTP Communication","Send Request"],"objective":"Communication","behavior":"HTTP Communication","method":"Send Request","id":"C0002.003"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send request in .NET\n    namespace: communication/http/client\n    authors:\n      - anushka.virgaonakr@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Command and Control::Application Layer Protocol::Web Protocols [T1071.001]\n    mbc:\n      - Communication::HTTP Communication::Send Request [C0002.003]\n  features:\n    - and:\n      - or:\n        - api: System.Net.WebRequest::GetRequestStream\n        - api: System.Net.WebRequest::GetRequestStreamAsync\n        - and:\n          - api: System.Net.WebRequest::BeginGetRequestStream\n          - api: System.Net.WebRequest::EndGetRequestStream\n      - api: System.IO.Stream::Write\n      - api: System.IO.Stream::Close\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Stream::Write"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,833]},{"type":"dn token offset","value":[100663446,788]},{"type":"dn token offset","value":[100663446,688]},{"type":"dn token offset","value":[100663446,1122]},{"type":"dn token offset","value":[100663446,1212]},{"type":"dn token offset","value":[100663446,977]},{"type":"dn token offset","value":[100663446,1108]},{"type":"dn token offset","value":[100663446,802]},{"type":"dn token offset","value":[100663446,847]},{"type":"dn token offset","value":[100663446,1181]},{"type":"dn token offset","value":[100663446,991]},{"type":"dn token offset","value":[100663446,1049]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Stream::Close"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1226]},{"type":"dn token offset","value":[100663446,1279]},{"type":"dn token offset","value":[100663446,1077]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetRequestStream"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,672]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetRequestStreamAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::BeginGetRequestStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::EndGetRequestStream"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send data":{"meta":{"name":"send data","namespace":"communication","authors":["william.ballenthin@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Command and Control","C2 Communication","Send Data"],"objective":"Command and Control","behavior":"C2 Communication","method":"Send Data","id":"B0030.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60"],"description":"all known techniques for sending data to a potential C2 server","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send data\n    namespace: communication\n    authors:\n      - william.ballenthin@mandiant.com\n      - joakim@intezer.com\n    description: all known techniques for sending data to a potential C2 server\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Command and Control::C2 Communication::Send Data [B0030.001]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - match: send HTTP request\n          - match: send data on socket\n          - match: send file via HTTP\n          - match: send data to Internet\n      - and:\n        - os: linux\n        - or: # Require network bound socket.\n          - match: create TCP socket\n          - match: create UDP socket\n        - or:\n          - match: send HTTP request\n          - match: send data on socket\n          - match: send file via HTTP\n","matches":[[{"type":"dn token","value":100663446},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data to Internet"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create UDP socket"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663446,1232]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663446}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663451}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data to Internet"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create UDP socket"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponse"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,124]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.WebRequest::GetResponseAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HTTP/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"InternetConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"HttpSendRequestEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpSendRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpWriteData"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpOpenRequest"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinHttpConnect"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"dn token","value":100663451}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"manipulate console buffer":{"meta":{"name":"manipulate console buffer","namespace":"host-interaction/console","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Operating System","Console"],"objective":"Operating System","behavior":"Console","method":"","id":"C0033"}],"references":["https://stackoverflow.com/a/15770935/87207"],"examples":["3aa7ee4d67f562933bc998f352b1f319:0x705413A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: manipulate console buffer\n    namespace: host-interaction/console\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Operating System::Console [C0033]\n    references:\n      - https://stackoverflow.com/a/15770935/87207\n    examples:\n      - 3aa7ee4d67f562933bc998f352b1f319:0x705413A0\n  features:\n    - or:\n      - and:\n        - or:\n          - api: kernel32.SetConsoleCursorPosition\n          - api: kernel32.ReadConsoleOutputCharacter\n          - api: kernel32.WriteConsoleOutputCharacter\n          - api: kernel32.WriteConsoleOutput\n          - api: kernel32.WriteConsoleInput\n        - optional:\n          - api: kernel32.GetStdHandle\n          - number: 0xfffffff5 = STD_OUTPUT_HANDLE\n      - api: System.Console::Write\n      - api: System.Console::WriteLine\n","matches":[[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Console::Write"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.Console::WriteLine"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,44]}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SetConsoleCursorPosition"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadConsoleOutputCharacter"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteConsoleOutputCharacter"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteConsoleOutput"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteConsoleInput"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetStdHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":4294967285,"description":"STD_OUTPUT_HANDLE"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if file exists":{"meta":{"name":"check if file exists","namespace":"host-interaction/file-system/exists","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["31600AD0D1A7EA615690DF111AE36C73:0x401284"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check if file exists\n    namespace: host-interaction/file-system/exists\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\n  features:\n    - or:\n      - basic block:\n        - and:\n          - api: kernel32.GetFileAttributes\n          - instruction:\n            - mnemonic: cmp\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\n      - basic block:\n        - and:\n          - api: kernel32.GetLastError\n          - instruction:\n            - mnemonic: cmp\n            - number: 2 = ERROR_FILE_NOT_FOUND\n      - api: shlwapi.PathFileExists\n      - api: System.IO.File::Exists\n      - property/read: System.IO.FileSystemInfo::Exists\n","matches":[[{"type":"dn token","value":100663451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/99984aed10134456a7f15c6d92f7f288"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/af5a8a8f525441788ddd714f50ef21c1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[{"type":"dn token offset","value":[100663451,82]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"compiled to the .NET platform":{"meta":{"name":"compiled to the .NET platform","namespace":"runtime/dotnet","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["b9f5bd514485fb06da39beff051b9fdc"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: compiled to the .NET platform\n    namespace: runtime/dotnet\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - b9f5bd514485fb06da39beff051b9fdc\n  features:\n    - or:\n      - format: dotnet\n      - import: mscoree._CorExeMain\n      - import: mscoree._corexemain\n      - import: mscoree._CorDllMain\n      - import: mscoree._cordllmain\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"format","format":"dotnet"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._CorExeMain"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._corexemain"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._CorDllMain"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"import","import_":"mscoree._cordllmain"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
diff --git a/rd/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_.json b/rd/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_.json
index 26d3865..569641e 100644
--- a/rd/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_.json
+++ b/rd/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_.json
@@ -1 +1 @@
-{"meta":{"timestamp":"2024-03-02T04:04:35.501894","version":"7.0.1","argv":["./tests/data/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_","-j"],"sample":{"md5":"3f3bbcf8fd90bdcdcdc5494314ed4225","sha1":"ff1c877db4d0b6a37f4ba5d7b4bd4b3b980eddef","sha256":"ebe09a6ef73a572f7a19d2e1eccd8f5d1895ae2730e67a060d008a2703ab3ec2","path":"C:/Users/HP/Documents/GitHub/capa/tests/data/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"i386","os":"windows","extractor":"VivisectFeatureExtractor","rules":["C:/Users/HP/Documents/GitHub/capa/rules"],"base_address":{"type":"absolute","value":4194304},"layout":{"functions":[{"address":{"type":"absolute","value":4198784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4198864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198864}},{"address":{"type":"absolute","value":4198903}},{"address":{"type":"absolute","value":4198964}},{"address":{"type":"absolute","value":4198994}},{"address":{"type":"absolute","value":4199016}},{"address":{"type":"absolute","value":4199057}},{"address":{"type":"absolute","value":4199070}},{"address":{"type":"absolute","value":4199120}},{"address":{"type":"absolute","value":4199138}}]},{"address":{"type":"absolute","value":4199200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199200}}]},{"address":{"type":"absolute","value":4199392},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199392}}]},{"address":{"type":"absolute","value":4199520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199520}},{"address":{"type":"absolute","value":4199541}}]},{"address":{"type":"absolute","value":4199568},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199568}},{"address":{"type":"absolute","value":4199589}}]},{"address":{"type":"absolute","value":4199616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199616}},{"address":{"type":"absolute","value":4199640}}]},{"address":{"type":"absolute","value":4199680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199680}}]},{"address":{"type":"absolute","value":4200000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200021}},{"address":{"type":"absolute","value":4200113}}]},{"address":{"type":"absolute","value":4200144},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200161}}]},{"address":{"type":"absolute","value":4200192},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200274}}]},{"address":{"type":"absolute","value":4200352},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200352}},{"address":{"type":"absolute","value":4200557}},{"address":{"type":"absolute","value":4200662}},{"address":{"type":"absolute","value":4200673}},{"address":{"type":"absolute","value":4200684}},{"address":{"type":"absolute","value":4200729}},{"address":{"type":"absolute","value":4200896}}]},{"address":{"type":"absolute","value":4200960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200960}}]},{"address":{"type":"absolute","value":4201456},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201456}}]},{"address":{"type":"absolute","value":4201744},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201744}},{"address":{"type":"absolute","value":4201779}}]},{"address":{"type":"absolute","value":4201856},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201856}},{"address":{"type":"absolute","value":4201891}}]},{"address":{"type":"absolute","value":4201952},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201952}}]},{"address":{"type":"absolute","value":4202016},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202016}}]},{"address":{"type":"absolute","value":4202304},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202304}}]},{"address":{"type":"absolute","value":4202912},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202912}},{"address":{"type":"absolute","value":4202942}}]},{"address":{"type":"absolute","value":4202976},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202976}}]},{"address":{"type":"absolute","value":4203104},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203157}}]},{"address":{"type":"absolute","value":4203280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203372}},{"address":{"type":"absolute","value":4203427}},{"address":{"type":"absolute","value":4203443}}]},{"address":{"type":"absolute","value":4203488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203550}},{"address":{"type":"absolute","value":4203566}}]},{"address":{"type":"absolute","value":4203616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203616}}]},{"address":{"type":"absolute","value":4203696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203696}}]},{"address":{"type":"absolute","value":4203776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203776}}]},{"address":{"type":"absolute","value":4203856},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203856}},{"address":{"type":"absolute","value":4203921}}]},{"address":{"type":"absolute","value":4203984},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203984}}]},{"address":{"type":"absolute","value":4204176},"matched_basic_blocks":[{"address":{"type":"absolute","value":4204176}},{"address":{"type":"absolute","value":4204228}},{"address":{"type":"absolute","value":4204349}},{"address":{"type":"absolute","value":4204550}},{"address":{"type":"absolute","value":4204662}}]},{"address":{"type":"absolute","value":4204720},"matched_basic_blocks":[{"address":{"type":"absolute","value":4204720}},{"address":{"type":"absolute","value":4204835}},{"address":{"type":"absolute","value":4204851}}]},{"address":{"type":"absolute","value":4204896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4204896}},{"address":{"type":"absolute","value":4205105}},{"address":{"type":"absolute","value":4205209}},{"address":{"type":"absolute","value":4205229}},{"address":{"type":"absolute","value":4205239}},{"address":{"type":"absolute","value":4205303}},{"address":{"type":"absolute","value":4205345}},{"address":{"type":"absolute","value":4205372}}]},{"address":{"type":"absolute","value":4205440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4205440}},{"address":{"type":"absolute","value":4205575}},{"address":{"type":"absolute","value":4205592}},{"address":{"type":"absolute","value":4205649}},{"address":{"type":"absolute","value":4205671}},{"address":{"type":"absolute","value":4205721}},{"address":{"type":"absolute","value":4205767}},{"address":{"type":"absolute","value":4205783}}]},{"address":{"type":"absolute","value":4205840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4205840}},{"address":{"type":"absolute","value":4206136}},{"address":{"type":"absolute","value":4206215}},{"address":{"type":"absolute","value":4206283}},{"address":{"type":"absolute","value":4206600}},{"address":{"type":"absolute","value":4206622}},{"address":{"type":"absolute","value":4206681}},{"address":{"type":"absolute","value":4206750}},{"address":{"type":"absolute","value":4206765}},{"address":{"type":"absolute","value":4206781}}]},{"address":{"type":"absolute","value":4206832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4206832}}]},{"address":{"type":"absolute","value":4207024},"matched_basic_blocks":[{"address":{"type":"absolute","value":4207111}},{"address":{"type":"absolute","value":4207160}},{"address":{"type":"absolute","value":4207176}}]},{"address":{"type":"absolute","value":4207280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4207280}},{"address":{"type":"absolute","value":4207549}},{"address":{"type":"absolute","value":4207814}},{"address":{"type":"absolute","value":4207889}},{"address":{"type":"absolute","value":4207898}},{"address":{"type":"absolute","value":4207919}},{"address":{"type":"absolute","value":4207928}},{"address":{"type":"absolute","value":4207953}},{"address":{"type":"absolute","value":4207962}},{"address":{"type":"absolute","value":4208020}},{"address":{"type":"absolute","value":4208048}},{"address":{"type":"absolute","value":4208072}},{"address":{"type":"absolute","value":4208100}},{"address":{"type":"absolute","value":4208111}},{"address":{"type":"absolute","value":4208143}},{"address":{"type":"absolute","value":4208152}},{"address":{"type":"absolute","value":4208203}},{"address":{"type":"absolute","value":4208222}}]},{"address":{"type":"absolute","value":4208496},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208516}},{"address":{"type":"absolute","value":4208550}},{"address":{"type":"absolute","value":4208568}}]},{"address":{"type":"absolute","value":4208608},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208707}},{"address":{"type":"absolute","value":4208746}},{"address":{"type":"absolute","value":4208761}}]},{"address":{"type":"absolute","value":4208896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208931}}]},{"address":{"type":"absolute","value":4208976},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208976}},{"address":{"type":"absolute","value":4209039}}]},{"address":{"type":"absolute","value":4209200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4209200}},{"address":{"type":"absolute","value":4209250}},{"address":{"type":"absolute","value":4209313}},{"address":{"type":"absolute","value":4209331}}]},{"address":{"type":"absolute","value":4209488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4209488}},{"address":{"type":"absolute","value":4209618}},{"address":{"type":"absolute","value":4209681}}]},{"address":{"type":"absolute","value":4209728},"matched_basic_blocks":[{"address":{"type":"absolute","value":4209728}},{"address":{"type":"absolute","value":4209866}},{"address":{"type":"absolute","value":4209936}}]},{"address":{"type":"absolute","value":4210000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4210139}},{"address":{"type":"absolute","value":4210163}},{"address":{"type":"absolute","value":4210268}},{"address":{"type":"absolute","value":4210345}},{"address":{"type":"absolute","value":4210441}},{"address":{"type":"absolute","value":4210459}},{"address":{"type":"absolute","value":4210481}},{"address":{"type":"absolute","value":4210535}}]},{"address":{"type":"absolute","value":4210656},"matched_basic_blocks":[{"address":{"type":"absolute","value":4210739}},{"address":{"type":"absolute","value":4210779}},{"address":{"type":"absolute","value":4210792}}]},{"address":{"type":"absolute","value":4210832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4210832}},{"address":{"type":"absolute","value":4210987}},{"address":{"type":"absolute","value":4211081}},{"address":{"type":"absolute","value":4211134}}]},{"address":{"type":"absolute","value":4211232},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211369}}]},{"address":{"type":"absolute","value":4211600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211600}},{"address":{"type":"absolute","value":4211659}},{"address":{"type":"absolute","value":4211728}},{"address":{"type":"absolute","value":4211737}},{"address":{"type":"absolute","value":4211774}},{"address":{"type":"absolute","value":4211783}}]},{"address":{"type":"absolute","value":4211872},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211999}},{"address":{"type":"absolute","value":4212061}},{"address":{"type":"absolute","value":4212109}},{"address":{"type":"absolute","value":4212118}},{"address":{"type":"absolute","value":4212153}},{"address":{"type":"absolute","value":4212162}}]},{"address":{"type":"absolute","value":4212432},"matched_basic_blocks":[{"address":{"type":"absolute","value":4212432}},{"address":{"type":"absolute","value":4212524}},{"address":{"type":"absolute","value":4212545}},{"address":{"type":"absolute","value":4212592}},{"address":{"type":"absolute","value":4212629}},{"address":{"type":"absolute","value":4212666}},{"address":{"type":"absolute","value":4212737}},{"address":{"type":"absolute","value":4212785}},{"address":{"type":"absolute","value":4212803}}]},{"address":{"type":"absolute","value":4213248},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213409}},{"address":{"type":"absolute","value":4213481}}]},{"address":{"type":"absolute","value":4213443},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213443}}]},{"address":{"type":"absolute","value":4213468},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213468}}]},{"address":{"type":"absolute","value":4213760},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213851}},{"address":{"type":"absolute","value":4213916}},{"address":{"type":"absolute","value":4213931}}]},{"address":{"type":"absolute","value":4213984},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214075}},{"address":{"type":"absolute","value":4214137}},{"address":{"type":"absolute","value":4214157}}]},{"address":{"type":"absolute","value":4214320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4214592},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214592}},{"address":{"type":"absolute","value":4214741}}]},{"address":{"type":"absolute","value":4214784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214784}},{"address":{"type":"absolute","value":4214876}}]},{"address":{"type":"absolute","value":4214912},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214912}},{"address":{"type":"absolute","value":4215004}}]},{"address":{"type":"absolute","value":4215184},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215184}},{"address":{"type":"absolute","value":4215249}}]},{"address":{"type":"absolute","value":4215280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215280}}]},{"address":{"type":"absolute","value":4215952},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215952}},{"address":{"type":"absolute","value":4216034}},{"address":{"type":"absolute","value":4216071}}]},{"address":{"type":"absolute","value":4216144},"matched_basic_blocks":[{"address":{"type":"absolute","value":4216144}},{"address":{"type":"absolute","value":4216272}}]},{"address":{"type":"absolute","value":4216592},"matched_basic_blocks":[{"address":{"type":"absolute","value":4216592}},{"address":{"type":"absolute","value":4216642}},{"address":{"type":"absolute","value":4216661}}]},{"address":{"type":"absolute","value":4216800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4216800}}]},{"address":{"type":"absolute","value":4217424},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217424}},{"address":{"type":"absolute","value":4217520}},{"address":{"type":"absolute","value":4217566}}]},{"address":{"type":"absolute","value":4217632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217694}},{"address":{"type":"absolute","value":4217715}}]},{"address":{"type":"absolute","value":4217776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217776}}]},{"address":{"type":"absolute","value":4217968},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217968}},{"address":{"type":"absolute","value":4218263}}]},{"address":{"type":"absolute","value":4218304},"matched_basic_blocks":[{"address":{"type":"absolute","value":4218304}},{"address":{"type":"absolute","value":4218521}},{"address":{"type":"absolute","value":4218567}}]},{"address":{"type":"absolute","value":4218688},"matched_basic_blocks":[{"address":{"type":"absolute","value":4218854}},{"address":{"type":"absolute","value":4218955}},{"address":{"type":"absolute","value":4219065}},{"address":{"type":"absolute","value":4219194}},{"address":{"type":"absolute","value":4219265}}]},{"address":{"type":"absolute","value":4219227},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219227}}]},{"address":{"type":"absolute","value":4219252},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219252}}]},{"address":{"type":"absolute","value":4219376},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219376}},{"address":{"type":"absolute","value":4219427}},{"address":{"type":"absolute","value":4219449}},{"address":{"type":"absolute","value":4219467}},{"address":{"type":"absolute","value":4219510}},{"address":{"type":"absolute","value":4219525}},{"address":{"type":"absolute","value":4219568}},{"address":{"type":"absolute","value":4219581}},{"address":{"type":"absolute","value":4219599}},{"address":{"type":"absolute","value":4219609}},{"address":{"type":"absolute","value":4219638}}]},{"address":{"type":"absolute","value":4219696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219696}},{"address":{"type":"absolute","value":4219764}},{"address":{"type":"absolute","value":4219781}},{"address":{"type":"absolute","value":4219788}},{"address":{"type":"absolute","value":4219810}},{"address":{"type":"absolute","value":4219856}},{"address":{"type":"absolute","value":4219874}},{"address":{"type":"absolute","value":4219904}},{"address":{"type":"absolute","value":4219948}},{"address":{"type":"absolute","value":4219966}},{"address":{"type":"absolute","value":4219989}}]},{"address":{"type":"absolute","value":4220048},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220237}},{"address":{"type":"absolute","value":4220283}}]},{"address":{"type":"absolute","value":4220384},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220419}},{"address":{"type":"absolute","value":4220437}},{"address":{"type":"absolute","value":4220447}}]},{"address":{"type":"absolute","value":4220496},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220496}},{"address":{"type":"absolute","value":4220551}},{"address":{"type":"absolute","value":4220568}},{"address":{"type":"absolute","value":4220575}},{"address":{"type":"absolute","value":4220597}},{"address":{"type":"absolute","value":4220643}},{"address":{"type":"absolute","value":4220683}},{"address":{"type":"absolute","value":4220719}},{"address":{"type":"absolute","value":4220737}},{"address":{"type":"absolute","value":4220760}}]},{"address":{"type":"absolute","value":4220816},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220816}}]},{"address":{"type":"absolute","value":4220976},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220976}},{"address":{"type":"absolute","value":4221101}},{"address":{"type":"absolute","value":4221209}},{"address":{"type":"absolute","value":4221502}}]},{"address":{"type":"absolute","value":4221464},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221464}}]},{"address":{"type":"absolute","value":4221489},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221489}}]},{"address":{"type":"absolute","value":4221616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221616}},{"address":{"type":"absolute","value":4221686}},{"address":{"type":"absolute","value":4221695}},{"address":{"type":"absolute","value":4221714}},{"address":{"type":"absolute","value":4221723}},{"address":{"type":"absolute","value":4221738}},{"address":{"type":"absolute","value":4221747}}]},{"address":{"type":"absolute","value":4221784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214784}},{"address":{"type":"absolute","value":4214876}}]},{"address":{"type":"absolute","value":4221792},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214516}}]},{"address":{"type":"absolute","value":4221800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214912}},{"address":{"type":"absolute","value":4215004}}]},{"address":{"type":"absolute","value":4221808},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214592}},{"address":{"type":"absolute","value":4214741}}]},{"address":{"type":"absolute","value":4221816},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214420}}]},{"address":{"type":"absolute","value":4221824},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221906}}]},{"address":{"type":"absolute","value":4221906},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221906}}]},{"address":{"type":"absolute","value":4226132},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226165}}]},{"address":{"type":"absolute","value":4226544},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226567}},{"address":{"type":"absolute","value":4226572}}]},{"address":{"type":"absolute","value":4226556},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226567}},{"address":{"type":"absolute","value":4226572}}]},{"address":{"type":"absolute","value":4226626},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226626}}]},{"address":{"type":"absolute","value":4226834},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226834}},{"address":{"type":"absolute","value":4337648}}]},{"address":{"type":"absolute","value":4226853},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226853}}]},{"address":{"type":"absolute","value":4227175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226567}},{"address":{"type":"absolute","value":4226572}}]},{"address":{"type":"absolute","value":4227211},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227211}}]},{"address":{"type":"absolute","value":4227365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4229112},"matched_basic_blocks":[{"address":{"type":"absolute","value":4228986}},{"address":{"type":"absolute","value":4229030}},{"address":{"type":"absolute","value":4229063}},{"address":{"type":"absolute","value":4229088}}]},{"address":{"type":"absolute","value":4229121},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229121}}]},{"address":{"type":"absolute","value":4229563},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229508}},{"address":{"type":"absolute","value":4229586}},{"address":{"type":"absolute","value":4229591}},{"address":{"type":"absolute","value":4339665}}]},{"address":{"type":"absolute","value":4229575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229508}},{"address":{"type":"absolute","value":4229586}},{"address":{"type":"absolute","value":4229591}},{"address":{"type":"absolute","value":4339665}}]},{"address":{"type":"absolute","value":4229645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229645}}]},{"address":{"type":"absolute","value":4230088},"matched_basic_blocks":[{"address":{"type":"absolute","value":4230088}}]},{"address":{"type":"absolute","value":4230128},"matched_basic_blocks":[{"address":{"type":"absolute","value":4230128}}]},{"address":{"type":"absolute","value":4230696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4230696}}]},{"address":{"type":"absolute","value":4236240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221906}}]},{"address":{"type":"absolute","value":4240433},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241323}},{"address":{"type":"absolute","value":4241334}},{"address":{"type":"absolute","value":4241346}},{"address":{"type":"absolute","value":4241374}},{"address":{"type":"absolute","value":4241420}},{"address":{"type":"absolute","value":4241431}},{"address":{"type":"absolute","value":4241443}},{"address":{"type":"absolute","value":4241471}},{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}},{"address":{"type":"absolute","value":4242005}},{"address":{"type":"absolute","value":4242016}},{"address":{"type":"absolute","value":4242028}},{"address":{"type":"absolute","value":4242056}},{"address":{"type":"absolute","value":4242098}},{"address":{"type":"absolute","value":4242109}},{"address":{"type":"absolute","value":4242121}},{"address":{"type":"absolute","value":4242149}},{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242716}},{"address":{"type":"absolute","value":4242727}},{"address":{"type":"absolute","value":4242739}},{"address":{"type":"absolute","value":4242767}},{"address":{"type":"absolute","value":4242813}},{"address":{"type":"absolute","value":4242824}},{"address":{"type":"absolute","value":4242836}},{"address":{"type":"absolute","value":4242864}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4243415}},{"address":{"type":"absolute","value":4243427}},{"address":{"type":"absolute","value":4243439}},{"address":{"type":"absolute","value":4243467}},{"address":{"type":"absolute","value":4243513}},{"address":{"type":"absolute","value":4243524}},{"address":{"type":"absolute","value":4243536}},{"address":{"type":"absolute","value":4243564}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4241315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241323}},{"address":{"type":"absolute","value":4241334}},{"address":{"type":"absolute","value":4241346}},{"address":{"type":"absolute","value":4241374}},{"address":{"type":"absolute","value":4241420}},{"address":{"type":"absolute","value":4241431}},{"address":{"type":"absolute","value":4241443}},{"address":{"type":"absolute","value":4241471}},{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241412},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241420}},{"address":{"type":"absolute","value":4241431}},{"address":{"type":"absolute","value":4241443}},{"address":{"type":"absolute","value":4241471}},{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241509},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241606},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241703},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241801},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241997},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242005}},{"address":{"type":"absolute","value":4242016}},{"address":{"type":"absolute","value":4242028}},{"address":{"type":"absolute","value":4242056}},{"address":{"type":"absolute","value":4242098}},{"address":{"type":"absolute","value":4242109}},{"address":{"type":"absolute","value":4242121}},{"address":{"type":"absolute","value":4242149}},{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242098}},{"address":{"type":"absolute","value":4242109}},{"address":{"type":"absolute","value":4242121}},{"address":{"type":"absolute","value":4242149}},{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242187},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242284},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242381},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242478},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242708},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242716}},{"address":{"type":"absolute","value":4242727}},{"address":{"type":"absolute","value":4242739}},{"address":{"type":"absolute","value":4242767}},{"address":{"type":"absolute","value":4242813}},{"address":{"type":"absolute","value":4242824}},{"address":{"type":"absolute","value":4242836}},{"address":{"type":"absolute","value":4242864}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4242805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242813}},{"address":{"type":"absolute","value":4242824}},{"address":{"type":"absolute","value":4242836}},{"address":{"type":"absolute","value":4242864}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4242902},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4242999},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243096},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243193},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243407},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243415}},{"address":{"type":"absolute","value":4243427}},{"address":{"type":"absolute","value":4243439}},{"address":{"type":"absolute","value":4243467}},{"address":{"type":"absolute","value":4243513}},{"address":{"type":"absolute","value":4243524}},{"address":{"type":"absolute","value":4243536}},{"address":{"type":"absolute","value":4243564}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243513}},{"address":{"type":"absolute","value":4243524}},{"address":{"type":"absolute","value":4243536}},{"address":{"type":"absolute","value":4243564}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243602},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243699},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243796},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243894},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4244309},"matched_basic_blocks":[{"address":{"type":"absolute","value":4244309}}]},{"address":{"type":"absolute","value":4247142},"matched_basic_blocks":[{"address":{"type":"absolute","value":4247142}},{"address":{"type":"absolute","value":4247253}}]},{"address":{"type":"absolute","value":4247600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4247695}},{"address":{"type":"absolute","value":4247772}}]},{"address":{"type":"absolute","value":4247740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4247695}},{"address":{"type":"absolute","value":4247772}}]},{"address":{"type":"absolute","value":4250305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250356}}]},{"address":{"type":"absolute","value":4250384},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250356}}]},{"address":{"type":"absolute","value":4250444},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250444}}]},{"address":{"type":"absolute","value":4250783},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250869}}]},{"address":{"type":"absolute","value":4250869},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250869}}]},{"address":{"type":"absolute","value":4251022},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251022}}]},{"address":{"type":"absolute","value":4251046},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251049}}]},{"address":{"type":"absolute","value":4251049},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251049}}]},{"address":{"type":"absolute","value":4251572},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251572}},{"address":{"type":"absolute","value":4251637}},{"address":{"type":"absolute","value":4251766}},{"address":{"type":"absolute","value":4251786}},{"address":{"type":"absolute","value":4251821}},{"address":{"type":"absolute","value":4251863}},{"address":{"type":"absolute","value":4251881}},{"address":{"type":"absolute","value":4251928}},{"address":{"type":"absolute","value":4251951}},{"address":{"type":"absolute","value":4251964}}]},{"address":{"type":"absolute","value":4252787},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251572}},{"address":{"type":"absolute","value":4251637}},{"address":{"type":"absolute","value":4251766}},{"address":{"type":"absolute","value":4251786}},{"address":{"type":"absolute","value":4251821}},{"address":{"type":"absolute","value":4251863}},{"address":{"type":"absolute","value":4251881}},{"address":{"type":"absolute","value":4251928}},{"address":{"type":"absolute","value":4251951}},{"address":{"type":"absolute","value":4251964}}]},{"address":{"type":"absolute","value":4253354},"matched_basic_blocks":[{"address":{"type":"absolute","value":4253279}}]},{"address":{"type":"absolute","value":4253365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4253461}}]},{"address":{"type":"absolute","value":4259929},"matched_basic_blocks":[{"address":{"type":"absolute","value":4259929}}]},{"address":{"type":"absolute","value":4259949},"matched_basic_blocks":[{"address":{"type":"absolute","value":4259949}}]},{"address":{"type":"absolute","value":4261130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4260877}}]},{"address":{"type":"absolute","value":4266197},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266302}}]},{"address":{"type":"absolute","value":4266237},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266302}}]},{"address":{"type":"absolute","value":4266313},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266302}}]},{"address":{"type":"absolute","value":4266485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266555}},{"address":{"type":"absolute","value":4266585}},{"address":{"type":"absolute","value":4266614}},{"address":{"type":"absolute","value":4266654}},{"address":{"type":"absolute","value":4266735}}]},{"address":{"type":"absolute","value":4266515},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266555}},{"address":{"type":"absolute","value":4266585}},{"address":{"type":"absolute","value":4266614}},{"address":{"type":"absolute","value":4266654}},{"address":{"type":"absolute","value":4266735}}]},{"address":{"type":"absolute","value":4266654},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266654}},{"address":{"type":"absolute","value":4266735}}]},{"address":{"type":"absolute","value":4272637},"matched_basic_blocks":[{"address":{"type":"absolute","value":4272637}}]},{"address":{"type":"absolute","value":4272709},"matched_basic_blocks":[{"address":{"type":"absolute","value":4272709}}]},{"address":{"type":"absolute","value":4276119},"matched_basic_blocks":[{"address":{"type":"absolute","value":4278946}},{"address":{"type":"absolute","value":4278994}},{"address":{"type":"absolute","value":4279013}},{"address":{"type":"absolute","value":4279041}},{"address":{"type":"absolute","value":4279074}}]},{"address":{"type":"absolute","value":4278899},"matched_basic_blocks":[{"address":{"type":"absolute","value":4278899}},{"address":{"type":"absolute","value":4278946}},{"address":{"type":"absolute","value":4278994}},{"address":{"type":"absolute","value":4279013}},{"address":{"type":"absolute","value":4279041}},{"address":{"type":"absolute","value":4279074}}]},{"address":{"type":"absolute","value":4284349},"matched_basic_blocks":[{"address":{"type":"absolute","value":4284349}}]},{"address":{"type":"absolute","value":4290246},"matched_basic_blocks":[{"address":{"type":"absolute","value":4289811}},{"address":{"type":"absolute","value":4289887}},{"address":{"type":"absolute","value":4289904}},{"address":{"type":"absolute","value":4290018}}]},{"address":{"type":"absolute","value":4291637},"matched_basic_blocks":[{"address":{"type":"absolute","value":4291261}},{"address":{"type":"absolute","value":4291305}},{"address":{"type":"absolute","value":4291335}}]},{"address":{"type":"absolute","value":4293588},"matched_basic_blocks":[{"address":{"type":"absolute","value":4293740}}]},{"address":{"type":"absolute","value":4296367},"matched_basic_blocks":[{"address":{"type":"absolute","value":4296069}},{"address":{"type":"absolute","value":4296083}},{"address":{"type":"absolute","value":4296111}},{"address":{"type":"absolute","value":4296205}},{"address":{"type":"absolute","value":4296258}},{"address":{"type":"absolute","value":4296333}}]},{"address":{"type":"absolute","value":4297712},"matched_basic_blocks":[{"address":{"type":"absolute","value":4297284}},{"address":{"type":"absolute","value":4297380}}]},{"address":{"type":"absolute","value":4300559},"matched_basic_blocks":[{"address":{"type":"absolute","value":4300559}}]},{"address":{"type":"absolute","value":4300568},"matched_basic_blocks":[{"address":{"type":"absolute","value":4300893}},{"address":{"type":"absolute","value":4300918}}]},{"address":{"type":"absolute","value":4300768},"matched_basic_blocks":[{"address":{"type":"absolute","value":4300893}},{"address":{"type":"absolute","value":4300918}}]},{"address":{"type":"absolute","value":4302087},"matched_basic_blocks":[{"address":{"type":"absolute","value":4302120}}]},{"address":{"type":"absolute","value":4302275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4301202}},{"address":{"type":"absolute","value":4301222}},{"address":{"type":"absolute","value":4301247}},{"address":{"type":"absolute","value":4301262}},{"address":{"type":"absolute","value":4301317}},{"address":{"type":"absolute","value":4301346}},{"address":{"type":"absolute","value":4301411}},{"address":{"type":"absolute","value":4301445}}]},{"address":{"type":"absolute","value":4305373},"matched_basic_blocks":[{"address":{"type":"absolute","value":4304710}},{"address":{"type":"absolute","value":4304751}},{"address":{"type":"absolute","value":4304859}},{"address":{"type":"absolute","value":4304896}},{"address":{"type":"absolute","value":4304924}},{"address":{"type":"absolute","value":4304994}},{"address":{"type":"absolute","value":4305018}},{"address":{"type":"absolute","value":4305037}}]},{"address":{"type":"absolute","value":4305824},"matched_basic_blocks":[{"address":{"type":"absolute","value":4305705}},{"address":{"type":"absolute","value":4305718}},{"address":{"type":"absolute","value":4305740}}]},{"address":{"type":"absolute","value":4306162},"matched_basic_blocks":[{"address":{"type":"absolute","value":4306162}}]},{"address":{"type":"absolute","value":4306345},"matched_basic_blocks":[{"address":{"type":"absolute","value":4306345}}]},{"address":{"type":"absolute","value":4323799},"matched_basic_blocks":[{"address":{"type":"absolute","value":4323805}},{"address":{"type":"absolute","value":4323826}}]},{"address":{"type":"absolute","value":4327092},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327158}},{"address":{"type":"absolute","value":4327175}}]},{"address":{"type":"absolute","value":4328671},"matched_basic_blocks":[{"address":{"type":"absolute","value":4328671}}]},{"address":{"type":"absolute","value":4330510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4330414}}]},{"address":{"type":"absolute","value":4333998},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333998}}]},{"address":{"type":"absolute","value":4337648},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337648}}]},{"address":{"type":"absolute","value":4339665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339665}}]},{"address":{"type":"absolute","value":4341699},"matched_basic_blocks":[{"address":{"type":"absolute","value":4341699}}]},{"address":{"type":"absolute","value":4342566},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342566}}]},{"address":{"type":"absolute","value":4342589},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342589}}]},{"address":{"type":"absolute","value":4342778},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342778}}]},{"address":{"type":"absolute","value":4346025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346207}}]},{"address":{"type":"absolute","value":4361594},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361594}}]},{"address":{"type":"absolute","value":4364549},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369296}}]},{"address":{"type":"absolute","value":4369163},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369296}}]},{"address":{"type":"absolute","value":4375835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375835}}]},{"address":{"type":"absolute","value":4377354},"matched_basic_blocks":[{"address":{"type":"absolute","value":4377364}}]},{"address":{"type":"absolute","value":4391855},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391888}}]},{"address":{"type":"absolute","value":4393121},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393130}}]},{"address":{"type":"absolute","value":4401716},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401951}}]},{"address":{"type":"absolute","value":4402695},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402695}}]},{"address":{"type":"absolute","value":4412502},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361594}},{"address":{"type":"absolute","value":4412502}}]},{"address":{"type":"absolute","value":4412625},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412625}}]},{"address":{"type":"absolute","value":4412835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412835}}]},{"address":{"type":"absolute","value":4412856},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412835}}]},{"address":{"type":"absolute","value":4412864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412864}}]},{"address":{"type":"absolute","value":4412876},"matched_basic_blocks":[{"address":{"type":"absolute","value":4373365}},{"address":{"type":"absolute","value":4373430}},{"address":{"type":"absolute","value":4373496}},{"address":{"type":"absolute","value":4373583}},{"address":{"type":"absolute","value":4412876}}]},{"address":{"type":"absolute","value":4413649},"matched_basic_blocks":[{"address":{"type":"absolute","value":4413649}}]},{"address":{"type":"absolute","value":4413743},"matched_basic_blocks":[{"address":{"type":"absolute","value":4413743}}]},{"address":{"type":"absolute","value":4425184},"matched_basic_blocks":[{"address":{"type":"absolute","value":4425225}},{"address":{"type":"absolute","value":4425255}}]},{"address":{"type":"absolute","value":4426376},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426376}}]},{"address":{"type":"absolute","value":4426762},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426762}}]},{"address":{"type":"absolute","value":4429982},"matched_basic_blocks":[{"address":{"type":"absolute","value":4429982}},{"address":{"type":"absolute","value":4430054}},{"address":{"type":"absolute","value":4430218}},{"address":{"type":"absolute","value":4430243}},{"address":{"type":"absolute","value":4430436}},{"address":{"type":"absolute","value":4430482}},{"address":{"type":"absolute","value":4430622}}]},{"address":{"type":"absolute","value":4430791},"matched_basic_blocks":[{"address":{"type":"absolute","value":4430791}}]},{"address":{"type":"absolute","value":4431190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431190}}]},{"address":{"type":"absolute","value":4431241},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431241}}]},{"address":{"type":"absolute","value":4431312},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4431386},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431424},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431456},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431496},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431504},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431552},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203984}}]},{"address":{"type":"absolute","value":4431691},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431702},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431824},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208393}},{"address":{"type":"absolute","value":4208406}},{"address":{"type":"absolute","value":4208424}}]},{"address":{"type":"absolute","value":4431832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200274}}]},{"address":{"type":"absolute","value":4431840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4431885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4206832}}]},{"address":{"type":"absolute","value":4431896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431936},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431944},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431984},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432032},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4432040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432112},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4432151},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432208},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432328},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432368},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432368}}]},{"address":{"type":"absolute","value":4432379},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432416},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4432444},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432528},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4432648},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432648}}]},{"address":{"type":"absolute","value":4432671},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432768},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4432776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432776}}]},{"address":{"type":"absolute","value":4432799},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432891},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432918},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432945},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4432953},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432990},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4432998},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4433033},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433138},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433183},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433218},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433266},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433312},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433404},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433444},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433561},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433628},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433760},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433857},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433892},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434049},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434076},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434103},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434146},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434189},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434241},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434284},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434327},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434354},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434397},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434558},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434621},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434648},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375835}}]},{"address":{"type":"absolute","value":4434656},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434731},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434769},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434796},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434839},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434866},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375835}}]},{"address":{"type":"absolute","value":4434874},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434917},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434952},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434989},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435024},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435051},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435180},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435362},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435362}}]},{"address":{"type":"absolute","value":4435373},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435413},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435440}}]},{"address":{"type":"absolute","value":4435451},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435451}}]},{"address":{"type":"absolute","value":4435462},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435497},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435532},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435584},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435689},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435857},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435884},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435884}}]},{"address":{"type":"absolute","value":4435895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436010},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436053},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436096},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436139},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436166},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436201},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436236},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436282},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436317},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436344},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436379},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436406},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436446},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436473},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436500},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250444}},{"address":{"type":"absolute","value":4436665}},{"address":{"type":"absolute","value":4436683}}]},{"address":{"type":"absolute","value":4436736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436746}},{"address":{"type":"absolute","value":4436807}},{"address":{"type":"absolute","value":4436825}}]},{"address":{"type":"absolute","value":4436880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203984}}]},{"address":{"type":"absolute","value":4436890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227345}}]},{"address":{"type":"absolute","value":4436900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215280}}]},{"address":{"type":"absolute","value":4436910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211369}}]},{"address":{"type":"absolute","value":4436920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227345}}]},{"address":{"type":"absolute","value":4436960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227345}}]}]},"feature_counts":{"file":5683,"functions":[{"address":{"type":"absolute","value":4198432},"count":12},{"address":{"type":"absolute","value":4198448},"count":16},{"address":{"type":"absolute","value":4198473},"count":14},{"address":{"type":"absolute","value":4198495},"count":18},{"address":{"type":"absolute","value":4198584},"count":17},{"address":{"type":"absolute","value":4198594},"count":14},{"address":{"type":"absolute","value":4198616},"count":12},{"address":{"type":"absolute","value":4198628},"count":12},{"address":{"type":"absolute","value":4198640},"count":12},{"address":{"type":"absolute","value":4198652},"count":14},{"address":{"type":"absolute","value":4198674},"count":14},{"address":{"type":"absolute","value":4198704},"count":12},{"address":{"type":"absolute","value":4198716},"count":12},{"address":{"type":"absolute","value":4198753},"count":9},{"address":{"type":"absolute","value":4198768},"count":7},{"address":{"type":"absolute","value":4198864},"count":79},{"address":{"type":"absolute","value":4199184},"count":9},{"address":{"type":"absolute","value":4199200},"count":36},{"address":{"type":"absolute","value":4199392},"count":24},{"address":{"type":"absolute","value":4199456},"count":25},{"address":{"type":"absolute","value":4199520},"count":18},{"address":{"type":"absolute","value":4199568},"count":18},{"address":{"type":"absolute","value":4199616},"count":16},{"address":{"type":"absolute","value":4199664},"count":16},{"address":{"type":"absolute","value":4199680},"count":40},{"address":{"type":"absolute","value":4199777},"count":14},{"address":{"type":"absolute","value":4199796},"count":19},{"address":{"type":"absolute","value":4199872},"count":14},{"address":{"type":"absolute","value":4199904},"count":21},{"address":{"type":"absolute","value":4200000},"count":42},{"address":{"type":"absolute","value":4200144},"count":21},{"address":{"type":"absolute","value":4200192},"count":53},{"address":{"type":"absolute","value":4200352},"count":109},{"address":{"type":"absolute","value":4200960},"count":37},{"address":{"type":"absolute","value":4201456},"count":29},{"address":{"type":"absolute","value":4201744},"count":35},{"address":{"type":"absolute","value":4201856},"count":35},{"address":{"type":"absolute","value":4201952},"count":16},{"address":{"type":"absolute","value":4202016},"count":16},{"address":{"type":"absolute","value":4202304},"count":39},{"address":{"type":"absolute","value":4202912},"count":33},{"address":{"type":"absolute","value":4202960},"count":7},{"address":{"type":"absolute","value":4202976},"count":38},{"address":{"type":"absolute","value":4203088},"count":7},{"address":{"type":"absolute","value":4203104},"count":45},{"address":{"type":"absolute","value":4203280},"count":65},{"address":{"type":"absolute","value":4203488},"count":58},{"address":{"type":"absolute","value":4203616},"count":37},{"address":{"type":"absolute","value":4203696},"count":37},{"address":{"type":"absolute","value":4203776},"count":36},{"address":{"type":"absolute","value":4203856},"count":36},{"address":{"type":"absolute","value":4204176},"count":82},{"address":{"type":"absolute","value":4204720},"count":58},{"address":{"type":"absolute","value":4204896},"count":88},{"address":{"type":"absolute","value":4205440},"count":80},{"address":{"type":"absolute","value":4205840},"count":150},{"address":{"type":"absolute","value":4206832},"count":72},{"address":{"type":"absolute","value":4207024},"count":57},{"address":{"type":"absolute","value":4207280},"count":167},{"address":{"type":"absolute","value":4208496},"count":36},{"address":{"type":"absolute","value":4208608},"count":64},{"address":{"type":"absolute","value":4208896},"count":33},{"address":{"type":"absolute","value":4208976},"count":79},{"address":{"type":"absolute","value":4209200},"count":83},{"address":{"type":"absolute","value":4209488},"count":66},{"address":{"type":"absolute","value":4209728},"count":65},{"address":{"type":"absolute","value":4210000},"count":118},{"address":{"type":"absolute","value":4210656},"count":66},{"address":{"type":"absolute","value":4210832},"count":94},{"address":{"type":"absolute","value":4211200},"count":14},{"address":{"type":"absolute","value":4211216},"count":14},{"address":{"type":"absolute","value":4211408},"count":59},{"address":{"type":"absolute","value":4211600},"count":78},{"address":{"type":"absolute","value":4211872},"count":82},{"address":{"type":"absolute","value":4212432},"count":94},{"address":{"type":"absolute","value":4213248},"count":66},{"address":{"type":"absolute","value":4213443},"count":20},{"address":{"type":"absolute","value":4213468},"count":46},{"address":{"type":"absolute","value":4213616},"count":7},{"address":{"type":"absolute","value":4213632},"count":7},{"address":{"type":"absolute","value":4213760},"count":62},{"address":{"type":"absolute","value":4213984},"count":59},{"address":{"type":"absolute","value":4214256},"count":8},{"address":{"type":"absolute","value":4214304},"count":6},{"address":{"type":"absolute","value":4214320},"count":28},{"address":{"type":"absolute","value":4214592},"count":66},{"address":{"type":"absolute","value":4215184},"count":36},{"address":{"type":"absolute","value":4215488},"count":8},{"address":{"type":"absolute","value":4215504},"count":32},{"address":{"type":"absolute","value":4215616},"count":45},{"address":{"type":"absolute","value":4215808},"count":65},{"address":{"type":"absolute","value":4215952},"count":61},{"address":{"type":"absolute","value":4216144},"count":91},{"address":{"type":"absolute","value":4216592},"count":59},{"address":{"type":"absolute","value":4216800},"count":61},{"address":{"type":"absolute","value":4217216},"count":20},{"address":{"type":"absolute","value":4217248},"count":28},{"address":{"type":"absolute","value":4217344},"count":30},{"address":{"type":"absolute","value":4217424},"count":59},{"address":{"type":"absolute","value":4217632},"count":52},{"address":{"type":"absolute","value":4217755},"count":7},{"address":{"type":"absolute","value":4217776},"count":83},{"address":{"type":"absolute","value":4217968},"count":96},{"address":{"type":"absolute","value":4218304},"count":82},{"address":{"type":"absolute","value":4218688},"count":103},{"address":{"type":"absolute","value":4219227},"count":20},{"address":{"type":"absolute","value":4219252},"count":44},{"address":{"type":"absolute","value":4219376},"count":72},{"address":{"type":"absolute","value":4219696},"count":77},{"address":{"type":"absolute","value":4220048},"count":73},{"address":{"type":"absolute","value":4220384},"count":56},{"address":{"type":"absolute","value":4220496},"count":84},{"address":{"type":"absolute","value":4220816},"count":29},{"address":{"type":"absolute","value":4220896},"count":9},{"address":{"type":"absolute","value":4220912},"count":21},{"address":{"type":"absolute","value":4220944},"count":21},{"address":{"type":"absolute","value":4220976},"count":95},{"address":{"type":"absolute","value":4221464},"count":20},{"address":{"type":"absolute","value":4221489},"count":44},{"address":{"type":"absolute","value":4221616},"count":48},{"address":{"type":"absolute","value":4221784},"count":53},{"address":{"type":"absolute","value":4221792},"count":31},{"address":{"type":"absolute","value":4221800},"count":53},{"address":{"type":"absolute","value":4221808},"count":69},{"address":{"type":"absolute","value":4221816},"count":30},{"address":{"type":"absolute","value":4221906},"count":37},{"address":{"type":"absolute","value":4222396},"count":11},{"address":{"type":"absolute","value":4222410},"count":32},{"address":{"type":"absolute","value":4222415},"count":32},{"address":{"type":"absolute","value":4222420},"count":11},{"address":{"type":"absolute","value":4222936},"count":18},{"address":{"type":"absolute","value":4223006},"count":19},{"address":{"type":"absolute","value":4223194},"count":12},{"address":{"type":"absolute","value":4223206},"count":12},{"address":{"type":"absolute","value":4223273},"count":17},{"address":{"type":"absolute","value":4223309},"count":15},{"address":{"type":"absolute","value":4223597},"count":26},{"address":{"type":"absolute","value":4223784},"count":14},{"address":{"type":"absolute","value":4223803},"count":14},{"address":{"type":"absolute","value":4223989},"count":24},{"address":{"type":"absolute","value":4224203},"count":11},{"address":{"type":"absolute","value":4224510},"count":14},{"address":{"type":"absolute","value":4224530},"count":29},{"address":{"type":"absolute","value":4224611},"count":18},{"address":{"type":"absolute","value":4224638},"count":20},{"address":{"type":"absolute","value":4224662},"count":18},{"address":{"type":"absolute","value":4224689},"count":20},{"address":{"type":"absolute","value":4225219},"count":11},{"address":{"type":"absolute","value":4225231},"count":38},{"address":{"type":"absolute","value":4225296},"count":9},{"address":{"type":"absolute","value":4225810},"count":7},{"address":{"type":"absolute","value":4225961},"count":9},{"address":{"type":"absolute","value":4226029},"count":7},{"address":{"type":"absolute","value":4226076},"count":7},{"address":{"type":"absolute","value":4226082},"count":7},{"address":{"type":"absolute","value":4226132},"count":27},{"address":{"type":"absolute","value":4226176},"count":18},{"address":{"type":"absolute","value":4226203},"count":19},{"address":{"type":"absolute","value":4226234},"count":18},{"address":{"type":"absolute","value":4226261},"count":19},{"address":{"type":"absolute","value":4226292},"count":18},{"address":{"type":"absolute","value":4226319},"count":17},{"address":{"type":"absolute","value":4226544},"count":50},{"address":{"type":"absolute","value":4226556},"count":47},{"address":{"type":"absolute","value":4226626},"count":31},{"address":{"type":"absolute","value":4226834},"count":48},{"address":{"type":"absolute","value":4226842},"count":16},{"address":{"type":"absolute","value":4226853},"count":48},{"address":{"type":"absolute","value":4226861},"count":16},{"address":{"type":"absolute","value":4227175},"count":50},{"address":{"type":"absolute","value":4227211},"count":16},{"address":{"type":"absolute","value":4227396},"count":10},{"address":{"type":"absolute","value":4227408},"count":10},{"address":{"type":"absolute","value":4227444},"count":42},{"address":{"type":"absolute","value":4228101},"count":7},{"address":{"type":"absolute","value":4228647},"count":21},{"address":{"type":"absolute","value":4229112},"count":55},{"address":{"type":"absolute","value":4229121},"count":17},{"address":{"type":"absolute","value":4229563},"count":66},{"address":{"type":"absolute","value":4229575},"count":63},{"address":{"type":"absolute","value":4229645},"count":12},{"address":{"type":"absolute","value":4229653},"count":15},{"address":{"type":"absolute","value":4229672},"count":15},{"address":{"type":"absolute","value":4229683},"count":16},{"address":{"type":"absolute","value":4230088},"count":44},{"address":{"type":"absolute","value":4230128},"count":38},{"address":{"type":"absolute","value":4230184},"count":15},{"address":{"type":"absolute","value":4230195},"count":16},{"address":{"type":"absolute","value":4230696},"count":24},{"address":{"type":"absolute","value":4232765},"count":17},{"address":{"type":"absolute","value":4233434},"count":12},{"address":{"type":"absolute","value":4233471},"count":12},{"address":{"type":"absolute","value":4233485},"count":12},{"address":{"type":"absolute","value":4234263},"count":20},{"address":{"type":"absolute","value":4235207},"count":40},{"address":{"type":"absolute","value":4235984},"count":8},{"address":{"type":"absolute","value":4236039},"count":7},{"address":{"type":"absolute","value":4241315},"count":77},{"address":{"type":"absolute","value":4241412},"count":69},{"address":{"type":"absolute","value":4241509},"count":61},{"address":{"type":"absolute","value":4241606},"count":53},{"address":{"type":"absolute","value":4241703},"count":45},{"address":{"type":"absolute","value":4241801},"count":37},{"address":{"type":"absolute","value":4241997},"count":79},{"address":{"type":"absolute","value":4242090},"count":71},{"address":{"type":"absolute","value":4242187},"count":63},{"address":{"type":"absolute","value":4242284},"count":55},{"address":{"type":"absolute","value":4242381},"count":47},{"address":{"type":"absolute","value":4242478},"count":39},{"address":{"type":"absolute","value":4242708},"count":81},{"address":{"type":"absolute","value":4242805},"count":73},{"address":{"type":"absolute","value":4242902},"count":65},{"address":{"type":"absolute","value":4242999},"count":57},{"address":{"type":"absolute","value":4243096},"count":49},{"address":{"type":"absolute","value":4243193},"count":41},{"address":{"type":"absolute","value":4243407},"count":83},{"address":{"type":"absolute","value":4243505},"count":75},{"address":{"type":"absolute","value":4243602},"count":67},{"address":{"type":"absolute","value":4243699},"count":59},{"address":{"type":"absolute","value":4243796},"count":51},{"address":{"type":"absolute","value":4243894},"count":43},{"address":{"type":"absolute","value":4244309},"count":21},{"address":{"type":"absolute","value":4245044},"count":7},{"address":{"type":"absolute","value":4245048},"count":8},{"address":{"type":"absolute","value":4245217},"count":7},{"address":{"type":"absolute","value":4245221},"count":7},{"address":{"type":"absolute","value":4246941},"count":18},{"address":{"type":"absolute","value":4246968},"count":20},{"address":{"type":"absolute","value":4247132},"count":10},{"address":{"type":"absolute","value":4247142},"count":49},{"address":{"type":"absolute","value":4247314},"count":51},{"address":{"type":"absolute","value":4247320},"count":52},{"address":{"type":"absolute","value":4247730},"count":11},{"address":{"type":"absolute","value":4247740},"count":48},{"address":{"type":"absolute","value":4247803},"count":21},{"address":{"type":"absolute","value":4247806},"count":21},{"address":{"type":"absolute","value":4248567},"count":7},{"address":{"type":"absolute","value":4250285},"count":12},{"address":{"type":"absolute","value":4250384},"count":28},{"address":{"type":"absolute","value":4250869},"count":44},{"address":{"type":"absolute","value":4251022},"count":15},{"address":{"type":"absolute","value":4251038},"count":7},{"address":{"type":"absolute","value":4251046},"count":13},{"address":{"type":"absolute","value":4251049},"count":13},{"address":{"type":"absolute","value":4251556},"count":10},{"address":{"type":"absolute","value":4251562},"count":10},{"address":{"type":"absolute","value":4252776},"count":39},{"address":{"type":"absolute","value":4252787},"count":107},{"address":{"type":"absolute","value":4253085},"count":10},{"address":{"type":"absolute","value":4253091},"count":10},{"address":{"type":"absolute","value":4253328},"count":13},{"address":{"type":"absolute","value":4253331},"count":13},{"address":{"type":"absolute","value":4253354},"count":49},{"address":{"type":"absolute","value":4253365},"count":40},{"address":{"type":"absolute","value":4254462},"count":10},{"address":{"type":"absolute","value":4254468},"count":10},{"address":{"type":"absolute","value":4254507},"count":12},{"address":{"type":"absolute","value":4254510},"count":12},{"address":{"type":"absolute","value":4254594},"count":10},{"address":{"type":"absolute","value":4254600},"count":10},{"address":{"type":"absolute","value":4255045},"count":10},{"address":{"type":"absolute","value":4255048},"count":10},{"address":{"type":"absolute","value":4255309},"count":10},{"address":{"type":"absolute","value":4255312},"count":10},{"address":{"type":"absolute","value":4259202},"count":10},{"address":{"type":"absolute","value":4259205},"count":10},{"address":{"type":"absolute","value":4259255},"count":7},{"address":{"type":"absolute","value":4259259},"count":9},{"address":{"type":"absolute","value":4259929},"count":18},{"address":{"type":"absolute","value":4259949},"count":18},{"address":{"type":"absolute","value":4260109},"count":26},{"address":{"type":"absolute","value":4260175},"count":12},{"address":{"type":"absolute","value":4260178},"count":13},{"address":{"type":"absolute","value":4260190},"count":15},{"address":{"type":"absolute","value":4260950},"count":12},{"address":{"type":"absolute","value":4260953},"count":12},{"address":{"type":"absolute","value":4261130},"count":29},{"address":{"type":"absolute","value":4261232},"count":26},{"address":{"type":"absolute","value":4261298},"count":12},{"address":{"type":"absolute","value":4261301},"count":13},{"address":{"type":"absolute","value":4261313},"count":15},{"address":{"type":"absolute","value":4262558},"count":32},{"address":{"type":"absolute","value":4262900},"count":10},{"address":{"type":"absolute","value":4262906},"count":10},{"address":{"type":"absolute","value":4263797},"count":10},{"address":{"type":"absolute","value":4263803},"count":10},{"address":{"type":"absolute","value":4263951},"count":12},{"address":{"type":"absolute","value":4264109},"count":12},{"address":{"type":"absolute","value":4264112},"count":12},{"address":{"type":"absolute","value":4265836},"count":15},{"address":{"type":"absolute","value":4265863},"count":15},{"address":{"type":"absolute","value":4265890},"count":20},{"address":{"type":"absolute","value":4265955},"count":26},{"address":{"type":"absolute","value":4266021},"count":12},{"address":{"type":"absolute","value":4266024},"count":13},{"address":{"type":"absolute","value":4266036},"count":26},{"address":{"type":"absolute","value":4266102},"count":12},{"address":{"type":"absolute","value":4266105},"count":13},{"address":{"type":"absolute","value":4266117},"count":15},{"address":{"type":"absolute","value":4266157},"count":15},{"address":{"type":"absolute","value":4266237},"count":47},{"address":{"type":"absolute","value":4266313},"count":45},{"address":{"type":"absolute","value":4266410},"count":29},{"address":{"type":"absolute","value":4266515},"count":69},{"address":{"type":"absolute","value":4266654},"count":54},{"address":{"type":"absolute","value":4266806},"count":13},{"address":{"type":"absolute","value":4266882},"count":24},{"address":{"type":"absolute","value":4266954},"count":14},{"address":{"type":"absolute","value":4267231},"count":7},{"address":{"type":"absolute","value":4267277},"count":12},{"address":{"type":"absolute","value":4267635},"count":24},{"address":{"type":"absolute","value":4267949},"count":25},{"address":{"type":"absolute","value":4267993},"count":14},{"address":{"type":"absolute","value":4268008},"count":28},{"address":{"type":"absolute","value":4268063},"count":13},{"address":{"type":"absolute","value":4268075},"count":15},{"address":{"type":"absolute","value":4268563},"count":12},{"address":{"type":"absolute","value":4268647},"count":12},{"address":{"type":"absolute","value":4272418},"count":7},{"address":{"type":"absolute","value":4272637},"count":17},{"address":{"type":"absolute","value":4272709},"count":17},{"address":{"type":"absolute","value":4272732},"count":12},{"address":{"type":"absolute","value":4273428},"count":12},{"address":{"type":"absolute","value":4273431},"count":12},{"address":{"type":"absolute","value":4275390},"count":14},{"address":{"type":"absolute","value":4278899},"count":70},{"address":{"type":"absolute","value":4281618},"count":31},{"address":{"type":"absolute","value":4282030},"count":31},{"address":{"type":"absolute","value":4282098},"count":13},{"address":{"type":"absolute","value":4282110},"count":39},{"address":{"type":"absolute","value":4282195},"count":13},{"address":{"type":"absolute","value":4282207},"count":30},{"address":{"type":"absolute","value":4282270},"count":13},{"address":{"type":"absolute","value":4282282},"count":31},{"address":{"type":"absolute","value":4282342},"count":13},{"address":{"type":"absolute","value":4282354},"count":15},{"address":{"type":"absolute","value":4282394},"count":15},{"address":{"type":"absolute","value":4282434},"count":15},{"address":{"type":"absolute","value":4282474},"count":15},{"address":{"type":"absolute","value":4283247},"count":23},{"address":{"type":"absolute","value":4283292},"count":23},{"address":{"type":"absolute","value":4284051},"count":12},{"address":{"type":"absolute","value":4284054},"count":12},{"address":{"type":"absolute","value":4284177},"count":40},{"address":{"type":"absolute","value":4284294},"count":12},{"address":{"type":"absolute","value":4284297},"count":13},{"address":{"type":"absolute","value":4284309},"count":15},{"address":{"type":"absolute","value":4284349},"count":16},{"address":{"type":"absolute","value":4284455},"count":28},{"address":{"type":"absolute","value":4284494},"count":29},{"address":{"type":"absolute","value":4284502},"count":22},{"address":{"type":"absolute","value":4284732},"count":26},{"address":{"type":"absolute","value":4286609},"count":10},{"address":{"type":"absolute","value":4287055},"count":10},{"address":{"type":"absolute","value":4287064},"count":10},{"address":{"type":"absolute","value":4288773},"count":10},{"address":{"type":"absolute","value":4288779},"count":10},{"address":{"type":"absolute","value":4290246},"count":74},{"address":{"type":"absolute","value":4290433},"count":12},{"address":{"type":"absolute","value":4290436},"count":12},{"address":{"type":"absolute","value":4291637},"count":50},{"address":{"type":"absolute","value":4291861},"count":56},{"address":{"type":"absolute","value":4291998},"count":12},{"address":{"type":"absolute","value":4292001},"count":13},{"address":{"type":"absolute","value":4292013},"count":15},{"address":{"type":"absolute","value":4293588},"count":67},{"address":{"type":"absolute","value":4293776},"count":10},{"address":{"type":"absolute","value":4293782},"count":10},{"address":{"type":"absolute","value":4294652},"count":53},{"address":{"type":"absolute","value":4294767},"count":12},{"address":{"type":"absolute","value":4294770},"count":13},{"address":{"type":"absolute","value":4294782},"count":15},{"address":{"type":"absolute","value":4294822},"count":53},{"address":{"type":"absolute","value":4296367},"count":95},{"address":{"type":"absolute","value":4296632},"count":12},{"address":{"type":"absolute","value":4296939},"count":7},{"address":{"type":"absolute","value":4296945},"count":7},{"address":{"type":"absolute","value":4296951},"count":7},{"address":{"type":"absolute","value":4296957},"count":7},{"address":{"type":"absolute","value":4296963},"count":24},{"address":{"type":"absolute","value":4297007},"count":24},{"address":{"type":"absolute","value":4297051},"count":24},{"address":{"type":"absolute","value":4297712},"count":101},{"address":{"type":"absolute","value":4299658},"count":12},{"address":{"type":"absolute","value":4299729},"count":12},{"address":{"type":"absolute","value":4299732},"count":12},{"address":{"type":"absolute","value":4300241},"count":30},{"address":{"type":"absolute","value":4300316},"count":12},{"address":{"type":"absolute","value":4300319},"count":13},{"address":{"type":"absolute","value":4300331},"count":15},{"address":{"type":"absolute","value":4300559},"count":16},{"address":{"type":"absolute","value":4300768},"count":70},{"address":{"type":"absolute","value":4300927},"count":50},{"address":{"type":"absolute","value":4301001},"count":22},{"address":{"type":"absolute","value":4301016},"count":20},{"address":{"type":"absolute","value":4302087},"count":27},{"address":{"type":"absolute","value":4302275},"count":78},{"address":{"type":"absolute","value":4302286},"count":28},{"address":{"type":"absolute","value":4302341},"count":13},{"address":{"type":"absolute","value":4302353},"count":15},{"address":{"type":"absolute","value":4303700},"count":12},{"address":{"type":"absolute","value":4303703},"count":12},{"address":{"type":"absolute","value":4305373},"count":89},{"address":{"type":"absolute","value":4305401},"count":11},{"address":{"type":"absolute","value":4305824},"count":48},{"address":{"type":"absolute","value":4306150},"count":12},{"address":{"type":"absolute","value":4306153},"count":12},{"address":{"type":"absolute","value":4306162},"count":26},{"address":{"type":"absolute","value":4306345},"count":26},{"address":{"type":"absolute","value":4306642},"count":12},{"address":{"type":"absolute","value":4306645},"count":12},{"address":{"type":"absolute","value":4311059},"count":12},{"address":{"type":"absolute","value":4311062},"count":12},{"address":{"type":"absolute","value":4319057},"count":17},{"address":{"type":"absolute","value":4320310},"count":13},{"address":{"type":"absolute","value":4323505},"count":11},{"address":{"type":"absolute","value":4323799},"count":55},{"address":{"type":"absolute","value":4323983},"count":15},{"address":{"type":"absolute","value":4324325},"count":18},{"address":{"type":"absolute","value":4324348},"count":14},{"address":{"type":"absolute","value":4324440},"count":14},{"address":{"type":"absolute","value":4327092},"count":59},{"address":{"type":"absolute","value":4327246},"count":36},{"address":{"type":"absolute","value":4327252},"count":37},{"address":{"type":"absolute","value":4328671},"count":15},{"address":{"type":"absolute","value":4330510},"count":44},{"address":{"type":"absolute","value":4333998},"count":20},{"address":{"type":"absolute","value":4334029},"count":17},{"address":{"type":"absolute","value":4335597},"count":28},{"address":{"type":"absolute","value":4339697},"count":18},{"address":{"type":"absolute","value":4339766},"count":10},{"address":{"type":"absolute","value":4339774},"count":24},{"address":{"type":"absolute","value":4340409},"count":10},{"address":{"type":"absolute","value":4340735},"count":10},{"address":{"type":"absolute","value":4340743},"count":9},{"address":{"type":"absolute","value":4340860},"count":7},{"address":{"type":"absolute","value":4341255},"count":22},{"address":{"type":"absolute","value":4341584},"count":12},{"address":{"type":"absolute","value":4341607},"count":12},{"address":{"type":"absolute","value":4341699},"count":16},{"address":{"type":"absolute","value":4341807},"count":14},{"address":{"type":"absolute","value":4342312},"count":12},{"address":{"type":"absolute","value":4342326},"count":17},{"address":{"type":"absolute","value":4342500},"count":28},{"address":{"type":"absolute","value":4342566},"count":13},{"address":{"type":"absolute","value":4342589},"count":13},{"address":{"type":"absolute","value":4342603},"count":7},{"address":{"type":"absolute","value":4342670},"count":12},{"address":{"type":"absolute","value":4342684},"count":12},{"address":{"type":"absolute","value":4342698},"count":28},{"address":{"type":"absolute","value":4342764},"count":12},{"address":{"type":"absolute","value":4342778},"count":15},{"address":{"type":"absolute","value":4342849},"count":30},{"address":{"type":"absolute","value":4343531},"count":32},{"address":{"type":"absolute","value":4343596},"count":17},{"address":{"type":"absolute","value":4343607},"count":11},{"address":{"type":"absolute","value":4343616},"count":14},{"address":{"type":"absolute","value":4344014},"count":18},{"address":{"type":"absolute","value":4344041},"count":19},{"address":{"type":"absolute","value":4344058},"count":18},{"address":{"type":"absolute","value":4344309},"count":23},{"address":{"type":"absolute","value":4346022},"count":7},{"address":{"type":"absolute","value":4346025},"count":38},{"address":{"type":"absolute","value":4351283},"count":9},{"address":{"type":"absolute","value":4351287},"count":25},{"address":{"type":"absolute","value":4351865},"count":26},{"address":{"type":"absolute","value":4351870},"count":26},{"address":{"type":"absolute","value":4351875},"count":26},{"address":{"type":"absolute","value":4351880},"count":9},{"address":{"type":"absolute","value":4360206},"count":32},{"address":{"type":"absolute","value":4360262},"count":32},{"address":{"type":"absolute","value":4361210},"count":18},{"address":{"type":"absolute","value":4361237},"count":18},{"address":{"type":"absolute","value":4361779},"count":23},{"address":{"type":"absolute","value":4362106},"count":24},{"address":{"type":"absolute","value":4362141},"count":24},{"address":{"type":"absolute","value":4362176},"count":22},{"address":{"type":"absolute","value":4362211},"count":22},{"address":{"type":"absolute","value":4362379},"count":24},{"address":{"type":"absolute","value":4362914},"count":29},{"address":{"type":"absolute","value":4363746},"count":34},{"address":{"type":"absolute","value":4363758},"count":34},{"address":{"type":"absolute","value":4364549},"count":67},{"address":{"type":"absolute","value":4364993},"count":10},{"address":{"type":"absolute","value":4365359},"count":23},{"address":{"type":"absolute","value":4366872},"count":21},{"address":{"type":"absolute","value":4366923},"count":9},{"address":{"type":"absolute","value":4367212},"count":9},{"address":{"type":"absolute","value":4367839},"count":9},{"address":{"type":"absolute","value":4369059},"count":36},{"address":{"type":"absolute","value":4372270},"count":28},{"address":{"type":"absolute","value":4374900},"count":7},{"address":{"type":"absolute","value":4375126},"count":19},{"address":{"type":"absolute","value":4375143},"count":19},{"address":{"type":"absolute","value":4375160},"count":18},{"address":{"type":"absolute","value":4375187},"count":19},{"address":{"type":"absolute","value":4375204},"count":19},{"address":{"type":"absolute","value":4375221},"count":19},{"address":{"type":"absolute","value":4375238},"count":18},{"address":{"type":"absolute","value":4375265},"count":19},{"address":{"type":"absolute","value":4375282},"count":18},{"address":{"type":"absolute","value":4375309},"count":19},{"address":{"type":"absolute","value":4375326},"count":19},{"address":{"type":"absolute","value":4375343},"count":25},{"address":{"type":"absolute","value":4375372},"count":25},{"address":{"type":"absolute","value":4375401},"count":19},{"address":{"type":"absolute","value":4375835},"count":29},{"address":{"type":"absolute","value":4375979},"count":22},{"address":{"type":"absolute","value":4376538},"count":29},{"address":{"type":"absolute","value":4376981},"count":31},{"address":{"type":"absolute","value":4376993},"count":35},{"address":{"type":"absolute","value":4377354},"count":26},{"address":{"type":"absolute","value":4377655},"count":16},{"address":{"type":"absolute","value":4377663},"count":16},{"address":{"type":"absolute","value":4377680},"count":23},{"address":{"type":"absolute","value":4377685},"count":23},{"address":{"type":"absolute","value":4377899},"count":8},{"address":{"type":"absolute","value":4377903},"count":9},{"address":{"type":"absolute","value":4378998},"count":29},{"address":{"type":"absolute","value":4379072},"count":10},{"address":{"type":"absolute","value":4379087},"count":21},{"address":{"type":"absolute","value":4379118},"count":11},{"address":{"type":"absolute","value":4379863},"count":18},{"address":{"type":"absolute","value":4379890},"count":19},{"address":{"type":"absolute","value":4380132},"count":18},{"address":{"type":"absolute","value":4380551},"count":22},{"address":{"type":"absolute","value":4380605},"count":28},{"address":{"type":"absolute","value":4380717},"count":24},{"address":{"type":"absolute","value":4382803},"count":11},{"address":{"type":"absolute","value":4383174},"count":9},{"address":{"type":"absolute","value":4384065},"count":18},{"address":{"type":"absolute","value":4384092},"count":18},{"address":{"type":"absolute","value":4384119},"count":18},{"address":{"type":"absolute","value":4384581},"count":19},{"address":{"type":"absolute","value":4385180},"count":8},{"address":{"type":"absolute","value":4385184},"count":8},{"address":{"type":"absolute","value":4391794},"count":14},{"address":{"type":"absolute","value":4391828},"count":14},{"address":{"type":"absolute","value":4391855},"count":34},{"address":{"type":"absolute","value":4392288},"count":22},{"address":{"type":"absolute","value":4392416},"count":8},{"address":{"type":"absolute","value":4393121},"count":21},{"address":{"type":"absolute","value":4394714},"count":31},{"address":{"type":"absolute","value":4396036},"count":42},{"address":{"type":"absolute","value":4398750},"count":51},{"address":{"type":"absolute","value":4399438},"count":18},{"address":{"type":"absolute","value":4399465},"count":18},{"address":{"type":"absolute","value":4399492},"count":18},{"address":{"type":"absolute","value":4399519},"count":18},{"address":{"type":"absolute","value":4399622},"count":23},{"address":{"type":"absolute","value":4399676},"count":24},{"address":{"type":"absolute","value":4401625},"count":9},{"address":{"type":"absolute","value":4401629},"count":13},{"address":{"type":"absolute","value":4401716},"count":80},{"address":{"type":"absolute","value":4402695},"count":37},{"address":{"type":"absolute","value":4405241},"count":31},{"address":{"type":"absolute","value":4407563},"count":31},{"address":{"type":"absolute","value":4412502},"count":87},{"address":{"type":"absolute","value":4412522},"count":33},{"address":{"type":"absolute","value":4412530},"count":23},{"address":{"type":"absolute","value":4412625},"count":64},{"address":{"type":"absolute","value":4412806},"count":10},{"address":{"type":"absolute","value":4412856},"count":22},{"address":{"type":"absolute","value":4412864},"count":64},{"address":{"type":"absolute","value":4412876},"count":96},{"address":{"type":"absolute","value":4412954},"count":13},{"address":{"type":"absolute","value":4413649},"count":27},{"address":{"type":"absolute","value":4413743},"count":27},{"address":{"type":"absolute","value":4414144},"count":13},{"address":{"type":"absolute","value":4414150},"count":13},{"address":{"type":"absolute","value":4414986},"count":39},{"address":{"type":"absolute","value":4415262},"count":8},{"address":{"type":"absolute","value":4415266},"count":8},{"address":{"type":"absolute","value":4417172},"count":17},{"address":{"type":"absolute","value":4417347},"count":8},{"address":{"type":"absolute","value":4417351},"count":12},{"address":{"type":"absolute","value":4423380},"count":7},{"address":{"type":"absolute","value":4424201},"count":14},{"address":{"type":"absolute","value":4424220},"count":13},{"address":{"type":"absolute","value":4425129},"count":19},{"address":{"type":"absolute","value":4425184},"count":50},{"address":{"type":"absolute","value":4425519},"count":12},{"address":{"type":"absolute","value":4425525},"count":12},{"address":{"type":"absolute","value":4425545},"count":7},{"address":{"type":"absolute","value":4425664},"count":9},{"address":{"type":"absolute","value":4426376},"count":17},{"address":{"type":"absolute","value":4426762},"count":75},{"address":{"type":"absolute","value":4428322},"count":18},{"address":{"type":"absolute","value":4428349},"count":18},{"address":{"type":"absolute","value":4429308},"count":20},{"address":{"type":"absolute","value":4429336},"count":21},{"address":{"type":"absolute","value":4429531},"count":14},{"address":{"type":"absolute","value":4429982},"count":133},{"address":{"type":"absolute","value":4430791},"count":20},{"address":{"type":"absolute","value":4431190},"count":21},{"address":{"type":"absolute","value":4431241},"count":25},{"address":{"type":"absolute","value":4431424},"count":31},{"address":{"type":"absolute","value":4431456},"count":31},{"address":{"type":"absolute","value":4431488},"count":50},{"address":{"type":"absolute","value":4431552},"count":50},{"address":{"type":"absolute","value":4431560},"count":31},{"address":{"type":"absolute","value":4431600},"count":31},{"address":{"type":"absolute","value":4431632},"count":50},{"address":{"type":"absolute","value":4431640},"count":31},{"address":{"type":"absolute","value":4431680},"count":73},{"address":{"type":"absolute","value":4431691},"count":50},{"address":{"type":"absolute","value":4431702},"count":55},{"address":{"type":"absolute","value":4431736},"count":33},{"address":{"type":"absolute","value":4431776},"count":50},{"address":{"type":"absolute","value":4431784},"count":33},{"address":{"type":"absolute","value":4431824},"count":45},{"address":{"type":"absolute","value":4431832},"count":53},{"address":{"type":"absolute","value":4431840},"count":37},{"address":{"type":"absolute","value":4431885},"count":72},{"address":{"type":"absolute","value":4431896},"count":33},{"address":{"type":"absolute","value":4431984},"count":33},{"address":{"type":"absolute","value":4432032},"count":50},{"address":{"type":"absolute","value":4432080},"count":31},{"address":{"type":"absolute","value":4432192},"count":30},{"address":{"type":"absolute","value":4432200},"count":32},{"address":{"type":"absolute","value":4432208},"count":31},{"address":{"type":"absolute","value":4432240},"count":31},{"address":{"type":"absolute","value":4432272},"count":30},{"address":{"type":"absolute","value":4432280},"count":31},{"address":{"type":"absolute","value":4432368},"count":25},{"address":{"type":"absolute","value":4432379},"count":31},{"address":{"type":"absolute","value":4432480},"count":32},{"address":{"type":"absolute","value":4432528},"count":31},{"address":{"type":"absolute","value":4432560},"count":31},{"address":{"type":"absolute","value":4432592},"count":32},{"address":{"type":"absolute","value":4432600},"count":31},{"address":{"type":"absolute","value":4432640},"count":28},{"address":{"type":"absolute","value":4432648},"count":13},{"address":{"type":"absolute","value":4432663},"count":18},{"address":{"type":"absolute","value":4432671},"count":33},{"address":{"type":"absolute","value":4432720},"count":30},{"address":{"type":"absolute","value":4432728},"count":32},{"address":{"type":"absolute","value":4432768},"count":28},{"address":{"type":"absolute","value":4432776},"count":13},{"address":{"type":"absolute","value":4432791},"count":18},{"address":{"type":"absolute","value":4432799},"count":33},{"address":{"type":"absolute","value":4432848},"count":30},{"address":{"type":"absolute","value":4432856},"count":32},{"address":{"type":"absolute","value":4432891},"count":31},{"address":{"type":"absolute","value":4432918},"count":31},{"address":{"type":"absolute","value":4433025},"count":28},{"address":{"type":"absolute","value":4433033},"count":31},{"address":{"type":"absolute","value":4433060},"count":31},{"address":{"type":"absolute","value":4433087},"count":24},{"address":{"type":"absolute","value":4433095},"count":31},{"address":{"type":"absolute","value":4433175},"count":24},{"address":{"type":"absolute","value":4433183},"count":31},{"address":{"type":"absolute","value":4433655},"count":31},{"address":{"type":"absolute","value":4433682},"count":23},{"address":{"type":"absolute","value":4433690},"count":31},{"address":{"type":"absolute","value":4433787},"count":23},{"address":{"type":"absolute","value":4433795},"count":31},{"address":{"type":"absolute","value":4433822},"count":23},{"address":{"type":"absolute","value":4433830},"count":31},{"address":{"type":"absolute","value":4433857},"count":31},{"address":{"type":"absolute","value":4434076},"count":31},{"address":{"type":"absolute","value":4434103},"count":31},{"address":{"type":"absolute","value":4434268},"count":14},{"address":{"type":"absolute","value":4434276},"count":16},{"address":{"type":"absolute","value":4434284},"count":31},{"address":{"type":"absolute","value":4434354},"count":31},{"address":{"type":"absolute","value":4434648},"count":29},{"address":{"type":"absolute","value":4434656},"count":31},{"address":{"type":"absolute","value":4434683},"count":11},{"address":{"type":"absolute","value":4434696},"count":31},{"address":{"type":"absolute","value":4434723},"count":23},{"address":{"type":"absolute","value":4434731},"count":31},{"address":{"type":"absolute","value":4434796},"count":31},{"address":{"type":"absolute","value":4434866},"count":29},{"address":{"type":"absolute","value":4434874},"count":31},{"address":{"type":"absolute","value":4434989},"count":31},{"address":{"type":"absolute","value":4435132},"count":23},{"address":{"type":"absolute","value":4435140},"count":31},{"address":{"type":"absolute","value":4435167},"count":11},{"address":{"type":"absolute","value":4435180},"count":31},{"address":{"type":"absolute","value":4435207},"count":23},{"address":{"type":"absolute","value":4435215},"count":31},{"address":{"type":"absolute","value":4435282},"count":23},{"address":{"type":"absolute","value":4435290},"count":31},{"address":{"type":"absolute","value":4435317},"count":23},{"address":{"type":"absolute","value":4435325},"count":33},{"address":{"type":"absolute","value":4435362},"count":17},{"address":{"type":"absolute","value":4435373},"count":31},{"address":{"type":"absolute","value":4435440},"count":19},{"address":{"type":"absolute","value":4435451},"count":20},{"address":{"type":"absolute","value":4435462},"count":31},{"address":{"type":"absolute","value":4435611},"count":17},{"address":{"type":"absolute","value":4435640},"count":31},{"address":{"type":"absolute","value":4435767},"count":12},{"address":{"type":"absolute","value":4435775},"count":31},{"address":{"type":"absolute","value":4435884},"count":18},{"address":{"type":"absolute","value":4435895},"count":31},{"address":{"type":"absolute","value":4435962},"count":11},{"address":{"type":"absolute","value":4435975},"count":31},{"address":{"type":"absolute","value":4436166},"count":31},{"address":{"type":"absolute","value":4436193},"count":22},{"address":{"type":"absolute","value":4436201},"count":31},{"address":{"type":"absolute","value":4436228},"count":22},{"address":{"type":"absolute","value":4436236},"count":31},{"address":{"type":"absolute","value":4436309},"count":23},{"address":{"type":"absolute","value":4436317},"count":31},{"address":{"type":"absolute","value":4436344},"count":31},{"address":{"type":"absolute","value":4436371},"count":44},{"address":{"type":"absolute","value":4436379},"count":31},{"address":{"type":"absolute","value":4436406},"count":31},{"address":{"type":"absolute","value":4436433},"count":11},{"address":{"type":"absolute","value":4436446},"count":31},{"address":{"type":"absolute","value":4436473},"count":31},{"address":{"type":"absolute","value":4436500},"count":31},{"address":{"type":"absolute","value":4436527},"count":25},{"address":{"type":"absolute","value":4436576},"count":16},{"address":{"type":"absolute","value":4436640},"count":45},{"address":{"type":"absolute","value":4436736},"count":47},{"address":{"type":"absolute","value":4436880},"count":73},{"address":{"type":"absolute","value":4436890},"count":25},{"address":{"type":"absolute","value":4436900},"count":45},{"address":{"type":"absolute","value":4436910},"count":70},{"address":{"type":"absolute","value":4436920},"count":25},{"address":{"type":"absolute","value":4436930},"count":19},{"address":{"type":"absolute","value":4436940},"count":32},{"address":{"type":"absolute","value":4436950},"count":36},{"address":{"type":"absolute","value":4436960},"count":25},{"address":{"type":"absolute","value":4436970},"count":36},{"address":{"type":"absolute","value":4436992},"count":10},{"address":{"type":"absolute","value":4437004},"count":19}]},"library_functions":[{"address":{"type":"absolute","value":4198400},"name":"??__EDEFAULT_CHANNEL@CryptoPP@@YAXXZ"},{"address":{"type":"absolute","value":4198526},"name":"??__Efout@std@@YAXXZ"},{"address":{"type":"absolute","value":4198728},"name":"??__Eg_DebugOutFilePtr@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4198742},"name":"??__E?s_cookie@Security@details@Concurrency@@2KA@@YAXXZ"},{"address":{"type":"absolute","value":4198784},"name":"?"},{"address":{"type":"absolute","value":4199280},"name":"??0exception@std@@QAE@ABV01@@Z"},{"address":{"type":"absolute","value":4199328},"name":"?what@exception@std@@UBEPBDXZ"},{"address":{"type":"absolute","value":4199344},"name":"?"},{"address":{"type":"absolute","value":4199424},"name":"?"},{"address":{"type":"absolute","value":4199504},"name":"?"},{"address":{"type":"absolute","value":4199856},"name":"?"},{"address":{"type":"absolute","value":4199952},"name":"??_H@YGXPAXIIP6EPAX0@Z@Z"},{"address":{"type":"absolute","value":4201056},"name":"??0_Locinfo@std@@QAE@PBD@Z"},{"address":{"type":"absolute","value":4201248},"name":"??0exception_ptr@std@@QAE@XZ"},{"address":{"type":"absolute","value":4201520},"name":"??_G_Facet_base@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4201568},"name":"?"},{"address":{"type":"absolute","value":4201584},"name":"?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ"},{"address":{"type":"absolute","value":4201616},"name":"??1locale@std@@QAE@XZ"},{"address":{"type":"absolute","value":4201696},"name":"?"},{"address":{"type":"absolute","value":4201712},"name":"?do_tolower@?$ctype@D@std@@MBEDD@Z"},{"address":{"type":"absolute","value":4201824},"name":"?do_toupper@?$ctype@D@std@@MBEDD@Z"},{"address":{"type":"absolute","value":4201936},"name":"?do_widen@?$ctype@D@std@@MBEDD@Z"},{"address":{"type":"absolute","value":4202000},"name":"?do_narrow@?$ctype@D@std@@MBEDDD@Z"},{"address":{"type":"absolute","value":4202064},"name":"??_G?$ctype@D@std@@MAEPAXI@Z"},{"address":{"type":"absolute","value":4202160},"name":"?default_error_condition@error_category@std@@UBE?AVerror_condition@2@H@Z"},{"address":{"type":"absolute","value":4202192},"name":"?equivalent@error_category@std@@UBE_NHABVerror_condition@2@@Z"},{"address":{"type":"absolute","value":4202256},"name":"?equivalent@error_category@std@@UBE_NABVerror_code@2@H@Z"},{"address":{"type":"absolute","value":4202368},"name":"?DecodeBody@Inflator@CryptoPP@@AAE_NXZ"},{"address":{"type":"absolute","value":4203056},"name":"??_G_Iostream_error_category2@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4203232},"name":"?"},{"address":{"type":"absolute","value":4203952},"name":"??$_Fputc@D@std@@YA_NDPAU_iobuf@@@Z"},{"address":{"type":"absolute","value":4203984},"name":"??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4208816},"name":"?imbue@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z"},{"address":{"type":"absolute","value":4208848},"name":"?sync@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4210592},"name":"?underflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4211232},"name":"??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ"},{"address":{"type":"absolute","value":4212240},"name":"?underflow@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4212336},"name":"?pbackfail@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHH@Z"},{"address":{"type":"absolute","value":4212880},"name":"??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ"},{"address":{"type":"absolute","value":4213648},"name":"?"},{"address":{"type":"absolute","value":4213664},"name":"?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z"},{"address":{"type":"absolute","value":4213712},"name":"?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z"},{"address":{"type":"absolute","value":4214208},"name":"?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4214272},"name":"?"},{"address":{"type":"absolute","value":4214288},"name":"?"},{"address":{"type":"absolute","value":4214448},"name":"??_G?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4214544},"name":"??_G?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4214784},"name":"??_G?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4214912},"name":"??_G?$basic_istream@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4215040},"name":"??_G?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4215280},"name":"??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4215392},"name":"?do_length@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z"},{"address":{"type":"absolute","value":4215424},"name":"?"},{"address":{"type":"absolute","value":4215456},"name":"?"},{"address":{"type":"absolute","value":4215760},"name":"?_Reset_back@?$basic_filebuf@DU?$char_traits@D@std@@@std@@AAEXXZ"},{"address":{"type":"absolute","value":4216400},"name":"?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ"},{"address":{"type":"absolute","value":4216992},"name":"??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z"},{"address":{"type":"absolute","value":4217152},"name":"?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ"},{"address":{"type":"absolute","value":4217184},"name":"?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ"},{"address":{"type":"absolute","value":4217296},"name":"?"},{"address":{"type":"absolute","value":4221824},"name":"@__security_check_cookie@4"},{"address":{"type":"absolute","value":4221841},"name":"___raise_securityfailure"},{"address":{"type":"absolute","value":4222130},"name":"___report_rangecheckfailure"},{"address":{"type":"absolute","value":4222142},"name":"___report_securityfailure"},{"address":{"type":"absolute","value":4222348},"name":"??2@YAPAXI@Z"},{"address":{"type":"absolute","value":4222434},"name":"?__scrt_initialize_thread_safe_statics@@YAHXZ"},{"address":{"type":"absolute","value":4222473},"name":"?"},{"address":{"type":"absolute","value":4222502},"name":"?__scrt_initialize_thread_safe_statics_platform_specific@@YAXXZ"},{"address":{"type":"absolute","value":4222769},"name":"__Init_thread_footer"},{"address":{"type":"absolute","value":4222843},"name":"__Init_thread_header"},{"address":{"type":"absolute","value":4222993},"name":"__Init_thread_wait"},{"address":{"type":"absolute","value":4223089},"name":"??_M@YGXPAXIIP6EX0@Z@Z"},{"address":{"type":"absolute","value":4223222},"name":"?__ArrayUnwind@@YGXPAXIIP6EX0@Z@Z"},{"address":{"type":"absolute","value":4223343},"name":"?find_pe_section@@YAPAU_IMAGE_SECTION_HEADER@@QAEI@Z"},{"address":{"type":"absolute","value":4223411},"name":"___scrt_acquire_startup_lock"},{"address":{"type":"absolute","value":4223461},"name":"___scrt_initialize_crt"},{"address":{"type":"absolute","value":4223518},"name":"___scrt_initialize_onexit_tables"},{"address":{"type":"absolute","value":4223683},"name":"___scrt_is_nonwritable_in_current_image"},{"address":{"type":"absolute","value":4223831},"name":"___scrt_release_startup_lock"},{"address":{"type":"absolute","value":4223860},"name":"___scrt_uninitialize_crt"},{"address":{"type":"absolute","value":4223900},"name":"__onexit"},{"address":{"type":"absolute","value":4223959},"name":"_atexit"},{"address":{"type":"absolute","value":4223980},"name":"?"},{"address":{"type":"absolute","value":4224195},"name":"?post_pgo_initialization@@YAHXZ"},{"address":{"type":"absolute","value":4224601},"name":"_mainCRTStartup"},{"address":{"type":"absolute","value":4224713},"name":"?"},{"address":{"type":"absolute","value":4224816},"name":"___scrt_fastfail"},{"address":{"type":"absolute","value":4225098},"name":"___scrt_get_show_window_mode"},{"address":{"type":"absolute","value":4225152},"name":"?"},{"address":{"type":"absolute","value":4225312},"name":"__SEH_prolog4"},{"address":{"type":"absolute","value":4225382},"name":"__SEH_epilog4"},{"address":{"type":"absolute","value":4225403},"name":"___isa_available_init"},{"address":{"type":"absolute","value":4225814},"name":"_Curl_tls_keylog_enabled"},{"address":{"type":"absolute","value":4225826},"name":"___get_entropy"},{"address":{"type":"absolute","value":4225903},"name":"___security_init_cookie"},{"address":{"type":"absolute","value":4226035},"name":"___scrt_initialize_default_local_stdio_options"},{"address":{"type":"absolute","value":4226397},"name":"??1GlobalCore@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4226410},"name":"??_EGlobalCore@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4226634},"name":"?"},{"address":{"type":"absolute","value":4226872},"name":"?wait@stl_condition_variable_concrt@details@Concurrency@@UAEXPAVstl_critical_section_interface@23@@Z"},{"address":{"type":"absolute","value":4226894},"name":"?wait@stl_condition_variable_vista@details@Concurrency@@UAEXPAVstl_critical_section_interface@23@@Z"},{"address":{"type":"absolute","value":4226921},"name":"?wait@stl_condition_variable_win7@details@Concurrency@@UAEXPAVstl_critical_section_interface@23@@Z"},{"address":{"type":"absolute","value":4226948},"name":"?wait_for@stl_condition_variable_concrt@details@Concurrency@@UAE_NPAVstl_critical_section_interface@23@I@Z"},{"address":{"type":"absolute","value":4226973},"name":"?wait_for@stl_condition_variable_vista@details@Concurrency@@UAE_NPAVstl_critical_section_interface@23@I@Z"},{"address":{"type":"absolute","value":4227007},"name":"?wait_for@stl_condition_variable_win7@details@Concurrency@@UAE_NPAVstl_critical_section_interface@23@I@Z"},{"address":{"type":"absolute","value":4227043},"name":"__Cnd_broadcast"},{"address":{"type":"absolute","value":4227074},"name":"__Cnd_destroy"},{"address":{"type":"absolute","value":4227100},"name":"__Cnd_destroy_in_situ"},{"address":{"type":"absolute","value":4227129},"name":"__Cnd_init"},{"address":{"type":"absolute","value":4227180},"name":"__Cnd_signal"},{"address":{"type":"absolute","value":4227232},"name":"??0_Init_locks@std@@QAE@XZ"},{"address":{"type":"absolute","value":4227277},"name":"??0_Lockit@std@@QAE@H@Z"},{"address":{"type":"absolute","value":4227365},"name":"??1_Lockit@std@@QAE@XZ"},{"address":{"type":"absolute","value":4227420},"name":"?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z"},{"address":{"type":"absolute","value":4227548},"name":"?_Throw_C_error@std@@YAXH@Z"},{"address":{"type":"absolute","value":4227593},"name":"?_Throw_Cpp_error@std@@YAXH@Z"},{"address":{"type":"absolute","value":4227735},"name":"??0_Locimp@locale@std@@AAE@_N@Z"},{"address":{"type":"absolute","value":4227800},"name":"??1_Fac_node@std@@QAE@XZ"},{"address":{"type":"absolute","value":4227934},"name":"??1_Locimp@locale@std@@MAE@XZ"},{"address":{"type":"absolute","value":4228023},"name":"??_G_Locimp@locale@std@@MAEPAXI@Z"},{"address":{"type":"absolute","value":4228057},"name":"?_Facet_Register@std@@YAXPAV_Facet_base@1@@Z"},{"address":{"type":"absolute","value":4228107},"name":"?_Init@locale@std@@CAPAV_Locimp@12@_N@Z"},{"address":{"type":"absolute","value":4228251},"name":"?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4228370},"name":"?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z"},{"address":{"type":"absolute","value":4228445},"name":"?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z"},{"address":{"type":"absolute","value":4228471},"name":"?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z"},{"address":{"type":"absolute","value":4228506},"name":"?_Setgloballocale@locale@std@@CAXPAX@Z"},{"address":{"type":"absolute","value":4228546},"name":"__Deletegloballocale"},{"address":{"type":"absolute","value":4228605},"name":"_tidy_global"},{"address":{"type":"absolute","value":4228652},"name":"?_Syserror_map@std@@YAPBDH@Z"},{"address":{"type":"absolute","value":4228689},"name":"?_Addstd@ios_base@std@@SAXPAV12@@Z"},{"address":{"type":"absolute","value":4228765},"name":"?_Callfns@ios_base@std@@AAEXW4event@12@@Z"},{"address":{"type":"absolute","value":4228816},"name":"?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z"},{"address":{"type":"absolute","value":4228880},"name":"?_Tidy@ios_base@std@@AAEXXZ"},{"address":{"type":"absolute","value":4229150},"name":"__Getctype"},{"address":{"type":"absolute","value":4229254},"name":"__Tolower"},{"address":{"type":"absolute","value":4229664},"name":"?lock@stl_critical_section_concrt@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4229694},"name":"?mtx_do_lock@@YAHPAU_Mtx_internal_imp_t@@PBUxtime@@@Z"},{"address":{"type":"absolute","value":4230096},"name":"?try_lock@stl_critical_section_vista@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4230112},"name":"?try_lock@stl_critical_section_win7@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4230140},"name":"?try_lock_for@stl_critical_section_vista@details@Concurrency@@UAE_NI@Z"},{"address":{"type":"absolute","value":4230158},"name":"?try_lock_for@stl_critical_section_win7@details@Concurrency@@UAE_NI@Z"},{"address":{"type":"absolute","value":4230176},"name":"?unlock@stl_critical_section_concrt@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4230206},"name":"__Mtx_clear_owner"},{"address":{"type":"absolute","value":4230221},"name":"__Mtx_destroy"},{"address":{"type":"absolute","value":4230247},"name":"__Mtx_destroy_in_situ"},{"address":{"type":"absolute","value":4230278},"name":"__Mtx_getconcrtcs"},{"address":{"type":"absolute","value":4230289},"name":"__Mtx_init"},{"address":{"type":"absolute","value":4230339},"name":"__Mtx_init_in_situ"},{"address":{"type":"absolute","value":4230372},"name":"__Mtx_lock"},{"address":{"type":"absolute","value":4230389},"name":"__Mtx_reset_owner"},{"address":{"type":"absolute","value":4230409},"name":"__Mtx_unlock"},{"address":{"type":"absolute","value":4230452},"name":"__Cnd_do_broadcast_at_thread_exit"},{"address":{"type":"absolute","value":4230622},"name":"__Thrd_current"},{"address":{"type":"absolute","value":4230720},"name":"__Thrd_equal"},{"address":{"type":"absolute","value":4230736},"name":"__Thrd_start"},{"address":{"type":"absolute","value":4230781},"name":"__Toupper"},{"address":{"type":"absolute","value":4231035},"name":"__Xtime_diff_to_millis2"},{"address":{"type":"absolute","value":4231099},"name":"__Xtime_get_ticks"},{"address":{"type":"absolute","value":4231138},"name":"_xtime_diff"},{"address":{"type":"absolute","value":4231317},"name":"_xtime_get"},{"address":{"type":"absolute","value":4231386},"name":"?initialize_pointers@@YAHXZ"},{"address":{"type":"absolute","value":4232324},"name":"?"},{"address":{"type":"absolute","value":4232356},"name":"?"},{"address":{"type":"absolute","value":4232390},"name":"?"},{"address":{"type":"absolute","value":4232424},"name":"___crtCreateEventExW"},{"address":{"type":"absolute","value":4232494},"name":"___crtCreateSemaphoreExW"},{"address":{"type":"absolute","value":4232582},"name":"?"},{"address":{"type":"absolute","value":4232626},"name":"?"},{"address":{"type":"absolute","value":4232670},"name":"___crtFlushProcessWriteBuffers"},{"address":{"type":"absolute","value":4232697},"name":"?"},{"address":{"type":"absolute","value":4232734},"name":"___crtGetCurrentProcessorNumber"},{"address":{"type":"absolute","value":4232844},"name":"___crtInitOnceExecuteOnce"},{"address":{"type":"absolute","value":4232986},"name":"?"},{"address":{"type":"absolute","value":4233018},"name":"___crtInitializeCriticalSectionEx"},{"address":{"type":"absolute","value":4233075},"name":"?"},{"address":{"type":"absolute","value":4233107},"name":"?"},{"address":{"type":"absolute","value":4233139},"name":"___crtSetThreadpoolTimer"},{"address":{"type":"absolute","value":4233182},"name":"___crtSetThreadpoolWait"},{"address":{"type":"absolute","value":4233222},"name":"?"},{"address":{"type":"absolute","value":4233260},"name":"___crtSleepConditionVariableSRW"},{"address":{"type":"absolute","value":4233301},"name":"?"},{"address":{"type":"absolute","value":4233333},"name":"?"},{"address":{"type":"absolute","value":4233370},"name":"?"},{"address":{"type":"absolute","value":4233402},"name":"?"},{"address":{"type":"absolute","value":4233448},"name":"__Mtxinit"},{"address":{"type":"absolute","value":4233499},"name":"??1_Init_atexit@@QAE@XZ"},{"address":{"type":"absolute","value":4233598},"name":"?_Atexit@@YAXP6AXXZ@Z"},{"address":{"type":"absolute","value":4233644},"name":"___crtLCMapStringA"},{"address":{"type":"absolute","value":4234113},"name":"__freea"},{"address":{"type":"absolute","value":4234143},"name":"_GetTableIndexFromLocaleName"},{"address":{"type":"absolute","value":4234221},"name":"___crtDownlevelLocaleNameToLCID"},{"address":{"type":"absolute","value":4234350},"name":"___wcsnicmp_ascii"},{"address":{"type":"absolute","value":4234454},"name":"??0CAtlBaseModule@ATL@@QAE@XZ"},{"address":{"type":"absolute","value":4234537},"name":"??0_ATL_BASE_MODULE70@ATL@@QAE@XZ"},{"address":{"type":"absolute","value":4234624},"name":"??0_com_error@@QAE@ABV0@@Z"},{"address":{"type":"absolute","value":4234688},"name":"??0_com_error@@QAE@JPAUIErrorInfo@@_N@Z"},{"address":{"type":"absolute","value":4234768},"name":"??1_com_error@@UAE@XZ"},{"address":{"type":"absolute","value":4234832},"name":"??_G_com_error@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4234912},"name":"?_com_raise_error@@YGXJPAUIErrorInfo@@@Z"},{"address":{"type":"absolute","value":4234949},"name":"?GetRangeOfTrysToCheck@__FrameHandler3@@SA?AU?$pair@Viterator@TryBlockMap@__FrameHandler3@@V123@@std@@AAVTryBlockMap@1@HH@Z"},{"address":{"type":"absolute","value":4235079},"name":"?_CallCatchBlock2@@YAPAXPAUEHRegistrationNode@@PBU_s_FuncInfo@@PAXHK@Z"},{"address":{"type":"absolute","value":4235173},"name":"?_CallSETranslator@@YAHPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAX2PBU_s_FuncInfo@@H1@Z"},{"address":{"type":"absolute","value":4235392},"name":"?_JumpToContinuation@@YGXPAXPAUEHRegistrationNode@@@Z"},{"address":{"type":"absolute","value":4235440},"name":"?_UnwindNestedFrames@@YGXPAUEHRegistrationNode@@PAUEHExceptionRecord@@@Z"},{"address":{"type":"absolute","value":4235523},"name":"?"},{"address":{"type":"absolute","value":4235572},"name":"__CreateFrameInfo"},{"address":{"type":"absolute","value":4235608},"name":"__FindAndUnlinkFrame"},{"address":{"type":"absolute","value":4235677},"name":"?"},{"address":{"type":"absolute","value":4235888},"name":"___DestructExceptionObject"},{"address":{"type":"absolute","value":4236048},"name":"?_CallMemberFunction0@@YGXQAX0@Z"},{"address":{"type":"absolute","value":4236061},"name":"__IsExceptionObjectToBeDestroyed"},{"address":{"type":"absolute","value":4236099},"name":"___AdjustPointer"},{"address":{"type":"absolute","value":4236136},"name":"___FrameUnwindFilter"},{"address":{"type":"absolute","value":4236205},"name":"___current_exception"},{"address":{"type":"absolute","value":4236214},"name":"___processing_throw"},{"address":{"type":"absolute","value":4236223},"name":"___std_terminate"},{"address":{"type":"absolute","value":4236240},"name":"_ValidateLocalCookies"},{"address":{"type":"absolute","value":4236304},"name":"__except_handler4"},{"address":{"type":"absolute","value":4236647},"name":"___std_exception_copy"},{"address":{"type":"absolute","value":4236746},"name":"___std_exception_destroy"},{"address":{"type":"absolute","value":4236777},"name":"___std_type_info_compare"},{"address":{"type":"absolute","value":4236837},"name":"__get_purecall_handler"},{"address":{"type":"absolute","value":4236858},"name":"__purecall"},{"address":{"type":"absolute","value":4236886},"name":"___vcrt_initialize"},{"address":{"type":"absolute","value":4236927},"name":"___vcrt_uninitialize"},{"address":{"type":"absolute","value":4236958},"name":"__CxxThrowException@8"},{"address":{"type":"absolute","value":4237072},"name":"_memset"},{"address":{"type":"absolute","value":4237424},"name":"?"},{"address":{"type":"absolute","value":4238028},"name":"?"},{"address":{"type":"absolute","value":4238092},"name":"?"},{"address":{"type":"absolute","value":4238268},"name":"?"},{"address":{"type":"absolute","value":4238832},"name":"?"},{"address":{"type":"absolute","value":4239436},"name":"?"},{"address":{"type":"absolute","value":4239500},"name":"?"},{"address":{"type":"absolute","value":4239676},"name":"?"},{"address":{"type":"absolute","value":4240413},"name":"___uncaught_exception"},{"address":{"type":"absolute","value":4240433},"name":"_memcmp"},{"address":{"type":"absolute","value":4244437},"name":"___vcrt_freefls@4"},{"address":{"type":"absolute","value":4244465},"name":"___vcrt_getptd"},{"address":{"type":"absolute","value":4244479},"name":"___vcrt_getptd_noexit"},{"address":{"type":"absolute","value":4244625},"name":"___vcrt_getptd_noinit"},{"address":{"type":"absolute","value":4244680},"name":"___vcrt_initialize_ptd"},{"address":{"type":"absolute","value":4244731},"name":"___vcrt_uninitialize_ptd"},{"address":{"type":"absolute","value":4244758},"name":"??$BuildCatchObjectHelperInternal@$$CBU_s_HandlerType@@@@YAHPAUEHExceptionRecord@@PAXPBU_s_HandlerType@@PBU_s_CatchableType@@@Z"},{"address":{"type":"absolute","value":4245077},"name":"??$BuildCatchObjectInternal@$$CBU_s_HandlerType@@@@YAXPAUEHExceptionRecord@@PAXPBU_s_HandlerType@@PBU_s_CatchableType@@@Z"},{"address":{"type":"absolute","value":4245230},"name":"??$CatchIt@V__FrameHandler3@@@@YAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@PBU_s_HandlerType@@PBU_s_CatchableType@@PBU_s_TryBlockMapEntry@@H1E@Z"},{"address":{"type":"absolute","value":4245358},"name":"??$FindHandler@V__FrameHandler3@@@@YAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@EH1@Z"},{"address":{"type":"absolute","value":4246268},"name":"??$FindHandlerForForeignException@V__FrameHandler3@@@@YAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@HH1@Z"},{"address":{"type":"absolute","value":4246541},"name":"?"},{"address":{"type":"absolute","value":4246683},"name":"??$__InternalCxxFrameHandler@V__FrameHandler3@@@@YA?AW4_EXCEPTION_DISPOSITION@@PAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@H1E@Z"},{"address":{"type":"absolute","value":4246992},"name":"?CallCatchBlock@@YAPAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PBU_s_FuncInfo@@PAXHK@Z"},{"address":{"type":"absolute","value":4247444},"name":"?CallUnexpected@@YAXPBU_s_ESTypeList@@@Z"},{"address":{"type":"absolute","value":4247476},"name":"__catch$?CallUnexpected@@YAXPBU_s_ESTypeList@@@Z$0"},{"address":{"type":"absolute","value":4247502},"name":"?ExFilterRethrow@@YAHPAU_EXCEPTION_POINTERS@@@Z"},{"address":{"type":"absolute","value":4247576},"name":"?FrameUnwindToEmptyState@__FrameHandler3@@SAXPAUEHRegistrationNode@@PAXPBU_s_FuncInfo@@@Z"},{"address":{"type":"absolute","value":4247600},"name":"?FrameUnwindToState@__FrameHandler3@@SAXPAUEHRegistrationNode@@PAXPBU_s_FuncInfo@@H@Z"},{"address":{"type":"absolute","value":4247832},"name":"?IsInExceptionSpec@@YAEPAUEHExceptionRecord@@PBU_s_ESTypeList@@@Z"},{"address":{"type":"absolute","value":4247986},"name":"?_CallMemberFunction1@@YGXQAX00@Z"},{"address":{"type":"absolute","value":4248002},"name":"?_CallMemberFunction2@@YGXQAX00H@Z"},{"address":{"type":"absolute","value":4248021},"name":"?"},{"address":{"type":"absolute","value":4248032},"name":"__CallSettingFrame@12"},{"address":{"type":"absolute","value":4248108},"name":"___except_validate_context_record"},{"address":{"type":"absolute","value":4248156},"name":"___except_validate_jump_buffer"},{"address":{"type":"absolute","value":4248208},"name":"__local_unwind4"},{"address":{"type":"absolute","value":4248352},"name":"__unwind_handler4"},{"address":{"type":"absolute","value":4248464},"name":"@_EH4_CallFilterFunc@8"},{"address":{"type":"absolute","value":4248488},"name":"@_EH4_TransferToHandler@8"},{"address":{"type":"absolute","value":4248516},"name":"@_EH4_GlobalUnwind2@8"},{"address":{"type":"absolute","value":4248544},"name":"@_EH4_LocalUnwind@16"},{"address":{"type":"absolute","value":4248578},"name":"___vcrt_initialize_locks"},{"address":{"type":"absolute","value":4248638},"name":"___vcrt_uninitialize_locks"},{"address":{"type":"absolute","value":4248685},"name":"?try_get_first_available_module@@YAPAUHINSTANCE__@@QBW4module_id@?A0xbf9eb92d@@0@Z"},{"address":{"type":"absolute","value":4248881},"name":"?try_get_function@@YAPAXW4function_id@?A0xbf9eb92d@@QBDQBW4module_id@2@2@Z"},{"address":{"type":"absolute","value":4248992},"name":"___vcrt_FlsAlloc"},{"address":{"type":"absolute","value":4249051},"name":"___vcrt_FlsFree"},{"address":{"type":"absolute","value":4249110},"name":"___vcrt_FlsGetValue"},{"address":{"type":"absolute","value":4249169},"name":"___vcrt_FlsSetValue"},{"address":{"type":"absolute","value":4249231},"name":"___vcrt_InitializeCriticalSectionEx"},{"address":{"type":"absolute","value":4249302},"name":"___vcrt_initialize_winapi_thunks"},{"address":{"type":"absolute","value":4249343},"name":"___vcrt_uninitialize_winapi_thunks"},{"address":{"type":"absolute","value":4249393},"name":"_unexpected"},{"address":{"type":"absolute","value":4249422},"name":"?GetCurrentState@__FrameHandler3@@SAHPAUEHRegistrationNode@@PAXPBU_s_FuncInfo@@@Z"},{"address":{"type":"absolute","value":4249451},"name":"?SetState@__FrameHandler3@@SAXPAUEHRegistrationNode@@PBU_s_FuncInfo@@H@Z"},{"address":{"type":"absolute","value":4249472},"name":"__global_unwind2"},{"address":{"type":"absolute","value":4249505},"name":"__unwind_handler"},{"address":{"type":"absolute","value":4249574},"name":"__local_unwind2"},{"address":{"type":"absolute","value":4249740},"name":"_at_done"},{"address":{"type":"absolute","value":4249744},"name":"__NLG_Notify1"},{"address":{"type":"absolute","value":4249756},"name":"__NLG_Notify"},{"address":{"type":"absolute","value":4249787},"name":"__NLG_Call"},{"address":{"type":"absolute","value":4249790},"name":"??0_LocaleUpdate@@QAE@QAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4249921},"name":"?"},{"address":{"type":"absolute","value":4249970},"name":"___acrt_call_reportfault"},{"address":{"type":"absolute","value":4250305},"name":"__invalid_parameter"},{"address":{"type":"absolute","value":4250428},"name":"__invalid_parameter_noinfo"},{"address":{"type":"absolute","value":4250444},"name":"__invalid_parameter_noinfo_noreturn"},{"address":{"type":"absolute","value":4250473},"name":"__invoke_watson"},{"address":{"type":"absolute","value":4250524},"name":"__resetstkoflw"},{"address":{"type":"absolute","value":4250733},"name":"?"},{"address":{"type":"absolute","value":4250764},"name":"?atexit_exception_filter@@YAHK@Z"},{"address":{"type":"absolute","value":4250783},"name":"?common_exit@@YAXHW4_crt_exit_cleanup_mode@@W4_crt_exit_return_mode@@@Z"},{"address":{"type":"absolute","value":4251064},"name":"?exit_or_terminate_process@@YAXI@Z"},{"address":{"type":"absolute","value":4251129},"name":"?"},{"address":{"type":"absolute","value":4251197},"name":"?try_cor_exit_process@@YAXI@Z"},{"address":{"type":"absolute","value":4251303},"name":"?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z"},{"address":{"type":"absolute","value":4251318},"name":"__c_exit"},{"address":{"type":"absolute","value":4251333},"name":"__cexit"},{"address":{"type":"absolute","value":4251348},"name":"?"},{"address":{"type":"absolute","value":4251370},"name":"__register_thread_local_exe_atexit_callback"},{"address":{"type":"absolute","value":4251426},"name":"_exit"},{"address":{"type":"absolute","value":4251572},"name":"??$common_ftell_nolock@_J@@YA_JV__crt_stdio_stream@@@Z"},{"address":{"type":"absolute","value":4251977},"name":"?common_ftell_read_mode_nolock@@YA_JV__crt_stdio_stream@@_J1@Z"},{"address":{"type":"absolute","value":4252365},"name":"?common_ftell_translated_utf8_nolock@@YA_JV__crt_stdio_stream@@_J@Z"},{"address":{"type":"absolute","value":4252798},"name":"__fputc_nolock"},{"address":{"type":"absolute","value":4252839},"name":"_fputc"},{"address":{"type":"absolute","value":4253099},"name":"_calloc"},{"address":{"type":"absolute","value":4253143},"name":"_srand"},{"address":{"type":"absolute","value":4253485},"name":"?_mbstowcs_l_helper@@YAIPA_WPBDIPAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4253862},"name":"__mbstowcs_s_l"},{"address":{"type":"absolute","value":4254089},"name":"_mbstowcs_s"},{"address":{"type":"absolute","value":4254121},"name":"___acrt_stdio_flush_nolock"},{"address":{"type":"absolute","value":4254223},"name":"__fflush_nolock"},{"address":{"type":"absolute","value":4254294},"name":"__flushall"},{"address":{"type":"absolute","value":4254303},"name":"_common_flush_all"},{"address":{"type":"absolute","value":4254519},"name":"_fflush"},{"address":{"type":"absolute","value":4254608},"name":"?unget@?$c_string_character_source@D@__crt_strtox@@QAEXD@Z"},{"address":{"type":"absolute","value":4254648},"name":"?unget@?$c_string_character_source@_W@__crt_strtox@@QAEX_W@Z"},{"address":{"type":"absolute","value":4254692},"name":"?"},{"address":{"type":"absolute","value":4254719},"name":"__chvalidchk_l"},{"address":{"type":"absolute","value":4254761},"name":"__ischartype_l"},{"address":{"type":"absolute","value":4254812},"name":"__fclose_nolock"},{"address":{"type":"absolute","value":4254930},"name":"_fclose"},{"address":{"type":"absolute","value":4255058},"name":"?LongLongSub@@YAJ_J0PA_J@Z"},{"address":{"type":"absolute","value":4255187},"name":"?common_fseek@@YAHV__crt_stdio_stream@@_JH@Z"},{"address":{"type":"absolute","value":4255322},"name":"?common_fseek_binary_mode_read_only_fast_track_nolock@@YA_NV__crt_stdio_stream@@_JH@Z"},{"address":{"type":"absolute","value":4255539},"name":"?common_fseek_nolock@@YAHV__crt_stdio_stream@@_JH@Z"},{"address":{"type":"absolute","value":4255756},"name":"__fseeki64"},{"address":{"type":"absolute","value":4255783},"name":"_fseek"},{"address":{"type":"absolute","value":4255810},"name":"__Strftime_l"},{"address":{"type":"absolute","value":4256113},"name":"_strftime"},{"address":{"type":"absolute","value":4256144},"name":"??$common_tox_l@$1?internal_isupper_l@@YA_NHQAU__crt_locale_pointers@@@Z$1?internal_map_lower@@YAHH0@Z@@YAHHKQAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4256474},"name":"?internal_isupper_l@@YA_NHQAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4256503},"name":"__tolower_l"},{"address":{"type":"absolute","value":4256529},"name":"??$is_overflow_condition@K@__crt_strtox@@YA_NIK@Z"},{"address":{"type":"absolute","value":4256580},"name":"??$parse_integer@KV?$c_string_character_source@D@__crt_strtox@@@__crt_strtox@@YAKQAU__crt_locale_pointers@@V?$c_string_character_source@D@0@H_N@Z"},{"address":{"type":"absolute","value":4257132},"name":"??$parse_integer@KV?$c_string_character_source@_W@__crt_strtox@@@__crt_strtox@@YAKQAU__crt_locale_pointers@@V?$c_string_character_source@_W@0@H_N@Z"},{"address":{"type":"absolute","value":4258897},"name":"__fgetc_nolock"},{"address":{"type":"absolute","value":4258957},"name":"_fgetc"},{"address":{"type":"absolute","value":4259215},"name":"_terminate"},{"address":{"type":"absolute","value":4259275},"name":"__strnicmp"},{"address":{"type":"absolute","value":4259383},"name":"__strnicmp_l"},{"address":{"type":"absolute","value":4259566},"name":"___acrt_initialize_stdio"},{"address":{"type":"absolute","value":4259766},"name":"___acrt_iob_func"},{"address":{"type":"absolute","value":4259783},"name":"___acrt_uninitialize_stdio"},{"address":{"type":"absolute","value":4259859},"name":"__get_stream_buffer_pointers"},{"address":{"type":"absolute","value":4259969},"name":"___acrt_errno_from_os_error"},{"address":{"type":"absolute","value":4260036},"name":"___acrt_errno_map_os_error"},{"address":{"type":"absolute","value":4260071},"name":"___doserrno"},{"address":{"type":"absolute","value":4260090},"name":"__errno"},{"address":{"type":"absolute","value":4260230},"name":"??R<lambda_b51c0495177f500e782686251704ae76>@@QBEIXZ"},{"address":{"type":"absolute","value":4260300},"name":"__fwrite_nolock"},{"address":{"type":"absolute","value":4260677},"name":"_fwrite"},{"address":{"type":"absolute","value":4260765},"name":"??$common_getenv_nolock@D@@YAPADQBD@Z"},{"address":{"type":"absolute","value":4260962},"name":"??$common_getenv_s_nolock@D@@YAHQAIQADIQBD@Z"},{"address":{"type":"absolute","value":4261141},"name":"_fgetpos"},{"address":{"type":"absolute","value":4261353},"name":"?"},{"address":{"type":"absolute","value":4261507},"name":"?set_buffer@@YAHV__crt_stdio_stream@@QADIH@Z"},{"address":{"type":"absolute","value":4261558},"name":"_setvbuf"},{"address":{"type":"absolute","value":4261676},"name":"??$common_timespec_get@U_timespec64@@@@YAHQAU_timespec64@@H@Z"},{"address":{"type":"absolute","value":4261803},"name":"?"},{"address":{"type":"absolute","value":4261869},"name":"??$common_localtime_s@_J@@YAHQAUtm@@QB_J@Z"},{"address":{"type":"absolute","value":4262519},"name":"?"},{"address":{"type":"absolute","value":4262563},"name":"__ungetc_nolock"},{"address":{"type":"absolute","value":4262802},"name":"_ungetc"},{"address":{"type":"absolute","value":4262914},"name":"__islower_l"},{"address":{"type":"absolute","value":4262970},"name":"__isupper_l"},{"address":{"type":"absolute","value":4263026},"name":"_islower"},{"address":{"type":"absolute","value":4263071},"name":"_isupper"},{"address":{"type":"absolute","value":4263116},"name":"_fsetpos"},{"address":{"type":"absolute","value":4263175},"name":"__fread_nolock_s"},{"address":{"type":"absolute","value":4263635},"name":"_fread"},{"address":{"type":"absolute","value":4263664},"name":"_fread_s"},{"address":{"type":"absolute","value":4263811},"name":"_memcpy_s"},{"address":{"type":"absolute","value":4263940},"name":"_malloc"},{"address":{"type":"absolute","value":4263971},"name":"__callnewh"},{"address":{"type":"absolute","value":4264039},"name":"__query_new_handler"},{"address":{"type":"absolute","value":4264121},"name":"__seh_filter_exe"},{"address":{"type":"absolute","value":4264492},"name":"??$common_configure_argv@D@@YAHW4_crt_argv_mode@@@Z"},{"address":{"type":"absolute","value":4264784},"name":"??$parse_command_line@D@@YAXPADPAPAD0PAI2@Z"},{"address":{"type":"absolute","value":4265157},"name":"___acrt_allocate_buffer_for_argv"},{"address":{"type":"absolute","value":4265242},"name":"__configure_narrow_argv"},{"address":{"type":"absolute","value":4265300},"name":"??$common_initialize_environment_nolock@D@@YAHXZ"},{"address":{"type":"absolute","value":4265389},"name":"??$create_environment@D@@YAQAPADQAD@Z"},{"address":{"type":"absolute","value":4265598},"name":"?"},{"address":{"type":"absolute","value":4265645},"name":"??$initialize_environment_by_cloning_nolock@D@@YAHXZ"},{"address":{"type":"absolute","value":4265772},"name":"?"},{"address":{"type":"absolute","value":4265895},"name":"___dcrt_uninitialize_environments_nolock"},{"address":{"type":"absolute","value":4266197},"name":"??R<lambda_275893d493268fdec8709772e3fcec0e>@@QBEHXZ"},{"address":{"type":"absolute","value":4266485},"name":"?"},{"address":{"type":"absolute","value":4266828},"name":"__execute_onexit_table"},{"address":{"type":"absolute","value":4266857},"name":"__initialize_onexit_table"},{"address":{"type":"absolute","value":4266918},"name":"__register_onexit_function"},{"address":{"type":"absolute","value":4266972},"name":"_initialize_c"},{"address":{"type":"absolute","value":4266998},"name":"_uninitialize_environment"},{"address":{"type":"absolute","value":4267006},"name":"_initialize_pointers"},{"address":{"type":"absolute","value":4267067},"name":"_uninitialize_vcruntime"},{"address":{"type":"absolute","value":4267076},"name":"_uninitialize_allocated_memory"},{"address":{"type":"absolute","value":4267195},"name":"___acrt_initialize"},{"address":{"type":"absolute","value":4267213},"name":"___acrt_uninitialize"},{"address":{"type":"absolute","value":4267237},"name":"?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z"},{"address":{"type":"absolute","value":4267252},"name":"___acrt_has_user_matherr"},{"address":{"type":"absolute","value":4267297},"name":"___acrt_invoke_user_matherr"},{"address":{"type":"absolute","value":4267370},"name":"___setusermatherr"},{"address":{"type":"absolute","value":4267391},"name":"?"},{"address":{"type":"absolute","value":4267474},"name":"__initterm"},{"address":{"type":"absolute","value":4267566},"name":"__initterm_e"},{"address":{"type":"absolute","value":4267679},"name":"__set_fmode"},{"address":{"type":"absolute","value":4267740},"name":"__setmode_nolock"},{"address":{"type":"absolute","value":4268115},"name":"??R<lambda_2af78c5f5901b1372d98f9ab3177dfa6>@@QBEXXZ"},{"address":{"type":"absolute","value":4268207},"name":"?"},{"address":{"type":"absolute","value":4268461},"name":"___acrt_copy_locale_name"},{"address":{"type":"absolute","value":4268574},"name":"___acrt_uninitialize_locale"},{"address":{"type":"absolute","value":4268656},"name":"___lc_lctowcs"},{"address":{"type":"absolute","value":4268768},"name":"___lc_wcstolc"},{"address":{"type":"absolute","value":4269071},"name":"__configthreadlocale"},{"address":{"type":"absolute","value":4269169},"name":"__copytlocinfo_nolock"},{"address":{"type":"absolute","value":4269216},"name":"__expandlocale"},{"address":{"type":"absolute","value":4270103},"name":"__wcscats"},{"address":{"type":"absolute","value":4270168},"name":"__wsetlocale"},{"address":{"type":"absolute","value":4270296},"name":"__wsetlocale_get_all"},{"address":{"type":"absolute","value":4270705},"name":"__wsetlocale_nolock"},{"address":{"type":"absolute","value":4271446},"name":"__wsetlocale_set_cat"},{"address":{"type":"absolute","value":4272424},"name":"__set_new_mode"},{"address":{"type":"absolute","value":4272477},"name":"__controlfp_s"},{"address":{"type":"absolute","value":4272572},"name":"___acrt_initialize_locks"},{"address":{"type":"absolute","value":4272660},"name":"___acrt_uninitialize_locks"},{"address":{"type":"absolute","value":4272750},"name":"_wcscpy_s"},{"address":{"type":"absolute","value":4272864},"name":"_strcspn"},{"address":{"type":"absolute","value":4272934},"name":"_call_wsetlocale"},{"address":{"type":"absolute","value":4273091},"name":"_setlocale"},{"address":{"type":"absolute","value":4274089},"name":"___pctype_func"},{"address":{"type":"absolute","value":4274127},"name":"__wcsdup"},{"address":{"type":"absolute","value":4274224},"name":"____lc_codepage_func"},{"address":{"type":"absolute","value":4274263},"name":"____lc_locale_name_func"},{"address":{"type":"absolute","value":4274304},"name":"___acrt_locale_initialize_ctype"},{"address":{"type":"absolute","value":4275230},"name":"_abort"},{"address":{"type":"absolute","value":4275297},"name":"??$thread_start@P6GIPAX@Z@@YGKQAX@Z"},{"address":{"type":"absolute","value":4275422},"name":"?"},{"address":{"type":"absolute","value":4275477},"name":"?common_end_thread@@YAXI@Z"},{"address":{"type":"absolute","value":4275564},"name":"?create_thread_parameter@@YAPAU__acrt_thread_parameter@@QAX0@Z"},{"address":{"type":"absolute","value":4275637},"name":"__beginthreadex"},{"address":{"type":"absolute","value":4275770},"name":"__endthreadex"},{"address":{"type":"absolute","value":4275784},"name":"?"},{"address":{"type":"absolute","value":4275849},"name":"?compute_iso_week@@YAHHHH@Z"},{"address":{"type":"absolute","value":4275927},"name":"?compute_iso_week_internal@@YAHHHH@Z"},{"address":{"type":"absolute","value":4276076},"name":"?compute_iso_year@@YAHHHH@Z"},{"address":{"type":"absolute","value":4276119},"name":"?expand_time@@YA_NPAU__crt_locale_pointers@@_WPBUtm@@PAPA_WPAIPBU__crt_lc_time_data@@_N@Z"},{"address":{"type":"absolute","value":4278931},"name":"?store_number@@YAXHHQAPA_WQAI_W@Z"},{"address":{"type":"absolute","value":4279093},"name":"?store_number_without_lead_zeroes@@YAXHQAPA_WQAI@Z"},{"address":{"type":"absolute","value":4279196},"name":"?store_string@@YAXPB_WQAPA_WQAI@Z"},{"address":{"type":"absolute","value":4279245},"name":"?store_winword@@YA_NQAU__crt_locale_pointers@@HQBUtm@@QAPA_WQAIQBU__crt_lc_time_data@@@Z"},{"address":{"type":"absolute","value":4280380},"name":"__Wcsftime_l"},{"address":{"type":"absolute","value":4280765},"name":"___strncnt"},{"address":{"type":"absolute","value":4280793},"name":"_wcsnlen"},{"address":{"type":"absolute","value":4281232},"name":"_strcpy_s"},{"address":{"type":"absolute","value":4281322},"name":"?"},{"address":{"type":"absolute","value":4281349},"name":"?"},{"address":{"type":"absolute","value":4281391},"name":"?"},{"address":{"type":"absolute","value":4281440},"name":"_strncmp"},{"address":{"type":"absolute","value":4281560},"name":"_wcsncmp"},{"address":{"type":"absolute","value":4281676},"name":"__malloc_base"},{"address":{"type":"absolute","value":4281754},"name":"__mbtowc_l"},{"address":{"type":"absolute","value":4282004},"name":"_mbtowc"},{"address":{"type":"absolute","value":4282514},"name":"?construct_ptd@@YAXQAU__acrt_ptd@@QAPAU__crt_locale_data@@@Z"},{"address":{"type":"absolute","value":4282635},"name":"?destroy_fls@@YGXPAX@Z"},{"address":{"type":"absolute","value":4282668},"name":"?destroy_ptd@@YAXQAU__acrt_ptd@@@Z"},{"address":{"type":"absolute","value":4282837},"name":"?replace_current_thread_locale_nolock@@YAXQAU__acrt_ptd@@QAU__crt_locale_data@@@Z"},{"address":{"type":"absolute","value":4282912},"name":"___acrt_getptd"},{"address":{"type":"absolute","value":4283044},"name":"___acrt_getptd_noexit"},{"address":{"type":"absolute","value":4283177},"name":"___acrt_initialize_ptd"},{"address":{"type":"absolute","value":4283221},"name":"___acrt_uninitialize_ptd"},{"address":{"type":"absolute","value":4283337},"name":"__fileno"},{"address":{"type":"absolute","value":4283375},"name":"___acrt_stdio_begin_temporary_buffering_nolock"},{"address":{"type":"absolute","value":4283556},"name":"___acrt_stdio_end_temporary_buffering_nolock"},{"address":{"type":"absolute","value":4283613},"name":"?initialize_inherited_file_handles_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4283795},"name":"?initialize_stdio_handles_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4283977},"name":"___acrt_initialize_lowio"},{"address":{"type":"absolute","value":4284063},"name":"___acrt_uninitialize_lowio"},{"address":{"type":"absolute","value":4284107},"name":"?"},{"address":{"type":"absolute","value":4284375},"name":"?try_get_function@@YAPAXW4function_id@?A0x352e5c4b@@QBDQBW4module_id@2@2@Z"},{"address":{"type":"absolute","value":4284531},"name":"?try_get_module@@YAPAUHINSTANCE__@@W4module_id@?A0x352e5c4b@@@Z"},{"address":{"type":"absolute","value":4284654},"name":"___acrt_AreFileApisANSI@0"},{"address":{"type":"absolute","value":4284848},"name":"___acrt_EnumSystemLocalesEx@16"},{"address":{"type":"absolute","value":4284957},"name":"___acrt_FlsAlloc@4"},{"address":{"type":"absolute","value":4285043},"name":"___acrt_FlsFree@4"},{"address":{"type":"absolute","value":4285129},"name":"___acrt_FlsGetValue@4"},{"address":{"type":"absolute","value":4285215},"name":"___acrt_FlsSetValue@8"},{"address":{"type":"absolute","value":4285304},"name":"___acrt_GetDateFormatEx@28"},{"address":{"type":"absolute","value":4285434},"name":"___acrt_GetLocaleInfoEx@16"},{"address":{"type":"absolute","value":4285540},"name":"___acrt_GetSystemTimePreciseAsFileTime@4"},{"address":{"type":"absolute","value":4285626},"name":"___acrt_GetTimeFormatEx@24"},{"address":{"type":"absolute","value":4285738},"name":"___acrt_GetUserDefaultLocaleName@8"},{"address":{"type":"absolute","value":4285841},"name":"___acrt_InitializeCriticalSectionEx@12"},{"address":{"type":"absolute","value":4285939},"name":"___acrt_IsValidLocaleName@4"},{"address":{"type":"absolute","value":4286038},"name":"___acrt_LCIDToLocaleName@16"},{"address":{"type":"absolute","value":4286144},"name":"___acrt_LCMapStringEx@36"},{"address":{"type":"absolute","value":4286280},"name":"___acrt_LocaleNameToLCID@8"},{"address":{"type":"absolute","value":4286372},"name":"___acrt_RoInitialize@4"},{"address":{"type":"absolute","value":4286454},"name":"___acrt_RoUninitialize@0"},{"address":{"type":"absolute","value":4286527},"name":"___acrt_SetThreadStackGuarantee@4"},{"address":{"type":"absolute","value":4286621},"name":"___acrt_initialize_winapi_thunks"},{"address":{"type":"absolute","value":4286659},"name":"___acrt_is_packaged_app"},{"address":{"type":"absolute","value":4286794},"name":"___acrt_uninitialize_winapi_thunks"},{"address":{"type":"absolute","value":4286848},"name":"??$common_lseek@_J@@YA_JH_JH@Z"},{"address":{"type":"absolute","value":4287109},"name":"??$common_lseek_nolock@_J@@YA_JH_JH@Z"},{"address":{"type":"absolute","value":4287235},"name":"__lseeki64"},{"address":{"type":"absolute","value":4287262},"name":"__lseeki64_nolock"},{"address":{"type":"absolute","value":4287289},"name":"??$translate_text_mode_nolock@D@@YAHHQADI@Z"},{"address":{"type":"absolute","value":4287632},"name":"??$translate_text_mode_nolock@_W@@YAHHQA_WI@Z"},{"address":{"type":"absolute","value":4288080},"name":"?translate_ansi_or_utf8_nolock@@YAHHQADIQA_WI@Z"},{"address":{"type":"absolute","value":4288416},"name":"?translate_utf16_from_console_nolock@@YAHHQA_WI@Z"},{"address":{"type":"absolute","value":4288545},"name":"__read"},{"address":{"type":"absolute","value":4288820},"name":"__read_nolock"},{"address":{"type":"absolute","value":4290042},"name":"??$write_buffer_nolock@D@@YA_NDV__crt_stdio_stream@@@Z"},{"address":{"type":"absolute","value":4290257},"name":"__calloc_base"},{"address":{"type":"absolute","value":4290350},"name":"?__acrt_stdio_allocate_stream@@YA?AV__crt_stdio_stream@@XZ"},{"address":{"type":"absolute","value":4290445},"name":"?__acrt_stdio_free_stream@@YAXV__crt_stdio_stream@@@Z"},{"address":{"type":"absolute","value":4290504},"name":"?find_or_allocate_unused_stream_nolock@@YA?AV__crt_stdio_stream@@XZ"},{"address":{"type":"absolute","value":4290699},"name":"??$__acrt_stdio_parse_mode@D@@YA?AU__acrt_stdio_stream_mode@@QBD@Z"},{"address":{"type":"absolute","value":4291394},"name":"?__acrt_stdio_parse_mode_D@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291421},"name":"?__acrt_stdio_parse_mode_T@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291452},"name":"?__acrt_stdio_parse_mode_b@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291484},"name":"?__acrt_stdio_parse_mode_c@@YA_NAAU__acrt_stdio_stream_mode@@AA_N@Z"},{"address":{"type":"absolute","value":4291518},"name":"?__acrt_stdio_parse_mode_n@@YA_NAAU__acrt_stdio_stream_mode@@AA_N@Z"},{"address":{"type":"absolute","value":4291552},"name":"?__acrt_stdio_parse_mode_plus@@YA_NAAU__acrt_stdio_stream_mode@@AA_N@Z"},{"address":{"type":"absolute","value":4291605},"name":"?__acrt_stdio_parse_mode_t@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291648},"name":"?"},{"address":{"type":"absolute","value":4291699},"name":"__realloc_base"},{"address":{"type":"absolute","value":4291804},"name":"__isleadbyte_l"},{"address":{"type":"absolute","value":4292053},"name":"__commit"},{"address":{"type":"absolute","value":4292164},"name":"?write_double_translated_ansi_nolock@@YA?AUwrite_result@?A0x47fa6670@@HQBDI@Z"},{"address":{"type":"absolute","value":4292599},"name":"?"},{"address":{"type":"absolute","value":4292708},"name":"?write_requires_double_translation_nolock@@YA_NH@Z"},{"address":{"type":"absolute","value":4292826},"name":"?"},{"address":{"type":"absolute","value":4293049},"name":"?write_text_utf16le_nolock@@YA?AUwrite_result@?A0x47fa6670@@HQBDI@Z"},{"address":{"type":"absolute","value":4293287},"name":"?write_text_utf8_nolock@@YA?AUwrite_result@?A0x47fa6670@@HQBDI@Z"},{"address":{"type":"absolute","value":4293823},"name":"__write_nolock"},{"address":{"type":"absolute","value":4294347},"name":"_iswctype"},{"address":{"type":"absolute","value":4294442},"name":"__isctype_l"},{"address":{"type":"absolute","value":4294949},"name":"__close_nolock"},{"address":{"type":"absolute","value":4295105},"name":"___acrt_stdio_free_buffer_nolock"},{"address":{"type":"absolute","value":4295167},"name":"___acrt_copy_path_to_wide_string"},{"address":{"type":"absolute","value":4295366},"name":"?__acrt_LCMapStringA_stat@@YAHPAU__crt_locale_pointers@@PB_WKPBDHPADHHH@Z"},{"address":{"type":"absolute","value":4295907},"name":"___acrt_LCMapStringA"},{"address":{"type":"absolute","value":4296384},"name":"___ascii_strnicmp"},{"address":{"type":"absolute","value":4296481},"name":"__fcloseall"},{"address":{"type":"absolute","value":4296641},"name":"__strnicoll"},{"address":{"type":"absolute","value":4296682},"name":"__strnicoll_l"},{"address":{"type":"absolute","value":4296884},"name":"___acrt_initialize_timeset"},{"address":{"type":"absolute","value":4297095},"name":"?"},{"address":{"type":"absolute","value":4297486},"name":"?compute_year@@YAHAA_JAA_N@Z"},{"address":{"type":"absolute","value":4297650},"name":"___getgmtimebuf"},{"address":{"type":"absolute","value":4297723},"name":"?_isindst_nolock@@YAHQAUtm@@@Z"},{"address":{"type":"absolute","value":4298210},"name":"?cvtdate@@YAXW4transition_type@?A0xdb49773f@@W4date_type@2@HHHHHHHHH@Z"},{"address":{"type":"absolute","value":4298546},"name":"?tzset_from_environment_nolock@@YAXPAD@Z"},{"address":{"type":"absolute","value":4299015},"name":"?tzset_from_system_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4299362},"name":"?tzset_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4299586},"name":"___tzset"},{"address":{"type":"absolute","value":4299667},"name":"__isindst"},{"address":{"type":"absolute","value":4299741},"name":"___acrt_stdio_allocate_buffer_nolock"},{"address":{"type":"absolute","value":4299834},"name":"??$common_xtox@K_W@@YAHKQA_WII_N@Z"},{"address":{"type":"absolute","value":4299976},"name":"??$common_xtox_s@K_W@@YAHKQA_WII_N@Z"},{"address":{"type":"absolute","value":4300071},"name":"?"},{"address":{"type":"absolute","value":4300124},"name":"_wcscat_s"},{"address":{"type":"absolute","value":4300371},"name":"?get_global_action_nolock@@YAPAP6AXH@ZH@Z"},{"address":{"type":"absolute","value":4300437},"name":"?siglookup@@YAPAU__crt_signal_action_t@@HQAU1@@Z"},{"address":{"type":"absolute","value":4300477},"name":"___acrt_get_sigabrt_handler"},{"address":{"type":"absolute","value":4300500},"name":"___acrt_initialize_signal_handlers"},{"address":{"type":"absolute","value":4300568},"name":"_raise"},{"address":{"type":"absolute","value":4301088},"name":"?"},{"address":{"type":"absolute","value":4301512},"name":"??$copy_and_add_argument_to_buffer@D@@YAHQBD0IAAV?$argument_list@D@?A0xb0e4b824@@@Z"},{"address":{"type":"absolute","value":4301662},"name":"??$expand_argument_wildcards@D@@YAHQAD0AAV?$argument_list@D@?A0xb0e4b824@@@Z"},{"address":{"type":"absolute","value":4302050},"name":"?"},{"address":{"type":"absolute","value":4302140},"name":"?"},{"address":{"type":"absolute","value":4302393},"name":"??R<lambda_ad1ced32f4ac17aa236e5ef05d6b3b7c>@@QBEXXZ"},{"address":{"type":"absolute","value":4302589},"name":"?CPtoLocaleName@@YAPB_WH@Z"},{"address":{"type":"absolute","value":4302651},"name":"?getSystemCP@@YAHH@Z"},{"address":{"type":"absolute","value":4302766},"name":"?setSBCS@@YAXPAU__crt_multibyte_data@@@Z"},{"address":{"type":"absolute","value":4302867},"name":"?setSBUpLow@@YAXPAU__crt_multibyte_data@@@Z"},{"address":{"type":"absolute","value":4303271},"name":"?setmbcp_internal@@YAHH_N@Z"},{"address":{"type":"absolute","value":4303528},"name":"___acrt_initialize_multibyte"},{"address":{"type":"absolute","value":4303558},"name":"___acrt_update_thread_multibyte_data"},{"address":{"type":"absolute","value":4303720},"name":"__setmbcp_nolock"},{"address":{"type":"absolute","value":4304217},"name":"?x_ismbbtype_l@@YAHPAU__crt_locale_pointers@@IHH@Z"},{"address":{"type":"absolute","value":4304306},"name":"__ismbblead"},{"address":{"type":"absolute","value":4304330},"name":"___acrt_initialize_command_line"},{"address":{"type":"absolute","value":4304355},"name":"?find_end_of_double_null_terminated_sequence@@YAPB_WQB_W@Z"},{"address":{"type":"absolute","value":4304410},"name":"___dcrt_get_narrow_environment_from_os"},{"address":{"type":"absolute","value":4305112},"name":"??$copy_environment@D@@YAPAPADQAPAD@Z"},{"address":{"type":"absolute","value":4305289},"name":"??$find_in_environment_nolock@D@@YAHQBDI@Z"},{"address":{"type":"absolute","value":4305384},"name":"___acrt_initialize_heap"},{"address":{"type":"absolute","value":4305411},"name":"___acrt_execute_initializers"},{"address":{"type":"absolute","value":4305542},"name":"___acrt_execute_uninitializers"},{"address":{"type":"absolute","value":4305835},"name":"___acrt_lowio_create_handle_array"},{"address":{"type":"absolute","value":4305957},"name":"___acrt_lowio_destroy_handle_array"},{"address":{"type":"absolute","value":4306010},"name":"___acrt_lowio_ensure_fh_exists"},{"address":{"type":"absolute","value":4306197},"name":"___acrt_lowio_set_os_handle"},{"address":{"type":"absolute","value":4306380},"name":"__alloc_osfhnd"},{"address":{"type":"absolute","value":4306654},"name":"__free_osfhnd"},{"address":{"type":"absolute","value":4306799},"name":"__get_osfhandle"},{"address":{"type":"absolute","value":4306905},"name":"___acrt_locale_free_monetary"},{"address":{"type":"absolute","value":4307159},"name":"___acrt_locale_initialize_monetary"},{"address":{"type":"absolute","value":4308115},"name":"___acrt_locale_free_numeric"},{"address":{"type":"absolute","value":4308220},"name":"___acrt_locale_initialize_numeric"},{"address":{"type":"absolute","value":4308760},"name":"?free_crt_array_internal@@YAXQAPBXI@Z"},{"address":{"type":"absolute","value":4308820},"name":"?initialize_lc_time@@YA_NQAU__crt_lc_time_data@@QAU__crt_locale_data@@@Z"},{"address":{"type":"absolute","value":4309457},"name":"___acrt_locale_free_time"},{"address":{"type":"absolute","value":4309685},"name":"___acrt_locale_initialize_time"},{"address":{"type":"absolute","value":4309812},"name":"_wcscspn"},{"address":{"type":"absolute","value":4309892},"name":"_wcspbrk"},{"address":{"type":"absolute","value":4309961},"name":"___acrt_GetStringTypeA"},{"address":{"type":"absolute","value":4310246},"name":"___acrt_add_locale_ref"},{"address":{"type":"absolute","value":4310371},"name":"___acrt_free_locale"},{"address":{"type":"absolute","value":4310701},"name":"___acrt_locale_add_lc_time_reference"},{"address":{"type":"absolute","value":4310742},"name":"___acrt_locale_free_lc_time_if_unreferenced"},{"address":{"type":"absolute","value":4310790},"name":"___acrt_locale_release_lc_time_reference"},{"address":{"type":"absolute","value":4310831},"name":"___acrt_release_locale_ref"},{"address":{"type":"absolute","value":4310960},"name":"___acrt_update_thread_locale_data"},{"address":{"type":"absolute","value":4311079},"name":"__updatetlocinfoEx_nolock"},{"address":{"type":"absolute","value":4311159},"name":"_GetLocaleNameFromDefault"},{"address":{"type":"absolute","value":4311296},"name":"_GetLocaleNameFromLangCountry"},{"address":{"type":"absolute","value":4311450},"name":"_GetLocaleNameFromLanguage"},{"address":{"type":"absolute","value":4311541},"name":"_GetPrimaryLen"},{"address":{"type":"absolute","value":4311593},"name":"_LangCountryEnumProcEx@12"},{"address":{"type":"absolute","value":4312339},"name":"_LanguageEnumProcEx@12"},{"address":{"type":"absolute","value":4312532},"name":"_ProcessCodePage"},{"address":{"type":"absolute","value":4312763},"name":"_TestDefaultCountry"},{"address":{"type":"absolute","value":4312838},"name":"_TranslateName"},{"address":{"type":"absolute","value":4312949},"name":"___acrt_get_qualified_locale"},{"address":{"type":"absolute","value":4313412},"name":"_CountryEnumProc@4"},{"address":{"type":"absolute","value":4313581},"name":"_GetLcidFromCountry"},{"address":{"type":"absolute","value":4313656},"name":"_GetLcidFromLangCountry"},{"address":{"type":"absolute","value":4313811},"name":"_GetLcidFromLanguage"},{"address":{"type":"absolute","value":4313908},"name":"_GetPrimaryLen"},{"address":{"type":"absolute","value":4313952},"name":"_LangCountryEnumProc@4"},{"address":{"type":"absolute","value":4314544},"name":"_LanguageEnumProc@4"},{"address":{"type":"absolute","value":4314760},"name":"_LcidFromHexString"},{"address":{"type":"absolute","value":4314841},"name":"_ProcessCodePage"},{"address":{"type":"absolute","value":4315068},"name":"_TestDefaultCountry"},{"address":{"type":"absolute","value":4315104},"name":"_TestDefaultLanguage"},{"address":{"type":"absolute","value":4315216},"name":"_TranslateName"},{"address":{"type":"absolute","value":4315309},"name":"___acrt_get_qualified_locale_downlevel"},{"address":{"type":"absolute","value":4315828},"name":"___hw_cw_sse2"},{"address":{"type":"absolute","value":4315999},"name":"__control87"},{"address":{"type":"absolute","value":4316769},"name":"__hw_cw"},{"address":{"type":"absolute","value":4316922},"name":"__errcode"},{"address":{"type":"absolute","value":4316974},"name":"__except1"},{"address":{"type":"absolute","value":4317180},"name":"__handle_exc"},{"address":{"type":"absolute","value":4317660},"name":"__raise_exc"},{"address":{"type":"absolute","value":4317695},"name":"__raise_exc_ex"},{"address":{"type":"absolute","value":4318448},"name":"__set_errno_from_matherr"},{"address":{"type":"absolute","value":4318495},"name":"__umatherr"},{"address":{"type":"absolute","value":4318657},"name":"__decomp"},{"address":{"type":"absolute","value":4318869},"name":"__set_exp"},{"address":{"type":"absolute","value":4318916},"name":"__sptype"},{"address":{"type":"absolute","value":4319010},"name":"___set_fpsr_sse2"},{"address":{"type":"absolute","value":4319128},"name":"__clrfp"},{"address":{"type":"absolute","value":4319147},"name":"__ctrlfp"},{"address":{"type":"absolute","value":4319191},"name":"__set_statfp"},{"address":{"type":"absolute","value":4319282},"name":"__statfp"},{"address":{"type":"absolute","value":4319300},"name":"__fpclass"},{"address":{"type":"absolute","value":4319464},"name":"?_wcstombs_l_helper@@YAIPADPB_WIPAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4320105},"name":"__wcstombs_s_l"},{"address":{"type":"absolute","value":4320336},"name":"__CIpow_pentium4"},{"address":{"type":"absolute","value":4320361},"name":"__pow_pentium4"},{"address":{"type":"absolute","value":4323696},"name":"__trandisp1"},{"address":{"type":"absolute","value":4323822},"name":"cwdefault"},{"address":{"type":"absolute","value":4323975},"name":"dont_change_zerosign"},{"address":{"type":"absolute","value":4324012},"name":"_tossnan1"},{"address":{"type":"absolute","value":4324058},"name":"_tossnan2"},{"address":{"type":"absolute","value":4324121},"name":"_snan2"},{"address":{"type":"absolute","value":4324157},"name":"retj"},{"address":{"type":"absolute","value":4324176},"name":"dont_change_sign"},{"address":{"type":"absolute","value":4324195},"name":"chsifnegret"},{"address":{"type":"absolute","value":4324208},"name":"__startTwoArgErrorHandling"},{"address":{"type":"absolute","value":4324231},"name":"__startOneArgErrorHandling"},{"address":{"type":"absolute","value":4324700},"name":"__d_inttype"},{"address":{"type":"absolute","value":4324806},"name":"__powhlp"},{"address":{"type":"absolute","value":4325105},"name":"?InternalGetLocaleInfoA@@YAHQAU__crt_locale_pointers@@QB_WKQADH@Z"},{"address":{"type":"absolute","value":4325356},"name":"___acrt_GetLocaleInfoA"},{"address":{"type":"absolute","value":4325790},"name":"__wcsicmp"},{"address":{"type":"absolute","value":4325939},"name":"__wcsicmp_l"},{"address":{"type":"absolute","value":4326163},"name":"__isatty"},{"address":{"type":"absolute","value":4326249},"name":"?GetTableIndexFromLocaleName@@YAHPB_W@Z"},{"address":{"type":"absolute","value":4326437},"name":"___acrt_DownlevelLCIDToLocaleName"},{"address":{"type":"absolute","value":4326607},"name":"___acrt_DownlevelLocaleNameToLCID"},{"address":{"type":"absolute","value":4326651},"name":"__wcsnicmp"},{"address":{"type":"absolute","value":4326835},"name":"__wcsnicmp_l"},{"address":{"type":"absolute","value":4327296},"name":"?configure_text_mode@@YAHHUfile_options@?A0x704126de@@HAAW4__crt_lowio_text_mode@@@Z"},{"address":{"type":"absolute","value":4327885},"name":"?"},{"address":{"type":"absolute","value":4327922},"name":"?decode_open_create_flags@@YAKH@Z"},{"address":{"type":"absolute","value":4328034},"name":"?"},{"address":{"type":"absolute","value":4328414},"name":"?truncate_ctrl_z_if_present@@YAHH@Z"},{"address":{"type":"absolute","value":4328590},"name":"__sopen_nolock"},{"address":{"type":"absolute","value":4328703},"name":"__wsopen_nolock"},{"address":{"type":"absolute","value":4329512},"name":"__putwch_nolock"},{"address":{"type":"absolute","value":4329581},"name":"?InternalCompareStringA@@YAHPAU__crt_locale_pointers@@PB_WKPBDH2HH@Z"},{"address":{"type":"absolute","value":4330261},"name":"___acrt_CompareStringA"},{"address":{"type":"absolute","value":4330528},"name":"?shortsort@@YAXPAD0IP6AHPBX1@Z@Z"},{"address":{"type":"absolute","value":4330688},"name":"?swap@@YAXPAD0I@Z"},{"address":{"type":"absolute","value":4330752},"name":"_qsort"},{"address":{"type":"absolute","value":4331680},"name":"_strpbrk"},{"address":{"type":"absolute","value":4331744},"name":"__mbsdec"},{"address":{"type":"absolute","value":4331767},"name":"__mbsdec_l"},{"address":{"type":"absolute","value":4331908},"name":"?initialize_multibyte@@YAHXZ"},{"address":{"type":"absolute","value":4331923},"name":"___libm_error_support"},{"address":{"type":"absolute","value":4332459},"name":"__87except"},{"address":{"type":"absolute","value":4332726},"name":"__frnd"},{"address":{"type":"absolute","value":4332748},"name":"__towlower_l"},{"address":{"type":"absolute","value":4333597},"name":"__chsize_nolock"},{"address":{"type":"absolute","value":4334052},"name":"___acrt_LCMapStringW"},{"address":{"type":"absolute","value":4334128},"name":"__CIlog10_pentium4"},{"address":{"type":"absolute","value":4334158},"name":"start"},{"address":{"type":"absolute","value":4334784},"name":"__ceil_default"},{"address":{"type":"absolute","value":4334969},"name":"??0MultiWaitBlock@details@Concurrency@@QAE@I_N0@Z"},{"address":{"type":"absolute","value":4335029},"name":"??0MultiWaitBlockHolder@details@Concurrency@@QAE@_NI00@Z"},{"address":{"type":"absolute","value":4335164},"name":"??0TimedSingleWaitBlock@details@Concurrency@@QAE@_N@Z"},{"address":{"type":"absolute","value":4335211},"name":"??0WaitAnyBlock@details@Concurrency@@QAE@I_N0@Z"},{"address":{"type":"absolute","value":4335251},"name":"??0WaitBlock@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335312},"name":"??0event@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335361},"name":"??1MultiWaitBlockHolder@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335391},"name":"??1_Condition_variable@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335467},"name":"??1event@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335641},"name":"?Destroy@EventWaitNode@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4335667},"name":"?Destroy@TimedSingleWaitBlock@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4335692},"name":"?Destroy@WaitAllBlock@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4335697},"name":"?DispatchEventTimer@MultiWaitBlock@details@Concurrency@@SGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4335791},"name":"?DispatchEventTimer@TimedSingleWaitBlock@details@Concurrency@@SGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4335842},"name":"?DispatchEventTimerXP@MultiWaitBlock@details@Concurrency@@SGXPAXE@Z"},{"address":{"type":"absolute","value":4335930},"name":"?DispatchEventTimerXP@TimedSingleWaitBlock@details@Concurrency@@SGXPAXE@Z"},{"address":{"type":"absolute","value":4335964},"name":"?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ"},{"address":{"type":"absolute","value":4336112},"name":"?NotifyCompletedNode@MultiWaitBlock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4336137},"name":"?Reset@WaitAllBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4336194},"name":"?Satisfy@EventWaitNode@details@Concurrency@@QAE_NPAPAVContext@3@@Z"},{"address":{"type":"absolute","value":4336228},"name":"?Satisfy@SingleWaitBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336318},"name":"?Satisfy@TimedSingleWaitBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336407},"name":"?Satisfy@WaitAllBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336478},"name":"?Satisfy@WaitAnyBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336545},"name":"?Set@StructuredEvent@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4336617},"name":"?SingleSatisfy@MultiWaitBlock@details@Concurrency@@MAEXPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336793},"name":"?Sweep@details@Concurrency@@YAPAVEventWaitNode@12@PAV312@_N@Z"},{"address":{"type":"absolute","value":4336851},"name":"?SweepResetNode@EventWaitNode@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4336876},"name":"?SweepResetNode@WaitAllBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4336927},"name":"?SweepWaitNode@EventWaitNode@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4336952},"name":"?SweepWaitNode@TimedSingleWaitBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4336988},"name":"?SweepWaitNode@WaitAllBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4337055},"name":"?SweepWaitNode@WaitAnyBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4337109},"name":"?"},{"address":{"type":"absolute","value":4337156},"name":"?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4337186},"name":"?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4337217},"name":"?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4337354},"name":"?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4337473},"name":"?createTimer@TimedSingleWaitBlock@details@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4337572},"name":"?destroyTimer@TimedSingleWaitBlock@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4337648},"name":"?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4337887},"name":"?set@event@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4338174},"name":"?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z"},{"address":{"type":"absolute","value":4338274},"name":"?wait@event@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4338494},"name":"?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z"},{"address":{"type":"absolute","value":4338726},"name":"?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z"},{"address":{"type":"absolute","value":4339464},"name":"??0LockQueueNode@details@Concurrency@@QAE@I@Z"},{"address":{"type":"absolute","value":4339628},"name":"?"},{"address":{"type":"absolute","value":4339649},"name":"??0_ReaderWriterLock@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4339665},"name":"??0critical_section@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4339724},"name":"?"},{"address":{"type":"absolute","value":4339828},"name":"?Block@LockQueueNode@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4339962},"name":"?CurrentContext@SchedulerBase@details@Concurrency@@SAPAVContextBase@23@XZ"},{"address":{"type":"absolute","value":4339996},"name":"?DerefTimerNode@LockQueueNode@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340027},"name":"?DispatchNodeTimeoutTimer@LockQueueNode@details@Concurrency@@SGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4340098},"name":"?DispatchNodeTimeoutTimerXP@LockQueueNode@details@Concurrency@@SGXPAXE@Z"},{"address":{"type":"absolute","value":4340175},"name":"?TryCompensateTimer@LockQueueNode@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340212},"name":"?Unblock@LockQueueNode@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4340262},"name":"?UpdateQueuePosition@LockQueueNode@details@Concurrency@@QAEXPAV123@@Z"},{"address":{"type":"absolute","value":4340366},"name":"?WaitForNextNode@LockQueueNode@details@Concurrency@@QAEPAV123@XZ"},{"address":{"type":"absolute","value":4340417},"name":"?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340465},"name":"?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340511},"name":"?_Acquire_lock@critical_section@Concurrency@@QAE_NPAX_N@Z"},{"address":{"type":"absolute","value":4340666},"name":"?_FlushWriteOwners@_ReaderWriterLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340688},"name":"?_Flush_current_owner@critical_section@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340712},"name":"?_Initialize@_SpinCount@details@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4340747},"name":"?"},{"address":{"type":"absolute","value":4340758},"name":"?_Switch_to_active@critical_section@Concurrency@@AAEXPAX@Z"},{"address":{"type":"absolute","value":4340837},"name":"?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4340866},"name":"?_WaitEquals@_ReaderWriterLock@details@Concurrency@@CAXADJJJ@Z"},{"address":{"type":"absolute","value":4340927},"name":"?lock@critical_section@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4341142},"name":"?unlock@critical_section@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4341328},"name":"??1WaiterThreadPool@platform@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4341362},"name":"?"},{"address":{"type":"absolute","value":4341407},"name":"?InitializeSystemFunctionPointers@platform@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4341621},"name":"?__CreateAutoResetEvent@platform@details@Concurrency@@YAPAX_N@Z"},{"address":{"type":"absolute","value":4341728},"name":"?__CreateTimerQueueTimer@platform@details@Concurrency@@YAHPAPAXPAXP6GX1E@Z1KKK@Z"},{"address":{"type":"absolute","value":4341760},"name":"?__DeleteTimerQueueTimer@platform@details@Concurrency@@YAXPAX00@Z"},{"address":{"type":"absolute","value":4341841},"name":"?__GetLogicalProcessorInformation@platform@details@Concurrency@@YAPAU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@PAK@Z"},{"address":{"type":"absolute","value":4341976},"name":"?__GetLogicalProcessorInformationEx@platform@details@Concurrency@@YAPAU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@W4_LOGICAL_PROCESSOR_RELATIONSHIP@@PAK@Z"},{"address":{"type":"absolute","value":4342156},"name":"?__GetNumaHighestNodeNumber@platform@details@Concurrency@@YAKXZ"},{"address":{"type":"absolute","value":4342223},"name":"?__GetThreadGroupAffinity@platform@details@Concurrency@@YAHPAXPAU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4342331},"name":"?__InitializeCriticalSectionEx@platform@details@Concurrency@@YAHPAU_RTL_CRITICAL_SECTION@@K@Z"},{"address":{"type":"absolute","value":4342352},"name":"?__RegisterWaitForSingleObject@platform@details@Concurrency@@YAPAXPAXP6GX0E@Z0@Z"},{"address":{"type":"absolute","value":4342432},"name":"?__SetThreadGroupAffinity@platform@details@Concurrency@@YAHPAXPBU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4342609},"name":"?__TlsAlloc@platform@details@Concurrency@@YAKXZ"},{"address":{"type":"absolute","value":4342797},"name":"?notify@WaiterThread@platform@details@Concurrency@@AAEX_N@Z"},{"address":{"type":"absolute","value":4342863},"name":"?"},{"address":{"type":"absolute","value":4342876},"name":"?DeleteAsyncTimerAndUnloadLibrary@details@Concurrency@@YAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4342936},"name":"?FreeLibraryAndDestroyThread@details@Concurrency@@YAXK@Z"},{"address":{"type":"absolute","value":4342978},"name":"?InitializeCookie@Security@details@Concurrency@@SAKXZ"},{"address":{"type":"absolute","value":4343054},"name":"?LoadLibraryAndCreateThread@details@Concurrency@@YAPAXPAU_SECURITY_ATTRIBUTES@@KP6GKPAX@Z1KPAK@Z"},{"address":{"type":"absolute","value":4343124},"name":"?ReferenceLoadLibrary@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4343272},"name":"?RegisterAsyncTimerAndLoadLibrary@details@Concurrency@@YAPAU_TP_TIMER@@KP6GXPAU_TP_CALLBACK_INSTANCE@@PAXPAU3@@Z1_N@Z"},{"address":{"type":"absolute","value":4343367},"name":"?RegisterAsyncWaitAndLoadLibrary@details@Concurrency@@YAPAU_TP_WAIT@@PAXP6GXPAU_TP_CALLBACK_INSTANCE@@0PAU3@K@Z0@Z"},{"address":{"type":"absolute","value":4343424},"name":"?UnRegisterAsyncTimerAndUnloadLibrary@details@Concurrency@@YAXPAU_TP_CALLBACK_INSTANCE@@PAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4343478},"name":"?UnRegisterAsyncWaitAndUnloadLibrary@details@Concurrency@@YAXPAU_TP_CALLBACK_INSTANCE@@PAU_TP_WAIT@@@Z"},{"address":{"type":"absolute","value":4343547},"name":"?_Acquire@_NonReentrantLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4343648},"name":"?_TryAcquire@_NonReentrantLock@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4343669},"name":"?_UnderlyingYield@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4343708},"name":"?Block@Context@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4343737},"name":"?CurrentContext@Context@Concurrency@@SAPAV12@XZ"},{"address":{"type":"absolute","value":4343742},"name":"??0HardwareAffinity@details@Concurrency@@QAE@PAX@Z"},{"address":{"type":"absolute","value":4343775},"name":"??0ResourceManager@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4344003},"name":"??0SchedulerCore@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4344085},"name":"??1GlobalNode@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4344098},"name":"??1ResourceManager@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4344372},"name":"??_EGlobalNode@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4344506},"name":"??_GAffinityRestriction@ResourceManager@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4344547},"name":"?AddTail@?$List@VSchedulerProxy@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4344604},"name":"?AdjustDynamicAllocation@ResourceManager@details@Concurrency@@AAEIIII@Z"},{"address":{"type":"absolute","value":4344812},"name":"?ApplyAffinityLimits@AffinityRestriction@ResourceManager@details@Concurrency@@QAEXPAU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4344847},"name":"?ApplyAffinityRestrictions@ResourceManager@details@Concurrency@@CAXPAK@Z"},{"address":{"type":"absolute","value":4344890},"name":"?ApplyAffinityRestrictions@ResourceManager@details@Concurrency@@CAXPAU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4344929},"name":"?ApplyTo@HardwareAffinity@details@Concurrency@@QAEXPAX@Z"},{"address":{"type":"absolute","value":4344947},"name":"?CaptureProcessAffinity@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4345240},"name":"?CleanupTopologyInformation@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4345267},"name":"?CommitStolenCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4345536},"name":"?ComputeDesiredHWThreadsWithExternalThread@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4345571},"name":"?ComputeMinHWThreadsWithExternalThread@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4345616},"name":"?CreateAllocatedNodeData@ResourceManager@details@Concurrency@@QAEPAUSchedulerNode@23@XZ"},{"address":{"type":"absolute","value":4345927},"name":"?CreateDynamicRMWorker@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4346030},"name":"?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4346275},"name":"?CurrentSubscriptionLevel@ResourceManager@details@Concurrency@@QAEIII@Z"},{"address":{"type":"absolute","value":4346381},"name":"?DesiredHWThreads@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4346406},"name":"?DestroyAllocatedNodeData@ResourceManager@details@Concurrency@@QAEXPAUSchedulerNode@23@@Z"},{"address":{"type":"absolute","value":4346464},"name":"?DetermineTopology@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4347250},"name":"?DiscardExistingSchedulerStatistics@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4347357},"name":"?DistributeCoresToSurvivingScheduler@ResourceManager@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4347766},"name":"?DistributeExclusiveCores@ResourceManager@details@Concurrency@@AAEXIIIII@Z"},{"address":{"type":"absolute","value":4348083},"name":"?DistributeIdleCores@ResourceManager@details@Concurrency@@AAEXII@Z"},{"address":{"type":"absolute","value":4348486},"name":"?DoCoreMigration@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4349054},"name":"?DynamicAssignCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@II_N@Z"},{"address":{"type":"absolute","value":4349163},"name":"?DynamicMigrateCores@ResourceManager@details@Concurrency@@AAEXPAUDynamicAllocationData@23@PAVSchedulerProxy@23@II@Z"},{"address":{"type":"absolute","value":4349517},"name":"?DynamicRMThreadProc@ResourceManager@details@Concurrency@@CGKPAX@Z"},{"address":{"type":"absolute","value":4349542},"name":"?DynamicResourceManager@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4349798},"name":"?FindBestFitExclusiveAllocation@ResourceManager@details@Concurrency@@AAEIAAI0PAUDynamicAllocationData@23@II@Z"},{"address":{"type":"absolute","value":4350636},"name":"?FindBestFitIdleAllocation@ResourceManager@details@Concurrency@@AAEIIPAUDynamicAllocationData@23@I@Z"},{"address":{"type":"absolute","value":4350918},"name":"?FindCoreForPartiallyFilledNode@ResourceManager@details@Concurrency@@AAE_NAAI0PAUDynamicAllocationData@23@I@Z"},{"address":{"type":"absolute","value":4351183},"name":"?FindGroupAffinity@AffinityRestriction@ResourceManager@details@Concurrency@@QAEPAUHardwareAffinity@34@G@Z"},{"address":{"type":"absolute","value":4351235},"name":"?FlushStoreBuffers@ResourceManager@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4351362},"name":"?GetCurrentNodeAndCore@ResourceManager@details@Concurrency@@QAEIPAI@Z"},{"address":{"type":"absolute","value":4351632},"name":"?"},{"address":{"type":"absolute","value":4351639},"name":"?GetFirstExecutionResource@TopologyObject@GlobalNode@details@Concurrency@@UBEPAUITopologyExecutionResource@4@XZ"},{"address":{"type":"absolute","value":4351649},"name":"?GetFirstNode@ResourceManager@details@Concurrency@@UBEPAUITopologyNode@3@XZ"},{"address":{"type":"absolute","value":4351656},"name":"?GetId@TopologyObject@GlobalNode@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4351663},"name":"?GetNext@TopologyObject@GlobalCore@details@Concurrency@@UBEPAUITopologyExecutionResource@4@XZ"},{"address":{"type":"absolute","value":4351686},"name":"?GetNext@TopologyObject@GlobalNode@details@Concurrency@@UBEPAUITopologyNode@4@XZ"},{"address":{"type":"absolute","value":4351709},"name":"?GetNextGlobalCore@GlobalNode@details@Concurrency@@QAEPAUGlobalCore@23@PBU423@@Z"},{"address":{"type":"absolute","value":4351746},"name":"?GetNextGlobalNode@ResourceManager@details@Concurrency@@QAEPAUGlobalNode@23@PBU423@@Z"},{"address":{"type":"absolute","value":4351858},"name":"?GetNumaNode@TopologyObject@GlobalNode@details@Concurrency@@UBEKXZ"},{"address":{"type":"absolute","value":4351893},"name":"?GetTopologyInformation@ResourceManager@details@Concurrency@@CAXW4_LOGICAL_PROCESSOR_RELATIONSHIP@@@Z"},{"address":{"type":"absolute","value":4351934},"name":"?HandleBorrowedCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@PAUAllocationData@23@@Z"},{"address":{"type":"absolute","value":4352219},"name":"?HandleSharedCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@PAUDynamicAllocationData@23@@Z"},{"address":{"type":"absolute","value":4352547},"name":"?IncreaseFullyLoadedSchedulerAllocations@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4352601},"name":"?Initialize@GlobalCore@details@Concurrency@@QAEXPAUGlobalNode@23@IE@Z"},{"address":{"type":"absolute","value":4352662},"name":"?Initialize@GlobalNode@details@Concurrency@@QAEXPAVResourceManager@23@GGKII@Z"},{"address":{"type":"absolute","value":4352937},"name":"?InitializeRMBuffers@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4353131},"name":"?InitializeSystemInformation@ResourceManager@details@Concurrency@@CAX_N@Z"},{"address":{"type":"absolute","value":4353687},"name":"?MinVprocHWThreads@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4353712},"name":"?PerformAllocation@ResourceManager@details@Concurrency@@QAEPAVExecutionResource@23@PAVSchedulerProxy@23@_N1@Z"},{"address":{"type":"absolute","value":4354054},"name":"?PopulateCommonAllocationData@ResourceManager@details@Concurrency@@AAEXIPAVSchedulerProxy@23@PAUAllocationData@23@@Z"},{"address":{"type":"absolute","value":4354252},"name":"?PopulateDynamicAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4354527},"name":"?PreProcessDynamicAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4354726},"name":"?PreProcessStaticAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4354773},"name":"?PrepareReceiversForCoreTransfer@ResourceManager@details@Concurrency@@AAEII@Z"},{"address":{"type":"absolute","value":4355303},"name":"?RedistributeCoresAmongAll@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@III@Z"},{"address":{"type":"absolute","value":4356283},"name":"?"},{"address":{"type":"absolute","value":4356293},"name":"?RegisterScheduler@ResourceManager@details@Concurrency@@UAEPAUISchedulerProxy@3@PAUIScheduler@3@I@Z"},{"address":{"type":"absolute","value":4356361},"name":"?Release@ResourceManager@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4356532},"name":"?ReleaseCoresOnExistingSchedulers@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@II@Z"},{"address":{"type":"absolute","value":4356617},"name":"?ReleaseSchedulerResources@ResourceManager@details@Concurrency@@AAE_NPAVSchedulerProxy@23@0I@Z"},{"address":{"type":"absolute","value":4356861},"name":"?Remove@?$List@VSchedulerProxy@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4356915},"name":"?RemoveExecutionResource@ResourceManager@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4357034},"name":"?RequestInitialVirtualProcessors@ResourceManager@details@Concurrency@@QAEPAUIExecutionResource@3@PAVSchedulerProxy@23@_N@Z"},{"address":{"type":"absolute","value":4357311},"name":"?ReserveAtHigherUseCounts@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@I@Z"},{"address":{"type":"absolute","value":4357363},"name":"?ReserveCores@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@II@Z"},{"address":{"type":"absolute","value":4357838},"name":"?ResetGlobalAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4357925},"name":"?RetrieveSystemVersionInformation@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4358163},"name":"?RoundUpScaledAllocations@ResourceManager@details@Concurrency@@CAXPAPAUAllocationData@23@II@Z"},{"address":{"type":"absolute","value":4358603},"name":"?SafeReference@ResourceManager@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4358634},"name":"?SendResourceNotifications@ResourceManager@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4359111},"name":"?SetupStaticAllocationData@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@_N@Z"},{"address":{"type":"absolute","value":4359318},"name":"?Shutdown@ResourceManager@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4359528},"name":"?SubscribeCurrentThread@ResourceManager@details@Concurrency@@QAEPAVExecutionResource@23@PAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4359612},"name":"?ToggleRMIdleState@ResourceManager@details@Concurrency@@AAEXPAUSchedulerNode@23@PAUSchedulerCore@23@PAUGlobalNode@23@PAUGlobalCore@23@PAUAllocationData@23@@Z"},{"address":{"type":"absolute","value":4359717},"name":"?Version@ResourceManager@details@Concurrency@@SA?AW4OSVersion@IResourceManager@3@XZ"},{"address":{"type":"absolute","value":4359790},"name":"??$_InternalDeleteHelper@VExternalContextBase@details@Concurrency@@@details@Concurrency@@YAXPAVExternalContextBase@01@@Z"},{"address":{"type":"absolute","value":4359825},"name":"??$_InternalDeleteHelper@VInternalContextBase@details@Concurrency@@@details@Concurrency@@YAXPAVInternalContextBase@01@@Z"},{"address":{"type":"absolute","value":4359862},"name":"??$_InternalDeleteHelper@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@YAXPAVScheduleGroupBase@01@@Z"},{"address":{"type":"absolute","value":4359897},"name":"?"},{"address":{"type":"absolute","value":4359959},"name":"?"},{"address":{"type":"absolute","value":4360318},"name":"??0NumaInformation@SchedulerBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4360342},"name":"??0QuickBitSet@details@Concurrency@@QAE@I@Z"},{"address":{"type":"absolute","value":4360412},"name":"??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4361283},"name":"??1?$ListArray@VExternalStatistics@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361405},"name":"??1?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361524},"name":"??1NumaInformation@SchedulerBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361557},"name":"??1ReferenceCountedQuickBitSet@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361594},"name":"??1SchedulerBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4361833},"name":"?"},{"address":{"type":"absolute","value":4361905},"name":"??_ENumaInformation@SchedulerBase@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4362034},"name":"?"},{"address":{"type":"absolute","value":4362069},"name":"?"},{"address":{"type":"absolute","value":4362246},"name":"??_GSchedulerBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4362283},"name":"??_GSubAllocator@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4362414},"name":"?Add@?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@QAEHPAVScheduleGroupBase@23@@Z"},{"address":{"type":"absolute","value":4362768},"name":"?AddContext@SchedulerBase@details@Concurrency@@QAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4362817},"name":"?AddHead@?$List@UBoostedObject@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUBoostedObject@23@@Z"},{"address":{"type":"absolute","value":4362869},"name":"?AddTail@?$List@VWaitNode@SchedulerBase@details@Concurrency@@VNoCount@CollectionTypes@34@@details@Concurrency@@QAEXPAVWaitNode@SchedulerBase@23@@Z"},{"address":{"type":"absolute","value":4363150},"name":"?AllocateSegment@CacheLocalScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4363209},"name":"?AllocateSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4363285},"name":"?Attach@SchedulerBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4363355},"name":"?AttachExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4363467},"name":"?AttemptSchedulerSweep@SchedulerBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4363502},"name":"?CancelAllContexts@SchedulerBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4363564},"name":"?ChangeThrottlingTimer@SchedulerBase@details@Concurrency@@AAEXK@Z"},{"address":{"type":"absolute","value":4363770},"name":"?CheckOneShotStaticDestruction@SchedulerBase@details@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4363808},"name":"?CheckStaticConstruction@SchedulerBase@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4363909},"name":"?Cleanup@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4364088},"name":"?CommitSafePoints@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4364155},"name":"?CommitToVersion@SchedulerBase@details@Concurrency@@AAEXK@Z"},{"address":{"type":"absolute","value":4364306},"name":"?ComputeSafePointCommitVersion@SchedulerBase@details@Concurrency@@AAEKXZ"},{"address":{"type":"absolute","value":4364443},"name":"?CopyFrom@QuickBitSet@details@Concurrency@@IAEXABV123@@Z"},{"address":{"type":"absolute","value":4364558},"name":"?CreateScheduleGroup@SchedulerBase@details@Concurrency@@UAEPAVScheduleGroup@3@XZ"},{"address":{"type":"absolute","value":4364589},"name":"?CreateWithoutInitializing@SchedulerBase@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z"},{"address":{"type":"absolute","value":4364627},"name":"?DecrementInternalContextCount@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4364652},"name":"?DeferredGetInternalContext@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4364682},"name":"?DeleteElements@?$ListArray@VExternalStatistics@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4364715},"name":"?DeleteElements@?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4364745},"name":"?Dequeue@?$SQueue@VInternalContextBase@details@Concurrency@@@details@Concurrency@@QAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4364774},"name":"?"},{"address":{"type":"absolute","value":4364852},"name":"?DestroySchedulerEventHandlers@SchedulerBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4364927},"name":"?DetachExternalContext@SchedulerBase@details@Concurrency@@AAEXPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4365006},"name":"?FastCurrentScheduler@SchedulerBase@details@Concurrency@@SAPAV123@XZ"},{"address":{"type":"absolute","value":4365032},"name":"?Fill@QuickBitSet@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4365061},"name":"?Finalize@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4365413},"name":"?FindCurrentNode@SchedulerBase@details@Concurrency@@QAEPAVSchedulingNode@23@XZ"},{"address":{"type":"absolute","value":4365478},"name":"?FindNodeByLocation@SchedulerBase@details@Concurrency@@QAEPAVSchedulingNode@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4365567},"name":"?FindScheduleGroupSegment@SchedulingRing@details@Concurrency@@AAEPAVScheduleGroupSegmentBase@23@HHPAHPAV?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@23@@Z"},{"address":{"type":"absolute","value":4365610},"name":"?FindVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@HHPAH@Z"},{"address":{"type":"absolute","value":4365657},"name":"?FoundAvailableVirtualProcessor@SchedulerBase@details@Concurrency@@QAE_NAAVClaimTicket@VirtualProcessor@23@Vlocation@3@K@Z"},{"address":{"type":"absolute","value":4365921},"name":"?FoundBlockedContexts@SchedulerBase@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4365963},"name":"?FoundUnstartedChores@SchedulerBase@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4366162},"name":"?GetAnonymousScheduleGroupSegment@SchedulerBase@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@XZ"},{"address":{"type":"absolute","value":4366171},"name":"?GetBitSet@SchedulerBase@details@Concurrency@@QAE?AVQuickBitSet@23@PBVlocation@3@@Z"},{"address":{"type":"absolute","value":4366353},"name":"?GetDefaultScheduler@SchedulerBase@details@Concurrency@@CAPAV123@XZ"},{"address":{"type":"absolute","value":4366510},"name":"?GetExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4366606},"name":"?GetInternalContext@SchedulerBase@details@Concurrency@@QAEPAVInternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4366849},"name":"__catch$?GetInternalContext@SchedulerBase@details@Concurrency@@QAEPAVInternalContextBase@23@_N@Z$0"},{"address":{"type":"absolute","value":4366897},"name":"?GetNewContextId@SchedulerBase@details@Concurrency@@QAEIXZ"},{"address":{"type":"absolute","value":4366910},"name":"?GetNewScheduleGroupId@SchedulerBase@details@Concurrency@@QAEIXZ"},{"address":{"type":"absolute","value":4366936},"name":"?GetNextPriorityObject@SchedulerBase@details@Concurrency@@QAEPAUBoostedObject@23@XZ"},{"address":{"type":"absolute","value":4366989},"name":"?GetNextScheduleGroupSegment@SchedulingRing@details@Concurrency@@AAEPAVScheduleGroupSegmentBase@23@PAHHPAV?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@23@@Z"},{"address":{"type":"absolute","value":4367049},"name":"?GetNextSchedulingRing@SchedulerBase@details@Concurrency@@QAEPAVSchedulingRing@23@PBV423@PAV423@@Z"},{"address":{"type":"absolute","value":4367092},"name":"?GetNextSchedulingRing@SchedulerBase@details@Concurrency@@QAEPAVSchedulingRing@23@XZ"},{"address":{"type":"absolute","value":4367125},"name":"?GetNextValidSchedulingRingIndex@SchedulerBase@details@Concurrency@@AAEHH@Z"},{"address":{"type":"absolute","value":4367159},"name":"?GetNextVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PAHH@Z"},{"address":{"type":"absolute","value":4367216},"name":"?GetPolicy@SchedulerBase@details@Concurrency@@UBE?AVSchedulerPolicy@3@XZ"},{"address":{"type":"absolute","value":4367238},"name":"?GetRealizedChore@SchedulerBase@details@Concurrency@@QAEPAVRealizedChore@23@P6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4367331},"name":"?GetReservedContext@SchedulerBase@details@Concurrency@@QAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4367354},"name":"?"},{"address":{"type":"absolute","value":4367373},"name":"?GetSubAllocator@SchedulerBase@details@Concurrency@@SAPAVSubAllocator@23@_N@Z"},{"address":{"type":"absolute","value":4367501},"name":"?GetValidSchedulingRingIndex@SchedulerBase@details@Concurrency@@AAEHH@Z"},{"address":{"type":"absolute","value":4367536},"name":"?Grow@QuickBitSet@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4367663},"name":"?Grow@ReferenceCountedQuickBitSet@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4367776},"name":"?HasCompletedShutdown@SchedulerBase@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4367795},"name":"?"},{"address":{"type":"absolute","value":4367843},"name":"?Id@SchedulerBase@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4367850},"name":"?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4369051},"name":"?"},{"address":{"type":"absolute","value":4369163},"name":"?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4369361},"name":"?InternalRelease@ScheduleGroupBase@details@Concurrency@@IAEJXZ"},{"address":{"type":"absolute","value":4369419},"name":"?Intersects@QuickBitSet@details@Concurrency@@QBE_NABV123@@Z"},{"address":{"type":"absolute","value":4369479},"name":"?InvokeAtNextSafePoint@SafePointInvocation@details@Concurrency@@QAEXP6AXPAX@Z0PAVSchedulerBase@23@@Z"},{"address":{"type":"absolute","value":4369539},"name":"?InvokeOnSafePoint@SchedulerBase@details@Concurrency@@AAEXPAVSafePointInvocation@23@@Z"},{"address":{"type":"absolute","value":4369607},"name":"?IsActive@ExternalStatistics@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4369635},"name":"?IsAvailableLocation@SchedulerBase@details@Concurrency@@UBE_NABVlocation@3@@Z"},{"address":{"type":"absolute","value":4369687},"name":"?"},{"address":{"type":"absolute","value":4369729},"name":"?MailChore@FairScheduleGroup@details@Concurrency@@UAE?AVSlot@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@23@PAV_UnrealizedChore@23@PAVlocation@3@PAPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4369746},"name":"?MarkSafePoint@SchedulerBase@details@Concurrency@@QAE_NPAVSafePointMarker@23@@Z"},{"address":{"type":"absolute","value":4369780},"name":"?NotifyThrottledContext@SchedulerBase@details@Concurrency@@AAE_NPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4369924},"name":"?OneShotStaticConstruction@SchedulerBase@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4369944},"name":"?OneShotStaticDestruction@SchedulerBase@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4369969},"name":"?PerformServiceScan@SchedulerBase@details@Concurrency@@AAEX_K@Z"},{"address":{"type":"absolute","value":4370421},"name":"?PhaseOneShutdown@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4370539},"name":"?PhaseTwoShutdown@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4370696},"name":"?PublishNewDataVersion@SchedulerBase@details@Concurrency@@AAEKXZ"},{"address":{"type":"absolute","value":4370720},"name":"?Push@?$LockFreePushStack@VContextNode@SchedulerBase@details@Concurrency@@@details@Concurrency@@QAEXPAVContextNode@SchedulerBase@23@@Z"},{"address":{"type":"absolute","value":4370750},"name":"?PushRunnableToInactive@SchedulerBase@details@Concurrency@@UAE_NPAVInternalContextBase@23@Vlocation@3@@Z"},{"address":{"type":"absolute","value":4370859},"name":"?Reallocate@QuickBitSet@details@Concurrency@@IAEXI@Z"},{"address":{"type":"absolute","value":4370914},"name":"?"},{"address":{"type":"absolute","value":4370930},"name":"?Reference@SchedulerBase@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4371042},"name":"?ReferenceForAttach@SchedulerBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4371073},"name":"?RegisterShutdownEvent@SchedulerBase@details@Concurrency@@UAEXPAX@Z"},{"address":{"type":"absolute","value":4371230},"name":"?Release@ScheduleGroupBase@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4371235},"name":"?Release@SchedulerBase@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4371259},"name":"?ReleaseExternalContext@SchedulerBase@details@Concurrency@@AAEXPAVExternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4371325},"name":"?ReleaseForDetach@SchedulerBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4371356},"name":"?ReleaseInternalContext@SchedulerBase@details@Concurrency@@QAEXPAVInternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4371430},"name":"?ReleaseRealizedChore@SchedulerBase@details@Concurrency@@QAEXPAVRealizedChore@23@@Z"},{"address":{"type":"absolute","value":4371510},"name":"?ReleaseReservedContexts@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4371616},"name":"?ReleaseSuspendedVirtualProcessors@SchedulerBase@details@Concurrency@@AAEXJ@Z"},{"address":{"type":"absolute","value":4371646},"name":"?Remove@?$List@UBoostedObject@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUBoostedObject@23@@Z"},{"address":{"type":"absolute","value":4371696},"name":"?Remove@?$ListArray@VExternalStatistics@details@Concurrency@@@details@Concurrency@@QAE_NPAVExternalStatistics@23@H_N@Z"},{"address":{"type":"absolute","value":4371945},"name":"?Remove@?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@QAE_NPAVScheduleGroupBase@23@H_N@Z"},{"address":{"type":"absolute","value":4372194},"name":"?RemoveHead@?$List@UBoostedObject@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEPAUBoostedObject@23@XZ"},{"address":{"type":"absolute","value":4372234},"name":"?RemoveHead@?$List@VWaitNode@SchedulerBase@details@Concurrency@@VNoCount@CollectionTypes@34@@details@Concurrency@@QAEPAVWaitNode@SchedulerBase@23@XZ"},{"address":{"type":"absolute","value":4372322},"name":"?RemovePrioritizedObject@SchedulerBase@details@Concurrency@@QAEXPAUBoostedObject@23@@Z"},{"address":{"type":"absolute","value":4372382},"name":"?RemoveScheduleGroup@SchedulerBase@details@Concurrency@@QAEXPAVScheduleGroupBase@23@@Z"},{"address":{"type":"absolute","value":4372406},"name":"?RemoveSegments@FairScheduleGroup@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4372672},"name":"?Resurrect@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4372743},"name":"?ReturnSubAllocator@SchedulerBase@details@Concurrency@@SAXPAVSubAllocator@23@@Z"},{"address":{"type":"absolute","value":4372808},"name":"?SafeFastCurrentContext@SchedulerBase@details@Concurrency@@SAPAVContextBase@23@XZ"},{"address":{"type":"absolute","value":4372836},"name":"?SafeReference@SchedulerBase@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4372870},"name":"?ScheduleTask@SchedulerBase@details@Concurrency@@UAEXP6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4372951},"name":"?ScheduleTask@SchedulerBase@details@Concurrency@@UAEXP6AXPAX@Z0AAVlocation@3@@Z"},{"address":{"type":"absolute","value":4373012},"name":"?SetNextSchedulingRing@SchedulerBase@details@Concurrency@@QAEXPAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4373049},"name":"?SpinUntilBitsReset@details@Concurrency@@YAJPCJJ@Z"},{"address":{"type":"absolute","value":4373098},"name":"?SpinUntilBitsSet@details@Concurrency@@YAJPCJJ@Z"},{"address":{"type":"absolute","value":4373156},"name":"?StartupNewVirtualProcessor@SchedulerBase@details@Concurrency@@UAEXPAVScheduleGroupSegmentBase@23@Vlocation@3@@Z"},{"address":{"type":"absolute","value":4373194},"name":"?StartupVirtualProcessor@SchedulerBase@details@Concurrency@@QAE_NPAVScheduleGroupSegmentBase@23@Vlocation@3@K@Z"},{"address":{"type":"absolute","value":4373837},"name":"?ThrottlerDispatch@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4374113},"name":"?ThrottlerDispatchBridge@SchedulerBase@details@Concurrency@@CGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4374128},"name":"?"},{"address":{"type":"absolute","value":4374143},"name":"?ThrottlerTrampoline@SchedulerBase@details@Concurrency@@CGXPAXE@Z"},{"address":{"type":"absolute","value":4374202},"name":"?ThrottlingTime@SchedulerBase@details@Concurrency@@QAEKK@Z"},{"address":{"type":"absolute","value":4374353},"name":"?ThrowSchedulerEvent@SchedulerBase@details@Concurrency@@CAXW4ConcRT_EventType@3@EI@Z"},{"address":{"type":"absolute","value":4374460},"name":"?TraceSchedulerEvent@SchedulerBase@details@Concurrency@@AAEXW4ConcRT_EventType@3@EI@Z"},{"address":{"type":"absolute","value":4374502},"name":"?TriggerCommitSafePoints@SchedulerBase@details@Concurrency@@QAEXPAVSafePointMarker@23@@Z"},{"address":{"type":"absolute","value":4374555},"name":"?TypeOfWorkPending@SchedulerBase@details@Concurrency@@MAE?AW4PendingWorkType@123@XZ"},{"address":{"type":"absolute","value":4374601},"name":"?UpdateCommitVersion@SchedulerBase@details@Concurrency@@AAEKK@Z"},{"address":{"type":"absolute","value":4374673},"name":"?UpdatePendingVersion@SchedulerBase@details@Concurrency@@AAEKXZ"},{"address":{"type":"absolute","value":4374723},"name":"?VirtualProcessorActive@SchedulerBase@details@Concurrency@@QAE_N_N@Z"},{"address":{"type":"absolute","value":4374903},"name":"?VirtualProcessorIdle@SchedulerBase@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4374996},"name":"?"},{"address":{"type":"absolute","value":4375073},"name":"?_Assign@location@Concurrency@@QAEXABV12@@Z"},{"address":{"type":"absolute","value":4375418},"name":"??0CancellationBeaconStack@ContextBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4375443},"name":"??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4375653},"name":"?"},{"address":{"type":"absolute","value":4375676},"name":"??1?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4375699},"name":"??1CancellationBeaconStack@ContextBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4375766},"name":"??1ContextBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4375812},"name":"?"},{"address":{"type":"absolute","value":4375892},"name":"??8location@Concurrency@@QBE_NABV01@@Z"},{"address":{"type":"absolute","value":4375927},"name":"??ACancellationBeaconStack@ContextBase@details@Concurrency@@QAEPAUCancellationBeacon@123@J@Z"},{"address":{"type":"absolute","value":4376014},"name":"??_GContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4376051},"name":"??_GWorkQueue@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4376095},"name":"?Add@?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@QAEHPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4376449},"name":"?AddStealer@ContextBase@details@Concurrency@@QAEXPAV123@_N@Z"},{"address":{"type":"absolute","value":4376491},"name":"?AddTail@?$List@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUListEntry@23@@Z"},{"address":{"type":"absolute","value":4376590},"name":"?CancelCollection@ContextBase@details@Concurrency@@QAEXH@Z"},{"address":{"type":"absolute","value":4376693},"name":"?CancelCollectionComplete@ContextBase@details@Concurrency@@QAE_NH@Z"},{"address":{"type":"absolute","value":4376741},"name":"?CancelStealers@ContextBase@details@Concurrency@@QAEXPAV_TaskCollectionBase@23@@Z"},{"address":{"type":"absolute","value":4377064},"name":"?Cleanup@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4377113},"name":"?ClearAliasTable@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4377176},"name":"?ClearContextTls@ContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4377192},"name":"?CreateWorkQueue@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4377320},"name":"?DeleteElements@?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4377703},"name":"?EnterCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377711},"name":"?EnterHyperCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377722},"name":"?ExitCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377730},"name":"?ExitHyperCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377741},"name":"?FindAndDelete@?$Hash@PAV_TaskCollection@details@Concurrency@@PAV123@@details@Concurrency@@QAE_NABQAV_TaskCollection@23@PAPAV423@@Z"},{"address":{"type":"absolute","value":4377807},"name":"?FlagCancellationBeacons@ContextBase@details@Concurrency@@QAEXH@Z"},{"address":{"type":"absolute","value":4377879},"name":"?GetCriticalRegionType@ContextBase@details@Concurrency@@UBE?AW4CriticalRegionType@3@XZ"},{"address":{"type":"absolute","value":4377907},"name":"?GetScheduleGroup@ContextBase@details@Concurrency@@QBEPAVScheduleGroupBase@23@XZ"},{"address":{"type":"absolute","value":4377924},"name":"?GetScheduleGroupId@ContextBase@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4377964},"name":"?IsCanceledAtDepth@ContextBase@details@Concurrency@@AAE_NPAV_TaskCollectionBase@23@H@Z"},{"address":{"type":"absolute","value":4378188},"name":"?LockedSetOwningContext@WorkQueue@details@Concurrency@@QAEXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4378223},"name":"?NextList@?$Hash@PAV_TaskCollection@details@Concurrency@@PAV123@@details@Concurrency@@AAEPAUListNode@123@PAH@Z"},{"address":{"type":"absolute","value":4378272},"name":"?Pop@?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAEPAV_UnrealizedChore@23@XZ"},{"address":{"type":"absolute","value":4378353},"name":"?PopContextFromTls@ContextBase@details@Concurrency@@AAEPAV123@XZ"},{"address":{"type":"absolute","value":4378383},"name":"?PushContextToTls@ContextBase@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4378410},"name":"?RecomputeMaximumCancellationDepth@ContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4378541},"name":"?ReferenceForCancellation@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4378546},"name":"?ReleaseWorkQueue@ContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4378633},"name":"?Remove@?$Hash@PAV_TaskCollection@details@Concurrency@@PAV123@@details@Concurrency@@AAEPAUListNode@123@ABQAV_TaskCollection@23@H@Z"},{"address":{"type":"absolute","value":4378711},"name":"?Remove@?$List@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUListEntry@23@@Z"},{"address":{"type":"absolute","value":4378757},"name":"?Remove@?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@QAE_NPAVWorkQueue@23@H_N@Z"},{"address":{"type":"absolute","value":4379050},"name":"?RemoveStealer@ContextBase@details@Concurrency@@QAEXPAV123@@Z"},{"address":{"type":"absolute","value":4379123},"name":"?SweepAliasTable@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4379253},"name":"?SweepUnstructured@ContextBase@details@Concurrency@@QAEXP6A_NPAV_UnrealizedChore@23@PAX@Z12@Z"},{"address":{"type":"absolute","value":4379418},"name":"?ThrowContextEvent@ContextBase@details@Concurrency@@KAXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4379531},"name":"?TraceContextEvent@ContextBase@details@Concurrency@@IAEXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4379675},"name":"?TryPopUnstructured@ContextBase@details@Concurrency@@QAEPAV_UnrealizedChore@23@H@Z"},{"address":{"type":"absolute","value":4379690},"name":"?_SafeGetParent@_TaskCollectionBase@details@Concurrency@@IAEPAV123@XZ"},{"address":{"type":"absolute","value":4379710},"name":"??$atomic_compare_exchange@J@details@Concurrency@@YAJAAU?$atomic@J@std@@JJ@Z"},{"address":{"type":"absolute","value":4379747},"name":"??0CancellationTokenRegistration_TaskProc@details@Concurrency@@QAE@P6AXPAX@Z0H@Z"},{"address":{"type":"absolute","value":4379790},"name":"??0_CancellationTokenRegistration@details@Concurrency@@QAE@J@Z"},{"address":{"type":"absolute","value":4379907},"name":"??0_TaskCollection@details@Concurrency@@AAE@PAV012@_N@Z"},{"address":{"type":"absolute","value":4380175},"name":"??1?$lock_guard@Vmutex@std@@@std@@QAE@XZ"},{"address":{"type":"absolute","value":4380230},"name":"??1?$unique_lock@Vmutex@std@@@std@@QAE@XZ"},{"address":{"type":"absolute","value":4380291},"name":"??1TaskStack@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4380307},"name":"??1_CancellationTokenRegistration@details@Concurrency@@MAE@XZ"},{"address":{"type":"absolute","value":4380344},"name":"??1_TaskCollection@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4380649},"name":"??_GCancellationTokenRegistration_TaskProc@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4380683},"name":"??_G_CancellationTokenRegistration@details@Concurrency@@MAEPAXI@Z"},{"address":{"type":"absolute","value":4380752},"name":"??_Gexception_ptr@std@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4380834},"name":"?AddArbitraryAlias@ContextBase@details@Concurrency@@QAEXPAV_TaskCollection@23@0@Z"},{"address":{"type":"absolute","value":4380869},"name":"?GetArbitraryAlias@ContextBase@details@Concurrency@@QAEPAV_TaskCollection@23@PAV423@@Z"},{"address":{"type":"absolute","value":4380967},"name":"?GetWorkQueueIdentity@ContextBase@details@Concurrency@@QAEIXZ"},{"address":{"type":"absolute","value":4380990},"name":"?_Abort@_TaskCollection@details@Concurrency@@AAEX_N@Z"},{"address":{"type":"absolute","value":4381293},"name":"?_AbortiveSweep@_TaskCollection@details@Concurrency@@AAEXPAX@Z"},{"address":{"type":"absolute","value":4381365},"name":"?_Alias@_TaskCollection@details@Concurrency@@AAEPAV123@XZ"},{"address":{"type":"absolute","value":4381494},"name":"?_Atomic_compare_exchange_strong_4@std@@YAHPCKPAKKW4memory_order@1@2@Z"},{"address":{"type":"absolute","value":4381606},"name":"?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4381691},"name":"?_Cancel@_TaskCollection@details@Concurrency@@AAEX_NPAV123@@Z"},{"address":{"type":"absolute","value":4381850},"name":"?_CancelDirectAliases@_TaskCollection@details@Concurrency@@AAEX_NPAV123@@Z"},{"address":{"type":"absolute","value":4381881},"name":"?_CancelFromArbitraryThread@_TaskCollection@details@Concurrency@@AAEX_N@Z"},{"address":{"type":"absolute","value":4382044},"name":"?_CancelStolenContexts@_TaskCollection@details@Concurrency@@AAEX_N0@Z"},{"address":{"type":"absolute","value":4382183},"name":"?_Cnd_broadcastX@std@@YAHPAU_Cnd_internal_imp_t@@@Z"},{"address":{"type":"absolute","value":4382214},"name":"?_CollectionMatchPredicate@_TaskCollection@details@Concurrency@@CA_NPAV_UnrealizedChore@23@PAX@Z"},{"address":{"type":"absolute","value":4382233},"name":"?"},{"address":{"type":"absolute","value":4382272},"name":"?_CountUp@_StructuredTaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4382318},"name":"?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4382533},"name":"?"},{"address":{"type":"absolute","value":4382562},"name":"?_Exec@CancellationTokenRegistration_TaskProc@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4382582},"name":"?_FullAliasWait@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4382807},"name":"?_Initialize@_StructuredTaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4382882},"name":"?_Initialize@_TaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4382904},"name":"?_Invoke@_CancellationTokenRegistration@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4383040},"name":"?_IsDirectAlias@_TaskCollection@details@Concurrency@@ABE_NXZ"},{"address":{"type":"absolute","value":4383058},"name":"?_IsIndirectAlias@_TaskCollection@details@Concurrency@@ABE_NXZ"},{"address":{"type":"absolute","value":4383076},"name":"?_IsMarkedForAbnormalExit@_TaskCollection@details@Concurrency@@QBE_NXZ"},{"address":{"type":"absolute","value":4383087},"name":"?_IsStaleAlias@_TaskCollection@details@Concurrency@@ABE_NXZ"},{"address":{"type":"absolute","value":4383095},"name":"?_NotifyCompletedChoreAndFree@_TaskCollection@details@Concurrency@@AAEXPAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4383178},"name":"?_RegisterCallback@_CancellationTokenState@details@Concurrency@@QAEPAV_CancellationTokenRegistration@23@P6AXPAX@Z0H@Z"},{"address":{"type":"absolute","value":4383239},"name":"?_RegisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4383353},"name":"?"},{"address":{"type":"absolute","value":4383392},"name":"?_ReleaseAlias@_TaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4383450},"name":"?_Reset@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4383701},"name":"?_SetCancelState@_TaskCollection@details@Concurrency@@AAE_NJ@Z"},{"address":{"type":"absolute","value":4383759},"name":"?_SweepAbortedChore@_TaskCollection@details@Concurrency@@CA_NPAV_UnrealizedChore@23@PAX@Z"},{"address":{"type":"absolute","value":4383784},"name":"?_TaskCleanup@_TaskCollection@details@Concurrency@@AAE_N_N@Z"},{"address":{"type":"absolute","value":4383868},"name":"?push_back@TokenRegistrationContainer@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@34@@Z"},{"address":{"type":"absolute","value":4383928},"name":"?remove@TokenRegistrationContainer@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@34@@Z"},{"address":{"type":"absolute","value":4383997},"name":"??0SchedulerPolicy@Concurrency@@QAA@IZZ"},{"address":{"type":"absolute","value":4384027},"name":"??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z"},{"address":{"type":"absolute","value":4384146},"name":"??1SchedulerPolicy@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4384158},"name":"??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z"},{"address":{"type":"absolute","value":4384188},"name":"?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z"},{"address":{"type":"absolute","value":4384242},"name":"?_AreConcurrencyLimitsValid@SchedulerPolicy@Concurrency@@CA_NII@Z"},{"address":{"type":"absolute","value":4384272},"name":"?_Initialize@SchedulerPolicy@Concurrency@@AAEXIPAPAD@Z"},{"address":{"type":"absolute","value":4384459},"name":"__catch$?_Initialize@SchedulerPolicy@Concurrency@@AAEXIPAPAD@Z$0"},{"address":{"type":"absolute","value":4384508},"name":"?_ResolvePolicyValues@SchedulerPolicy@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4384604},"name":"?_ValidPolicyValue@SchedulerPolicy@Concurrency@@CA_NW4PolicyElementKey@2@I@Z"},{"address":{"type":"absolute","value":4384828},"name":"?_ValidateConcRTPolicy@SchedulerPolicy@Concurrency@@QBEXXZ"},{"address":{"type":"absolute","value":4384886},"name":"??0ExecutionResource@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAUSchedulerNode@12@I@Z"},{"address":{"type":"absolute","value":4384980},"name":"??0ExecutionResource@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAV012@@Z"},{"address":{"type":"absolute","value":4385058},"name":"?CurrentSubscriptionLevel@ExecutionResource@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4385076},"name":"?DecrementUseCounts@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385188},"name":"?IncrementUseCounts@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385388},"name":"?Remove@ExecutionResource@details@Concurrency@@UAEXPAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4385483},"name":"?ResetCurrent@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385511},"name":"?SetAsCurrent@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385546},"name":"??$sign@I@details@Concurrency@@YAII@Z"},{"address":{"type":"absolute","value":4385570},"name":"??$sign@N@details@Concurrency@@YANN@Z"},{"address":{"type":"absolute","value":4385626},"name":"??0HillClimbing@details@Concurrency@@QAE@IIPAVSchedulerProxy@12@@Z"},{"address":{"type":"absolute","value":4385767},"name":"?Add@MeasuredHistory@HillClimbing@details@Concurrency@@QAEXNI@Z"},{"address":{"type":"absolute","value":4385802},"name":"?CalculateThroughput@HillClimbing@details@Concurrency@@AAENIIII@Z"},{"address":{"type":"absolute","value":4385861},"name":"?CalculateThroughputSlope@HillClimbing@details@Concurrency@@AAENHH@Z"},{"address":{"type":"absolute","value":4386048},"name":"?CoefficientOfVariationMean@MeasuredHistory@HillClimbing@details@Concurrency@@QAENXZ"},{"address":{"type":"absolute","value":4386103},"name":"?EstablishControlSetting@HillClimbing@details@Concurrency@@AAEXI@Z"},{"address":{"type":"absolute","value":4386172},"name":"?FlushHistories@HillClimbing@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4386242},"name":"?GetHistory@HillClimbing@details@Concurrency@@AAEPAVMeasuredHistory@123@I@Z"},{"address":{"type":"absolute","value":4386285},"name":"?GetRandomMove@HillClimbing@details@Concurrency@@AAEHXZ"},{"address":{"type":"absolute","value":4386310},"name":"?IsStableHistory@HillClimbing@details@Concurrency@@AAE_NPAVMeasuredHistory@123@@Z"},{"address":{"type":"absolute","value":4386358},"name":"?Mean@MeasuredHistory@HillClimbing@details@Concurrency@@QAENXZ"},{"address":{"type":"absolute","value":4386390},"name":"?RecommendControlSetting@HillClimbing@details@Concurrency@@AAEII@Z"},{"address":{"type":"absolute","value":4386598},"name":"?Update@HillClimbing@details@Concurrency@@QAEIIIII@Z"},{"address":{"type":"absolute","value":4387046},"name":"?Variance@MeasuredHistory@HillClimbing@details@Concurrency@@QAENXZ"},{"address":{"type":"absolute","value":4387122},"name":"??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4387726},"name":"??1SchedulerProxy@details@Concurrency@@IAE@XZ"},{"address":{"type":"absolute","value":4387819},"name":"?AddCore@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerNode@23@I_N@Z"},{"address":{"type":"absolute","value":4388022},"name":"?AddExecutionResource@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4388100},"name":"?AddTail@?$List@VExecutionResource@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4388157},"name":"?AddThreadSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4388172},"name":"?AddVirtualProcessorRoots@SchedulerProxy@details@Concurrency@@QAEXPAPAUIVirtualProcessorRoot@3@I@Z"},{"address":{"type":"absolute","value":4388346},"name":"?AdjustAllocationIncrease@SchedulerProxy@details@Concurrency@@QBEII@Z"},{"address":{"type":"absolute","value":4388458},"name":"?"},{"address":{"type":"absolute","value":4388550},"name":"?Cleanup@SchedulerProxy@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4388755},"name":"?CreateExternalThreadResource@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@PAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4388826},"name":"?CreateOversubscriber@SchedulerProxy@details@Concurrency@@UAEPAUIVirtualProcessorRoot@3@PAUIExecutionResource@3@@Z"},{"address":{"type":"absolute","value":4389014},"name":"?CreateVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@UAEPAVVirtualProcessorRoot@23@PAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4389070},"name":"?DecrementCoreSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4389144},"name":"?DecrementFixedCoreCount@SchedulerProxy@details@Concurrency@@QAEXII_N@Z"},{"address":{"type":"absolute","value":4389265},"name":"?DeleteThis@SchedulerProxy@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4389292},"name":"?DestroyExecutionResource@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4389425},"name":"?DestroyVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@QAEXPAVVirtualProcessorRoot@23@@Z"},{"address":{"type":"absolute","value":4389563},"name":"?FinalShutdown@SchedulerProxy@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4389592},"name":"?GetCurrentThreadExecutionResource@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@XZ"},{"address":{"type":"absolute","value":4389621},"name":"?GetNewThreadProxy@SchedulerProxy@details@Concurrency@@UAEPAUIThreadProxy@3@PAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4389701},"name":"?GetResourceForNewSubscription@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@PAV423@@Z"},{"address":{"type":"absolute","value":4389779},"name":"?GrantAllocation@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@I_N0@Z"},{"address":{"type":"absolute","value":4390508},"name":"?IncrementCoreSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4390586},"name":"?IncrementFixedCoreCount@SchedulerProxy@details@Concurrency@@QAEXII_N@Z"},{"address":{"type":"absolute","value":4390720},"name":"?ReferenceCurrentThreadExecutionResource@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@XZ"},{"address":{"type":"absolute","value":4390889},"name":"?Remove@?$List@VExecutionResource@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4390943},"name":"?RemoveCore@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4391177},"name":"?RemoveThreadSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4391221},"name":"?RequestInitialVirtualProcessors@SchedulerProxy@details@Concurrency@@UAEPAUIExecutionResource@3@_N@Z"},{"address":{"type":"absolute","value":4391240},"name":"?SendCoreNotification@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerCore@23@_N@Z"},{"address":{"type":"absolute","value":4391468},"name":"?Shutdown@SchedulerProxy@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4391478},"name":"?SubscribeCurrentThread@SchedulerProxy@details@Concurrency@@UAEPAUIExecutionResource@3@XZ"},{"address":{"type":"absolute","value":4391488},"name":"?ToggleBorrowedState@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4391548},"name":"?UnbindContext@SchedulerProxy@details@Concurrency@@UAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4391621},"name":"?Initialize@WinRT@details@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4391912},"name":"??0FreeThreadProxy@details@Concurrency@@QAE@PAUIThreadProxyFactory@12@I@Z"},{"address":{"type":"absolute","value":4391965},"name":"??0FreeThreadProxyFactory@details@Concurrency@@IAE@PAVThreadProxyFactoryManager@12@@Z"},{"address":{"type":"absolute","value":4392007},"name":"??0ThreadProxyFactoryManager@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4392059},"name":"??1ThreadProxyFactoryManager@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4392178},"name":"?"},{"address":{"type":"absolute","value":4392213},"name":"??_GFreeThreadProxy@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4392253},"name":"??_GFreeThreadProxyFactory@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4392323},"name":"?Create@FreeThreadProxyFactory@details@Concurrency@@EAEPAVFreeThreadProxy@23@I@Z"},{"address":{"type":"absolute","value":4392376},"name":"?CreateFactory@FreeThreadProxyFactory@details@Concurrency@@SAPAV123@PAVThreadProxyFactoryManager@23@@Z"},{"address":{"type":"absolute","value":4392420},"name":"?GetFreeThreadProxyFactory@ThreadProxyFactoryManager@details@Concurrency@@QAEPAVFreeThreadProxyFactory@23@XZ"},{"address":{"type":"absolute","value":4392492},"name":"?Prepare@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@MAEXPAVFreeThreadProxy@23@H@Z"},{"address":{"type":"absolute","value":4392516},"name":"?ReclaimProxy@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@UAEXPAUIThreadProxy@3@@Z"},{"address":{"type":"absolute","value":4392615},"name":"?ReclaimProxy@FreeThreadProxyFactory@details@Concurrency@@UAEXPAUIThreadProxy@3@@Z"},{"address":{"type":"absolute","value":4392780},"name":"?Reference@FreeThreadProxyFactory@details@Concurrency@@UAEJXZ"},{"address":{"type":"absolute","value":4392790},"name":"?Release@FreeThreadProxyFactory@details@Concurrency@@UAEJXZ"},{"address":{"type":"absolute","value":4392835},"name":"?RequestProxy@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@UAEPAUIThreadProxy@3@IH@Z"},{"address":{"type":"absolute","value":4392965},"name":"?Retire@FreeThreadProxyFactory@details@Concurrency@@EAEXPAVFreeThreadProxy@23@@Z"},{"address":{"type":"absolute","value":4392980},"name":"?RetireThreadProxies@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4393088},"name":"?ShutdownFactory@FreeThreadProxyFactory@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4393149},"name":"??0Etw@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4393399},"name":"?ControlCallback@details@Concurrency@@YGKW4WMIDPREQUESTCODE@@PAXPAK1@Z"},{"address":{"type":"absolute","value":4393597},"name":"?GetEnableFlags@Etw@details@Concurrency@@QAEK_K@Z"},{"address":{"type":"absolute","value":4393658},"name":"?GetEnableLevel@Etw@details@Concurrency@@QAEE_K@Z"},{"address":{"type":"absolute","value":4393719},"name":"?GetLoggerHandle@Etw@details@Concurrency@@QAE_KPAX@Z"},{"address":{"type":"absolute","value":4393780},"name":"?RegisterGuids@Etw@details@Concurrency@@QAEKP6GKW4WMIDPREQUESTCODE@@PAXPAK1@ZPBU_GUID@@KPAU_TRACE_GUID_REGISTRATION@@PA_K@Z"},{"address":{"type":"absolute","value":4393848},"name":"?Trace@Etw@details@Concurrency@@QAEK_KPAU_EVENT_TRACE_HEADER@@@Z"},{"address":{"type":"absolute","value":4393905},"name":"?UnregisterGuids@Etw@details@Concurrency@@QAEK_K@Z"},{"address":{"type":"absolute","value":4393959},"name":"?_RegisterConcRTEventTracing@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4394070},"name":"?_UnregisterConcRTEventTracing@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4394137},"name":"?"},{"address":{"type":"absolute","value":4394171},"name":"?"},{"address":{"type":"absolute","value":4394281},"name":"?"},{"address":{"type":"absolute","value":4394291},"name":"??0VirtualProcessor@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4394387},"name":"??1VirtualProcessor@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4394483},"name":"??_GVirtualProcessor@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4394520},"name":"?AcknowledgedAffinityMessage@SchedulerBase@details@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4394573},"name":"?Affinitize@VirtualProcessor@details@Concurrency@@MAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4394646},"name":"?CheckAffinityNotification@VirtualProcessor@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4394726},"name":"?ClaimExclusiveOwnership@VirtualProcessor@details@Concurrency@@QAE_NAAVClaimTicket@123@K_N@Z"},{"address":{"type":"absolute","value":4394875},"name":"?ClearQuickCacheSlot@SchedulerBase@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4394912},"name":"?Deactivate@VirtualProcessor@details@Concurrency@@QAE_NPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4394946},"name":"?DeleteElements@?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4394979},"name":"?EnsureAllTasksVisible@VirtualProcessor@details@Concurrency@@QAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4395013},"name":"?ExerciseClaim@VirtualProcessor@details@Concurrency@@AAE_NW4AvailabilityType@123@PAVScheduleGroupSegmentBase@23@PAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4395158},"name":"?ExerciseWith@ClaimTicket@VirtualProcessor@details@Concurrency@@QAE_NPAVInternalContextBase@34@@Z"},{"address":{"type":"absolute","value":4395201},"name":"?GetCurrentSubAllocator@VirtualProcessor@details@Concurrency@@QAEPAVSubAllocator@23@XZ"},{"address":{"type":"absolute","value":4395223},"name":"?GetResourceMaskId@SchedulerBase@details@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4395253},"name":"?Initialize@VirtualProcessor@details@Concurrency@@MAEXPAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4395635},"name":"?InterlockedClear@ReferenceCountedQuickBitSet@details@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4395699},"name":"?InterlockedSet@ReferenceCountedQuickBitSet@details@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4395767},"name":"?MakeAvailable@VirtualProcessor@details@Concurrency@@IAEXW4AvailabilityType@123@_N@Z"},{"address":{"type":"absolute","value":4395879},"name":"?MarkForRetirement@VirtualProcessor@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4395985},"name":"?Oversubscribe@VirtualProcessor@details@Concurrency@@EAEPAV123@XZ"},{"address":{"type":"absolute","value":4396114},"name":"?Remove@?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@QAE_NPAVVirtualProcessor@23@H_N@Z"},{"address":{"type":"absolute","value":4396358},"name":"?Retire@VirtualProcessor@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4396712},"name":"?SafePoint@VirtualProcessor@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4396730},"name":"?SaveRetiredVirtualProcessorStatistics@SchedulerBase@details@Concurrency@@QAEXPAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4396788},"name":"?SpinUntilClear@QuickBitSet@details@Concurrency@@QBEXI@Z"},{"address":{"type":"absolute","value":4396860},"name":"?SpinUntilSet@QuickBitSet@details@Concurrency@@QBEXI@Z"},{"address":{"type":"absolute","value":4396932},"name":"?StartupWorkerContext@VirtualProcessor@details@Concurrency@@EAE_NPAVScheduleGroupSegmentBase@23@PAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4397090},"name":"?ThrowVirtualProcessorEvent@VirtualProcessor@details@Concurrency@@CAXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4397203},"name":"?"},{"address":{"type":"absolute","value":4397213},"name":"?TraceVirtualProcessorEvent@VirtualProcessor@details@Concurrency@@AAEXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4397258},"name":"?UpdateWorkState@VirtualProcessor@details@Concurrency@@QAEX_N0@Z"},{"address":{"type":"absolute","value":4397352},"name":"?Wipe@QuickBitSet@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4397381},"name":"??0SchedulingNode@details@Concurrency@@QAE@ABVQuickBitSet@12@KPAVSchedulingRing@12@@Z"},{"address":{"type":"absolute","value":4397506},"name":"??1?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4397625},"name":"??1SchedulingNode@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4397666},"name":"?Add@?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@QAEHPAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4398020},"name":"?AddVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PAUIVirtualProcessorRoot@3@_N@Z"},{"address":{"type":"absolute","value":4398284},"name":"?"},{"address":{"type":"absolute","value":4398368},"name":"?FindMatchingVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4398429},"name":"?FindVirtualProcessorByLocation@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PBVlocation@3@@Z"},{"address":{"type":"absolute","value":4398519},"name":"?FoundAvailableVirtualProcessor@SchedulingNode@details@Concurrency@@AAE_NAAVClaimTicket@VirtualProcessor@23@Vlocation@3@K@Z"},{"address":{"type":"absolute","value":4398631},"name":"?GetLocation@SchedulingNode@details@Concurrency@@QAE?AVlocation@3@XZ"},{"address":{"type":"absolute","value":4398683},"name":"?Steal@?$StructuredWorkStealingQueue@VInternalContextBase@details@Concurrency@@V_HyperNonReentrantLock@23@@details@Concurrency@@QAEPAVInternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4398876},"name":"??0AllocatorBucket@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4398897},"name":"??1AllocatorBucket@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4398979},"name":"?Alloc@AllocatorBucket@details@Concurrency@@QAEPATAllocationEntry@23@XZ"},{"address":{"type":"absolute","value":4399004},"name":"?Alloc@SubAllocator@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4399084},"name":"?Free@AllocatorBucket@details@Concurrency@@QAE_NPATAllocationEntry@23@@Z"},{"address":{"type":"absolute","value":4399126},"name":"?Free@SubAllocator@details@Concurrency@@QAEXPAX@Z"},{"address":{"type":"absolute","value":4399181},"name":"?GetBucketIndex@SubAllocator@details@Concurrency@@SAHI@Z"},{"address":{"type":"absolute","value":4399262},"name":"?StaticAlloc@SubAllocator@details@Concurrency@@SAPAXI@Z"},{"address":{"type":"absolute","value":4399319},"name":"??0InternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@@Z"},{"address":{"type":"absolute","value":4399546},"name":"??1InternalContextBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4399721},"name":"?AddToRunnables@InternalContextBase@details@Concurrency@@MAEXVlocation@3@@Z"},{"address":{"type":"absolute","value":4400103},"name":"?Alloc@InternalContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4400187},"name":"?Block@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4400503},"name":"?Cancel@InternalContextBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4400617},"name":"?Cleanup@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4400641},"name":"?CleanupDispatchedContextOnCancel@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4400668},"name":"?Dispatch@InternalContextBase@details@Concurrency@@UAEXPAUDispatchState@3@@Z"},{"address":{"type":"absolute","value":4401066},"name":"?ExecuteChoreInline@InternalContextBase@details@Concurrency@@IAEXPAVWorkItem@23@@Z"},{"address":{"type":"absolute","value":4401127},"name":"?ExecutedAssociatedChore@InternalContextBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4401237},"name":"?FindWorkForBlockingOrNesting@InternalContextBase@details@Concurrency@@AAEPAV123@AA_N0@Z"},{"address":{"type":"absolute","value":4401535},"name":"?Free@InternalContextBase@details@Concurrency@@UAEXPAX@Z"},{"address":{"type":"absolute","value":4401579},"name":"?GetAndResetOversubscribedVProc@InternalContextBase@details@Concurrency@@QAEPAVVirtualProcessor@23@PAV423@@Z"},{"address":{"type":"absolute","value":4401637},"name":"?"},{"address":{"type":"absolute","value":4401644},"name":"?GetScheduler@InternalContextBase@details@Concurrency@@UAEPAUIScheduler@3@XZ"},{"address":{"type":"absolute","value":4401669},"name":"?GetVirtualProcessorId@InternalContextBase@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4402092},"name":"?IsSynchronouslyBlocked@InternalContextBase@details@Concurrency@@UBE_NXZ"},{"address":{"type":"absolute","value":4402100},"name":"?IsVirtualProcessorRetired@InternalContextBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4402194},"name":"?LeaveScheduler@InternalContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4402455},"name":"?Oversubscribe@InternalContextBase@details@Concurrency@@UAEX_N@Z"},{"address":{"type":"absolute","value":4402589},"name":"?PrepareForUse@InternalContextBase@details@Concurrency@@QAEXPAVScheduleGroupSegmentBase@23@PAU_Chore@23@_N@Z"},{"address":{"type":"absolute","value":4402672},"name":"?PrepareToRun@InternalContextBase@details@Concurrency@@MAEXPAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4402760},"name":"?ReclaimVirtualProcessor@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4402865},"name":"?RejoinScheduler@InternalContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4402896},"name":"?RemoveFromUse@InternalContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4402931},"name":"?SearchForWork@VirtualProcessor@details@Concurrency@@QAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_N@Z"},{"address":{"type":"absolute","value":4402971},"name":"?SetProxy@InternalContextBase@details@Concurrency@@UAEXPAUIThreadProxy@3@@Z"},{"address":{"type":"absolute","value":4403022},"name":"?SpinUntilBlocked@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4403065},"name":"?SpinUntilValueEquals@details@Concurrency@@YAXPCJJ@Z"},{"address":{"type":"absolute","value":4403110},"name":"?SpinYield@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4403297},"name":"?SwapScheduleGroupSegment@InternalContextBase@details@Concurrency@@QAEXPAVScheduleGroupSegmentBase@23@_N@Z"},{"address":{"type":"absolute","value":4403372},"name":"?SwitchOut@InternalContextBase@details@Concurrency@@IAE_NW4ReasonForSwitch@123@@Z"},{"address":{"type":"absolute","value":4403659},"name":"?SwitchTo@InternalContextBase@details@Concurrency@@IAEXPAV123@W4ReasonForSwitch@123@@Z"},{"address":{"type":"absolute","value":4403984},"name":"?Unblock@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4404175},"name":"?WaitForWork@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4404431},"name":"?WorkWasFound@InternalContextBase@details@Concurrency@@IAE_NPAVWorkItem@23@@Z"},{"address":{"type":"absolute","value":4404523},"name":"?Yield@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4404911},"name":"??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z"},{"address":{"type":"absolute","value":4405048},"name":"??1?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4405167},"name":"??1SchedulingRing@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4405191},"name":"?Activate@SchedulingRing@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4405253},"name":"?DeleteElements@?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4405286},"name":"?Remove@?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@QAE_NPAVScheduleGroupSegmentBase@23@H_N@Z"},{"address":{"type":"absolute","value":4405530},"name":"?RemoveScheduleGroupSegment@SchedulingRing@details@Concurrency@@AAEXPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4405577},"name":"??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z"},{"address":{"type":"absolute","value":4405696},"name":"??0ScheduleGroupBase@details@Concurrency@@QAE@PAVSchedulerBase@12@PAVlocation@2@@Z"},{"address":{"type":"absolute","value":4405785},"name":"??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z"},{"address":{"type":"absolute","value":4405978},"name":"??0Segment@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@23@ABVQuickBitSet@23@II@Z"},{"address":{"type":"absolute","value":4406086},"name":"??1?$ListArray@U?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4406208},"name":"??1?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4406332},"name":"??1?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4406432},"name":"??1ScheduleGroupSegmentBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4406510},"name":"??4QuickBitSet@details@Concurrency@@QAEAAV012@$$QAV012@@Z"},{"address":{"type":"absolute","value":4406552},"name":"??_GScheduleGroupSegmentBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4406589},"name":"?"},{"address":{"type":"absolute","value":4406942},"name":"?Add@?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@QAEHPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4407299},"name":"?AddRunnableContext@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVInternalContextBase@23@Vlocation@3@@Z"},{"address":{"type":"absolute","value":4407575},"name":"?ClearQuickCacheSlotIf@SchedulerBase@details@Concurrency@@QAEXIPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4407612},"name":"?CreateSegment@ScheduleGroupBase@details@Concurrency@@IAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4407789},"name":"?DeleteElements@?$ListArray@U?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4407822},"name":"?DemandInitialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4407940},"name":"?Dequeue@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE_NPAPAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4408186},"name":"?DetachActiveWorkQueue@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4408249},"name":"?Enqueue@?$SafeSQueue@VRealizedChore@details@Concurrency@@V_HyperNonReentrantLock@23@@details@Concurrency@@QAEXPAVRealizedChore@23@@Z"},{"address":{"type":"absolute","value":4408308},"name":"?FindSegment@ScheduleGroupBase@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4408392},"name":"?GetDetachedWorkQueue@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVWorkQueue@23@XZ"},{"address":{"type":"absolute","value":4408493},"name":"?GetInternalContext@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVInternalContextBase@23@PAU_Chore@23@_N@Z"},{"address":{"type":"absolute","value":4408544},"name":"?GetRealizedChore@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVRealizedChore@23@XZ"},{"address":{"type":"absolute","value":4408560},"name":"?Grow@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEPAUSegment@123@PAU4123@@Z"},{"address":{"type":"absolute","value":4408634},"name":"?"},{"address":{"type":"absolute","value":4408642},"name":"?HasUnrealizedChores@ScheduleGroupSegmentBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4408653},"name":"?Initialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAEXABVQuickBitSet@23@@Z"},{"address":{"type":"absolute","value":4408694},"name":"?Initialize@ScheduleGroupBase@details@Concurrency@@QAEXPAVlocation@3@@Z"},{"address":{"type":"absolute","value":4408713},"name":"?Initialize@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVScheduleGroupBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4408843},"name":"?IsEmpty@WorkQueue@details@Concurrency@@QBE_NXZ"},{"address":{"type":"absolute","value":4408864},"name":"?LocateMailboxSegment@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEPAUSegment@123@I_N@Z"},{"address":{"type":"absolute","value":4408936},"name":"?LocateSegment@ScheduleGroupBase@details@Concurrency@@UAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@_N@Z"},{"address":{"type":"absolute","value":4409156},"name":"?LocateUnrealizedChores@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVWorkQueue@23@XZ"},{"address":{"type":"absolute","value":4409245},"name":"?MarkDetachment@?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4409296},"name":"?RedetachQueue@ScheduleGroupSegmentBase@details@Concurrency@@QAEXPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4409321},"name":"?ReleaseInternalContext@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4409359},"name":"?Remove@?$ListArray@U?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@details@Concurrency@@@details@Concurrency@@QAE_NPAU?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@23@H_N@Z"},{"address":{"type":"absolute","value":4409600},"name":"?Remove@ScheduleGroupSegmentBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4409635},"name":"?RemoveSegments@ScheduleGroupBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4409698},"name":"?RetireDetachedQueue@ScheduleGroupSegmentBase@details@Concurrency@@QAEXPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4409737},"name":"?SafelyDeleteDetachedWorkQueue@ScheduleGroupSegmentBase@details@Concurrency@@IAE_NPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4409851},"name":"?ScheduleTask@ScheduleGroupBase@details@Concurrency@@UAEXP6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4409891},"name":"?ScheduleTask@ScheduleGroupSegmentBase@details@Concurrency@@QAEXP6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4410199},"name":"?SetDeletionReferences@Segment@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4410237},"name":"?StealUnrealizedChore@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAV_UnrealizedChore@23@_N@Z"},{"address":{"type":"absolute","value":4410664},"name":"??IQuickBitSet@details@Concurrency@@QBE?AV012@ABV012@@Z"},{"address":{"type":"absolute","value":4410740},"name":"?"},{"address":{"type":"absolute","value":4410755},"name":"?Enqueue@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE?AVSlot@123@PAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4410896},"name":"?InterlockedSet@QuickBitSet@details@Concurrency@@QAEXABV123@@Z"},{"address":{"type":"absolute","value":4410952},"name":"?MailChore@CacheLocalScheduleGroup@details@Concurrency@@UAE?AVSlot@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@23@PAV_UnrealizedChore@23@PAVlocation@3@PAPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4411008},"name":"?MailChore@CacheLocalScheduleGroupSegment@details@Concurrency@@QAE?AVSlot@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@23@PAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4411032},"name":"?NotifyAffinitizedWork@CacheLocalScheduleGroupSegment@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4411083},"name":"?PostAffinityMessage@SchedulerBase@details@Concurrency@@QAEXABVQuickBitSet@23@@Z"},{"address":{"type":"absolute","value":4411145},"name":"?SetQuickCacheSlot@SchedulerBase@details@Concurrency@@QAEXIPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4411183},"name":"?FindSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4411230},"name":"?LocateSegment@FairScheduleGroup@details@Concurrency@@UAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@_N@Z"},{"address":{"type":"absolute","value":4411335},"name":"??0ExternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4411488},"name":"??1ExternalContextBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4411557},"name":"??_GExternalContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4411594},"name":"?Alloc@ExternalContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4411627},"name":"?Block@ExternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4411701},"name":"?Cleanup@ExternalContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4411789},"name":"?Free@ExternalContextBase@details@Concurrency@@UAEXPAX@Z"},{"address":{"type":"absolute","value":4411826},"name":"?GetCurrentSubAllocator@ExternalContextBase@details@Concurrency@@QAEPAVSubAllocator@23@XZ"},{"address":{"type":"absolute","value":4411855},"name":"?ImplicitDetachHandler@ExternalContextBase@details@Concurrency@@CGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_WAIT@@K@Z"},{"address":{"type":"absolute","value":4411889},"name":"?ImplicitDetachHandlerXP@ExternalContextBase@details@Concurrency@@CGXPAXE@Z"},{"address":{"type":"absolute","value":4411924},"name":"?IsSynchronouslyBlocked@ExternalContextBase@details@Concurrency@@UBE_NXZ"},{"address":{"type":"absolute","value":4411932},"name":"?"},{"address":{"type":"absolute","value":4411985},"name":"?PrepareForUse@ExternalContextBase@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4412180},"name":"?RemoveFromUse@ExternalContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4412214},"name":"?SpinYield@ExternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4412238},"name":"?Unblock@ExternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4412415},"name":"??0ThreadInternalContext@details@Concurrency@@QAE@PAVSchedulerBase@12@@Z"},{"address":{"type":"absolute","value":4412453},"name":"??0ThreadScheduler@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4412637},"name":"?Create@ThreadScheduler@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z"},{"address":{"type":"absolute","value":4412688},"name":"?CreateInternalContext@ThreadScheduler@details@Concurrency@@MAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4412750},"name":"?CreateVirtualProcessor@ThreadScheduler@details@Concurrency@@UAEPAVVirtualProcessor@23@PAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4412810},"name":"?"},{"address":{"type":"absolute","value":4412835},"name":"?"},{"address":{"type":"absolute","value":4412974},"name":"??0exception_ptr@std@@QAE@ABV01@@Z"},{"address":{"type":"absolute","value":4413040},"name":"?_Current_exception@exception_ptr@std@@SA?AV12@XZ"},{"address":{"type":"absolute","value":4413116},"name":"?_FinishCancelState@_TaskCollectionBase@details@Concurrency@@IAEXI@Z"},{"address":{"type":"absolute","value":4413154},"name":"?_GetTokenState@_TaskCollectionBase@details@Concurrency@@QAEPAV_CancellationTokenState@23@PAPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4413194},"name":"?_MarkCancellation@_TaskCollectionBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4413234},"name":"?_RaisedException@_TaskCollectionBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4413328},"name":"?_RethrowException@_TaskCollectionBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4413440},"name":"?_RethrowException@exception_ptr@std@@QBEXXZ"},{"address":{"type":"absolute","value":4413447},"name":"?rethrow_exception@std@@YAXVexception_ptr@1@@Z"},{"address":{"type":"absolute","value":4413472},"name":"??0?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAE@PAV_CriticalNonReentrantLock@12@@Z"},{"address":{"type":"absolute","value":4413575},"name":"??0WorkQueue@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4413685},"name":"?Reinitialize@WorkQueue@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4413779},"name":"?StaticRedetachFromScheduleGroup@WorkQueue@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4413796},"name":"?StaticRetire@WorkQueue@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4413813},"name":"?Steal@WorkQueue@details@Concurrency@@QAEPAV_UnrealizedChore@23@_N@Z"},{"address":{"type":"absolute","value":4414072},"name":"?TryToSteal@WorkQueue@details@Concurrency@@QAEPAV_UnrealizedChore@23@_NAA_N@Z"},{"address":{"type":"absolute","value":4414184},"name":"?UnlockedSteal@?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAEPAV_UnrealizedChore@23@_N0@Z"},{"address":{"type":"absolute","value":4414326},"name":"?UnlockedSteal@WorkQueue@details@Concurrency@@AAEPAV_UnrealizedChore@23@_N@Z"},{"address":{"type":"absolute","value":4414514},"name":"?_CancelViaToken@_UnrealizedChore@details@Concurrency@@CAXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4414553},"name":"?_InternalFree@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4414583},"name":"?_PrepareSteal@_UnrealizedChore@details@Concurrency@@QAEXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4414607},"name":"?_PrepareStealStructured@_UnrealizedChore@details@Concurrency@@AAEXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4414765},"name":"?_SetDetached@_UnrealizedChore@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4414778},"name":"?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4414957},"name":"__catch$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z$0"},{"address":{"type":"absolute","value":4415093},"name":"__catch$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z$1"},{"address":{"type":"absolute","value":4415138},"name":"??0VirtualProcessorRoot@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAUSchedulerNode@12@I@Z"},{"address":{"type":"absolute","value":4415212},"name":"??_GVirtualProcessorRoot@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4415254},"name":"?CurrentSubscriptionLevel@VirtualProcessorRoot@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4415270},"name":"?Remove@VirtualProcessorRoot@details@Concurrency@@UAEXPAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4415358},"name":"?ResetSubscriptionLevel@VirtualProcessorRoot@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4415380},"name":"?Subscribe@VirtualProcessorRoot@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4415393},"name":"?Unsubscribe@VirtualProcessorRoot@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4415406},"name":"??0FreeVirtualProcessorRoot@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAUSchedulerNode@12@I@Z"},{"address":{"type":"absolute","value":4415457},"name":"??8HardwareAffinity@details@Concurrency@@QAE_NABU012@@Z"},{"address":{"type":"absolute","value":4415489},"name":"??_GFreeVirtualProcessorRoot@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4415531},"name":"?AcquireActivatedContext@VirtualProcessorRoot@details@Concurrency@@QAEPAUIExecutionContext@3@XZ"},{"address":{"type":"absolute","value":4415578},"name":"?Activate@FreeVirtualProcessorRoot@details@Concurrency@@UAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4415772},"name":"?Affinitize@FreeVirtualProcessorRoot@details@Concurrency@@QAEXPAVFreeThreadProxy@23@@Z"},{"address":{"type":"absolute","value":4415875},"name":"?Deactivate@FreeVirtualProcessorRoot@details@Concurrency@@UAE_NPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4416038},"name":"?DeleteThis@FreeVirtualProcessorRoot@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4416116},"name":"?EnsureAllTasksVisible@FreeVirtualProcessorRoot@details@Concurrency@@UAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4416244},"name":"?ResetOnIdle@FreeVirtualProcessorRoot@details@Concurrency@@QAEXW4SwitchingProxyState@3@@Z"},{"address":{"type":"absolute","value":4416353},"name":"?SetAffinity@FreeThreadProxy@details@Concurrency@@QAEXUHardwareAffinity@23@@Z"},{"address":{"type":"absolute","value":4416407},"name":"?SpinUntilIdle@FreeVirtualProcessorRoot@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4416453},"name":"?AssociateExecutionContext@FreeThreadProxy@details@Concurrency@@QAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4416488},"name":"?Dispatch@FreeThreadProxy@details@Concurrency@@EAEXXZ"},{"address":{"type":"absolute","value":4416654},"name":"?ReturnIdleProxy@FreeThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4416684},"name":"?SwitchOut@FreeThreadProxy@details@Concurrency@@UAEXW4SwitchingProxyState@3@@Z"},{"address":{"type":"absolute","value":4416765},"name":"?SwitchTo@FreeThreadProxy@details@Concurrency@@UAEXPAUIExecutionContext@3@W4SwitchingProxyState@3@@Z"},{"address":{"type":"absolute","value":4416961},"name":"??0ThreadProxy@details@Concurrency@@QAE@PAUIThreadProxyFactory@12@I@Z"},{"address":{"type":"absolute","value":4417199},"name":"??1ThreadProxy@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4417296},"name":"??_GThreadProxy@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4417330},"name":"?Cancel@ThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4417361},"name":"?SetPriority@ThreadProxy@details@Concurrency@@QAEXH@Z"},{"address":{"type":"absolute","value":4417385},"name":"?SpinUntilBlocked@ThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4417428},"name":"?SuspendExecution@ThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4417456},"name":"?ThreadProxyMain@ThreadProxy@details@Concurrency@@CGKPAX@Z"},{"address":{"type":"absolute","value":4417536},"name":"??0location@Concurrency@@QAE@W4_Type@01@IIPAX@Z"},{"address":{"type":"absolute","value":4417573},"name":"?ContainsResourceId@SchedulingNode@details@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4417615},"name":"?_FastNodeIntersects@location@Concurrency@@QBE_NABV12@@Z"},{"address":{"type":"absolute","value":4417690},"name":"?_FastVPIntersects@location@Concurrency@@QBE_NABV12@@Z"},{"address":{"type":"absolute","value":4417766},"name":"??0WorkItem@details@Concurrency@@QAE@PAVInternalContextBase@12@@Z"},{"address":{"type":"absolute","value":4417804},"name":"?AcquireQuickCacheSlot@SchedulerBase@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@I@Z"},{"address":{"type":"absolute","value":4417885},"name":"?Bind@WorkItem@details@Concurrency@@QAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4417962},"name":"?BindTo@WorkItem@details@Concurrency@@QAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4418020},"name":"?CheckPriorityList@WorkSearchContext@details@Concurrency@@AAE_N_K@Z"},{"address":{"type":"absolute","value":4418074},"name":"?GetLocalRunnable@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVVirtualProcessor@23@_N@Z"},{"address":{"type":"absolute","value":4418225},"name":"?GetNextSchedulingNode@SchedulerBase@details@Concurrency@@QAEPAVSchedulingNode@23@PAHH@Z"},{"address":{"type":"absolute","value":4418302},"name":"?GetPseudoRRAffineScheduleGroupSegment@SchedulingRing@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@PAH@Z"},{"address":{"type":"absolute","value":4418361},"name":"?GetPseudoRRNonAffineScheduleGroupSegment@SchedulingRing@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@PAH@Z"},{"address":{"type":"absolute","value":4418423},"name":"?GetRealizedChore@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_N@Z"},{"address":{"type":"absolute","value":4418503},"name":"?GetRealizedChoreWithinGroup@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@2@Z"},{"address":{"type":"absolute","value":4418632},"name":"?GetRunnableContext@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4418693},"name":"?GetRunnableContextWithinGroup@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@W4SearchAffinity@123@_N@Z"},{"address":{"type":"absolute","value":4418816},"name":"?GetUnrealizedChore@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_N2@Z"},{"address":{"type":"absolute","value":4418899},"name":"?GetUnrealizedChoreWithinGroup@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@2@Z"},{"address":{"type":"absolute","value":4419041},"name":"?Invoke@WorkItem@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4419108},"name":"?PeriodicScan@SchedulerBase@details@Concurrency@@QAEX_K@Z"},{"address":{"type":"absolute","value":4419165},"name":"?PreSearch@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@@Z"},{"address":{"type":"absolute","value":4419225},"name":"?QuickSearch@WorkSearchContext@details@Concurrency@@AAE_NPAVScheduleGroupSegmentBase@23@PAVWorkItem@23@_NK@Z"},{"address":{"type":"absolute","value":4419334},"name":"?QuickSearchYield@WorkSearchContext@details@Concurrency@@AAE_NPAVScheduleGroupSegmentBase@23@PAVWorkItem@23@_NK@Z"},{"address":{"type":"absolute","value":4419444},"name":"?Reset@WorkSearchContext@details@Concurrency@@QAEXPAVVirtualProcessor@23@W4Algorithm@123@@Z"},{"address":{"type":"absolute","value":4419534},"name":"?ResolveToken@WorkItem@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4419661},"name":"?SearchCacheLocal@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4420372},"name":"?SearchCacheLocalYield@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4421020},"name":"?SearchCacheLocal_Realized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@K3@Z"},{"address":{"type":"absolute","value":4421272},"name":"?SearchCacheLocal_Runnables@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@K3@Z"},{"address":{"type":"absolute","value":4421542},"name":"?SearchCacheLocal_Unrealized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@K3@Z"},{"address":{"type":"absolute","value":4421797},"name":"?SearchFair@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4422072},"name":"?SearchFairYield@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4422342},"name":"?SearchFair_Realized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@_N@Z"},{"address":{"type":"absolute","value":4422490},"name":"?SearchFair_Runnables@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4422619},"name":"?SearchFair_Unrealized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@_N@Z"},{"address":{"type":"absolute","value":4422771},"name":"?ServiceMark@ScheduleGroupSegmentBase@details@Concurrency@@QAEX_K@Z"},{"address":{"type":"absolute","value":4422809},"name":"?ServiceMark@VirtualProcessor@details@Concurrency@@QAEX_K@Z"},{"address":{"type":"absolute","value":4422847},"name":"?SkipSegmentSearch@WorkSearchContext@details@Concurrency@@AAE_NPAVScheduleGroupSegmentBase@23@0W4SearchAffinity@123@_N@Z"},{"address":{"type":"absolute","value":4422987},"name":"?StealForeignLocalRunnable@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingNode@23@@Z"},{"address":{"type":"absolute","value":4423053},"name":"?StealLocalRunnable@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingNode@23@PAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4423164},"name":"?StealLocalRunnableContext@VirtualProcessor@details@Concurrency@@AAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4423187},"name":"?TransferReferences@WorkItem@details@Concurrency@@QAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4423262},"name":"?Invoke@RealizedChore@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4423282},"name":"??0ThreadVirtualProcessor@details@Concurrency@@QAE@PAVSchedulingNode@12@PAUIVirtualProcessorRoot@2@@Z"},{"address":{"type":"absolute","value":4423337},"name":"??_GThreadVirtualProcessor@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4423386},"name":"__EH_epilog3"},{"address":{"type":"absolute","value":4423407},"name":"__EH_epilog3_GS"},{"address":{"type":"absolute","value":4423424},"name":"__EH_prolog3"},{"address":{"type":"absolute","value":4423476},"name":"__EH_prolog3_GS"},{"address":{"type":"absolute","value":4423531},"name":"__EH_prolog3_catch"},{"address":{"type":"absolute","value":4423600},"name":"__aulldvrm"},{"address":{"type":"absolute","value":4423760},"name":"__allmul"},{"address":{"type":"absolute","value":4423936},"name":"__alloca_probe_16"},{"address":{"type":"absolute","value":4423984},"name":"__FindPESection"},{"address":{"type":"absolute","value":4424064},"name":"__IsNonwritableInCurrentImage"},{"address":{"type":"absolute","value":4424256},"name":"__ValidateImageBase"},{"address":{"type":"absolute","value":4424320},"name":"?"},{"address":{"type":"absolute","value":4424368},"name":"__SEH_prolog4_GS"},{"address":{"type":"absolute","value":4424441},"name":"__SEH_epilog4_GS"},{"address":{"type":"absolute","value":4424464},"name":"__alldiv"},{"address":{"type":"absolute","value":4424704},"name":"__alldvrm"},{"address":{"type":"absolute","value":4424928},"name":"__allrem"},{"address":{"type":"absolute","value":4425429},"name":"??_L@YGXPAXIIP6EX0@Z1@Z"},{"address":{"type":"absolute","value":4425551},"name":"??$?0AAPAUEHExceptionRecord@@_N@?$_Ref_count_obj@V__ExceptionPtr@@@std@@QAE@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425599},"name":"??$?0AAPAUEHExceptionRecord@@_N@?$_Ref_count_obj_alloc@V__ExceptionPtr@@U?$_StaticAllocator@H@@@std@@QAE@ABU?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425667},"name":"?"},{"address":{"type":"absolute","value":4425698},"name":"??$allocate_shared@V__ExceptionPtr@@U?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@_N@std@@YA?AV?$shared_ptr@V__ExceptionPtr@@@0@ABU?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425757},"name":"__catch$??$allocate_shared@V__ExceptionPtr@@U?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@_N@std@@YA?AV?$shared_ptr@V__ExceptionPtr@@@0@ABU?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@$$QA_N@Z$0"},{"address":{"type":"absolute","value":4425767},"name":"??$make_shared@V__ExceptionPtr@@AAPAUEHExceptionRecord@@_N@std@@YA?AV?$shared_ptr@V__ExceptionPtr@@@0@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425831},"name":"??0__ExceptionPtr@@QAE@PBUEHExceptionRecord@@_N@Z"},{"address":{"type":"absolute","value":4426115},"name":"??1__ExceptionPtr@@QAE@XZ"},{"address":{"type":"absolute","value":4426306},"name":"?"},{"address":{"type":"absolute","value":4426335},"name":"?"},{"address":{"type":"absolute","value":4426415},"name":"?_CallCopyCtor@__ExceptionPtr@@ABEXPAX0IQBU_s_CatchableType@@@Z"},{"address":{"type":"absolute","value":4426558},"name":"__catch$?_CallCopyCtor@__ExceptionPtr@@ABEXPAX0IQBU_s_CatchableType@@@Z$0"},{"address":{"type":"absolute","value":4426564},"name":"?_CurrentException@__ExceptionPtr@@SA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ"},{"address":{"type":"absolute","value":4426659},"name":"__catch$?_CurrentException@__ExceptionPtr@@SA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ$0"},{"address":{"type":"absolute","value":4426700},"name":"__catch$?_CurrentException@__ExceptionPtr@@SA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ$1"},{"address":{"type":"absolute","value":4426706},"name":"?_Delete_this@?$_Ref_count_obj@V__ExceptionPtr@@@std@@EAEXXZ"},{"address":{"type":"absolute","value":4426736},"name":"?_Delete_this@?$_Ref_count_obj_alloc@V__ExceptionPtr@@U?$_StaticAllocator@H@@@std@@EAEXXZ"},{"address":{"type":"absolute","value":4426770},"name":"?_InitBadAllocException@__ExceptionPtr@@CA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ"},{"address":{"type":"absolute","value":4426876},"name":"?_PlacementInitBadAllocException@__ExceptionPtr@@CGHPAX0PAPAX@Z"},{"address":{"type":"absolute","value":4426937},"name":"?_PopulateExceptionRecord@__ExceptionPtr@@SAPAUEHExceptionRecord@@AAU2@PBXPBU_s_ThrowInfo@@@Z"},{"address":{"type":"absolute","value":4427027},"name":"?_RethrowException@__ExceptionPtr@@QBEXXZ"},{"address":{"type":"absolute","value":4427262},"name":"?_StaticAlloc@@YAPAXI@Z"},{"address":{"type":"absolute","value":4427323},"name":"?__ExceptionPtrCopy@@YAXPAXPBX@Z"},{"address":{"type":"absolute","value":4427346},"name":"?__ExceptionPtrCreate@@YAXPAX@Z"},{"address":{"type":"absolute","value":4427361},"name":"?__ExceptionPtrCurrentException@@YAXPAX@Z"},{"address":{"type":"absolute","value":4427404},"name":"?__ExceptionPtrDestroy@@YAXPAX@Z"},{"address":{"type":"absolute","value":4427419},"name":"?__ExceptionPtrRethrow@@YAXPBX@Z"},{"address":{"type":"absolute","value":4427437},"name":"?align@std@@YAPAXIIAAPAXAAI@Z"},{"address":{"type":"absolute","value":4427504},"name":"_strrchr"},{"address":{"type":"absolute","value":4427824},"name":"_strchr"},{"address":{"type":"absolute","value":4428123},"name":"_wcschr"},{"address":{"type":"absolute","value":4428376},"name":"?FindMITargetTypeInstance@@YAPBU_s_RTTIBaseClassDescriptor@@PAXPBU_s_RTTICompleteObjectLocator@@PAUTypeDescriptor@@H2@Z"},{"address":{"type":"absolute","value":4428613},"name":"?FindSITargetTypeInstance@@YAPBU_s_RTTIBaseClassDescriptor@@PBU_s_RTTICompleteObjectLocator@@PAUTypeDescriptor@@1@Z"},{"address":{"type":"absolute","value":4428846},"name":"?FindVITargetTypeInstance@@YAPBU_s_RTTIBaseClassDescriptor@@PAXPBU_s_RTTICompleteObjectLocator@@PAUTypeDescriptor@@H2@Z"},{"address":{"type":"absolute","value":4429202},"name":"?PMDtoOffset@@YAHPAXABUPMD@@@Z"},{"address":{"type":"absolute","value":4429238},"name":"?TypeidsEqual@@YA_NQBUTypeDescriptor@@0@Z"},{"address":{"type":"absolute","value":4429364},"name":"___RTDynamicCast"},{"address":{"type":"absolute","value":4429676},"name":"__CIexp"},{"address":{"type":"absolute","value":4429760},"name":"__CIsqrt"},{"address":{"type":"absolute","value":4429789},"name":"start"},{"address":{"type":"absolute","value":4430656},"name":"__cintrindisp2"},{"address":{"type":"absolute","value":4430856},"name":"ctranexit"},{"address":{"type":"absolute","value":4430863},"name":"cintrinexit"},{"address":{"type":"absolute","value":4431295},"name":"fpload"},{"address":{"type":"absolute","value":4431312},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$0"},{"address":{"type":"absolute","value":4431320},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$1"},{"address":{"type":"absolute","value":4431331},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$2"},{"address":{"type":"absolute","value":4431342},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$3"},{"address":{"type":"absolute","value":4431353},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$4"},{"address":{"type":"absolute","value":4431364},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$5"},{"address":{"type":"absolute","value":4431375},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$6"},{"address":{"type":"absolute","value":4431386},"name":"__ehhandler$??0_Locinfo@std@@QAE@PBD@Z"},{"address":{"type":"absolute","value":4431496},"name":"__unwindfunclet$?DrawItem@CMFCButton@@UAEXPAUtagDRAWITEMSTRUCT@@@Z$0"},{"address":{"type":"absolute","value":4431504},"name":"__ehhandler$?DrawItem@CMFCButton@@UAEXPAUtagDRAWITEMSTRUCT@@@Z"},{"address":{"type":"absolute","value":4431936},"name":"__unwindfunclet$?propagate_message@?$_Greedy_node@W4agent_status@Concurrency@@@Concurrency@@MAE?AW4message_status@2@PAV?$message@W4agent_status@Concurrency@@@2@PAV?$ISource@W4agent_status@Concurrency@@@2@@Z$0"},{"address":{"type":"absolute","value":4431944},"name":"__ehhandler$?propagate_message@?$_Greedy_node@W4agent_status@Concurrency@@@Concurrency@@MAE?AW4message_status@2@PAV?$message@W4agent_status@Concurrency@@@2@PAV?$ISource@W4agent_status@Concurrency@@@2@@Z"},{"address":{"type":"absolute","value":4432040},"name":"__ehhandler$___std_fs_change_permissions@12"},{"address":{"type":"absolute","value":4432112},"name":"__unwindfunclet$??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z$0"},{"address":{"type":"absolute","value":4432140},"name":"__unwindfunclet$??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z$1"},{"address":{"type":"absolute","value":4432151},"name":"__ehhandler$??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z"},{"address":{"type":"absolute","value":4432320},"name":"__unwindfunclet$?__ExceptionPtrCopyException@@YAXPAXPBX1@Z$0"},{"address":{"type":"absolute","value":4432328},"name":"__ehhandler$?__ExceptionPtrCopyException@@YAXPAXPBX1@Z"},{"address":{"type":"absolute","value":4432416},"name":"__unwindfunclet$??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z$0"},{"address":{"type":"absolute","value":4432444},"name":"__ehhandler$??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z"},{"address":{"type":"absolute","value":4432488},"name":"__ehhandler$??1CMSPCallBase@@UAE@XZ"},{"address":{"type":"absolute","value":4432736},"name":"__ehhandler$?clear@?$vector@_NV?$allocator@_N@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4432864},"name":"__ehhandler$??$_Insert_range@PBE@?$vector@EV?$AllocatorWithCleanup@E$0A@@CryptoPP@@@std@@AAEXV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@E@std@@@std@@@1@PBE1Uforward_iterator_tag@1@@Z"},{"address":{"type":"absolute","value":4432945},"name":"__unwindfunclet$?OnDrawValue@CMFCPropertyGridColorProperty@@UAEXPAVCDC@@VCRect@@@Z$0"},{"address":{"type":"absolute","value":4432953},"name":"__ehhandler$?OnDrawValue@CMFCPropertyGridColorProperty@@UAEXPAVCDC@@VCRect@@@Z"},{"address":{"type":"absolute","value":4432990},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4432998},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433122},"name":"__unwindfunclet$?set@event@Concurrency@@QAEXXZ$0"},{"address":{"type":"absolute","value":4433130},"name":"__unwindfunclet$?set@event@Concurrency@@QAEXXZ$1"},{"address":{"type":"absolute","value":4433138},"name":"__ehhandler$?set@event@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4433210},"name":"__unwindfunclet$?wait@event@Concurrency@@QAEII@Z$0"},{"address":{"type":"absolute","value":4433218},"name":"__ehhandler$?wait@event@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4433245},"name":"__unwindfunclet$?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z$0"},{"address":{"type":"absolute","value":4433258},"name":"__unwindfunclet$?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z$1"},{"address":{"type":"absolute","value":4433266},"name":"__ehhandler$?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z"},{"address":{"type":"absolute","value":4433293},"name":"__unwindfunclet$?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z$0"},{"address":{"type":"absolute","value":4433301},"name":"__unwindfunclet$?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z$1"},{"address":{"type":"absolute","value":4433312},"name":"__ehhandler$?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z"},{"address":{"type":"absolute","value":4433342},"name":"__unwindfunclet$?try_lock_for@critical_section@Concurrency@@QAE_NI@Z$0"},{"address":{"type":"absolute","value":4433355},"name":"__ehhandler$?try_lock_for@critical_section@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4433382},"name":"__unwindfunclet$??0ResourceManager@details@Concurrency@@AAE@XZ$0"},{"address":{"type":"absolute","value":4433393},"name":"__unwindfunclet$??0ResourceManager@details@Concurrency@@AAE@XZ$1"},{"address":{"type":"absolute","value":4433404},"name":"__ehhandler$??0ResourceManager@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4433431},"name":"__unwindfunclet$?CaptureProcessAffinity@ResourceManager@details@Concurrency@@CAXXZ$2"},{"address":{"type":"absolute","value":4433444},"name":"__ehhandler$?CaptureProcessAffinity@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4433481},"name":"__unwindfunclet$?CreateAllocatedNodeData@ResourceManager@details@Concurrency@@QAEPAUSchedulerNode@23@XZ$0"},{"address":{"type":"absolute","value":4433510},"name":"__ehhandler$?CreateAllocatedNodeData@ResourceManager@details@Concurrency@@QAEPAUSchedulerNode@23@XZ"},{"address":{"type":"absolute","value":4433537},"name":"__unwindfunclet$?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z$0"},{"address":{"type":"absolute","value":4433545},"name":"__unwindfunclet$?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z$1"},{"address":{"type":"absolute","value":4433561},"name":"__ehhandler$?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4433588},"name":"__unwindfunclet$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ$0"},{"address":{"type":"absolute","value":4433596},"name":"__unwindfunclet$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ$1"},{"address":{"type":"absolute","value":4433612},"name":"__unwindfunclet$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ$2"},{"address":{"type":"absolute","value":4433628},"name":"__ehhandler$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ"},{"address":{"type":"absolute","value":4433717},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4433725},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433752},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4433760},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433884},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4433892},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433919},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$0"},{"address":{"type":"absolute","value":4433927},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$1"},{"address":{"type":"absolute","value":4433938},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$2"},{"address":{"type":"absolute","value":4433949},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$3"},{"address":{"type":"absolute","value":4433960},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$4"},{"address":{"type":"absolute","value":4433971},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$5"},{"address":{"type":"absolute","value":4433982},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$6"},{"address":{"type":"absolute","value":4433993},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$7"},{"address":{"type":"absolute","value":4434007},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$8"},{"address":{"type":"absolute","value":4434021},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$9"},{"address":{"type":"absolute","value":4434035},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$10"},{"address":{"type":"absolute","value":4434049},"name":"__ehhandler$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4434130},"name":"__unwindfunclet$?AllocateSegment@CacheLocalScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434146},"name":"__ehhandler$?AllocateSegment@CacheLocalScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4434173},"name":"__unwindfunclet$?AllocateSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434189},"name":"__ehhandler$?AllocateSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4434216},"name":"__unwindfunclet$?GetBitSet@SchedulerBase@details@Concurrency@@QAE?AVQuickBitSet@23@PBVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434241},"name":"__ehhandler$?GetBitSet@SchedulerBase@details@Concurrency@@QAE?AVQuickBitSet@23@PBVlocation@3@@Z"},{"address":{"type":"absolute","value":4434311},"name":"__unwindfunclet$?GetExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z$0"},{"address":{"type":"absolute","value":4434327},"name":"__ehhandler$?GetExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4434381},"name":"__unwindfunclet$?GetSubAllocator@SchedulerBase@details@Concurrency@@SAPAVSubAllocator@23@_N@Z$0"},{"address":{"type":"absolute","value":4434397},"name":"__ehhandler$?GetSubAllocator@SchedulerBase@details@Concurrency@@SAPAVSubAllocator@23@_N@Z"},{"address":{"type":"absolute","value":4434424},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$0"},{"address":{"type":"absolute","value":4434465},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$1"},{"address":{"type":"absolute","value":4434473},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$2"},{"address":{"type":"absolute","value":4434489},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$3"},{"address":{"type":"absolute","value":4434505},"name":"__ehhandler$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4434532},"name":"__unwindfunclet$?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434545},"name":"__unwindfunclet$?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z$1"},{"address":{"type":"absolute","value":4434558},"name":"__ehhandler$?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4434585},"name":"__unwindfunclet$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$0"},{"address":{"type":"absolute","value":4434593},"name":"__unwindfunclet$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$1"},{"address":{"type":"absolute","value":4434607},"name":"__unwindfunclet$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$2"},{"address":{"type":"absolute","value":4434621},"name":"__ehhandler$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4434758},"name":"__unwindfunclet$??0CFullScreenImpl@@QAE@PAVCFrameImpl@@@Z$0"},{"address":{"type":"absolute","value":4434769},"name":"__ehhandler$??0CFullScreenImpl@@QAE@PAVCFrameImpl@@@Z"},{"address":{"type":"absolute","value":4434823},"name":"__unwindfunclet$?_Alias@_TaskCollection@details@Concurrency@@AAEPAV123@XZ$0"},{"address":{"type":"absolute","value":4434839},"name":"__ehhandler$?_Alias@_TaskCollection@details@Concurrency@@AAEPAV123@XZ"},{"address":{"type":"absolute","value":4434901},"name":"__unwindfunclet$?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z$0"},{"address":{"type":"absolute","value":4434909},"name":"__unwindfunclet$?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z$1"},{"address":{"type":"absolute","value":4434917},"name":"__ehhandler$?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4434944},"name":"__unwindfunclet$?_FullAliasWait@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z$0"},{"address":{"type":"absolute","value":4434952},"name":"__ehhandler$?_FullAliasWait@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4435016},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4435024},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4435051},"name":"__ehhandler$?clear@?$vector@_NV?$allocator@_N@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4435078},"name":"__unwindfunclet$??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z$0"},{"address":{"type":"absolute","value":4435089},"name":"__unwindfunclet$??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z$1"},{"address":{"type":"absolute","value":4435105},"name":"__ehhandler$??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4435242},"name":"__unwindfunclet$?CreateVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@UAEPAVVirtualProcessorRoot@23@PAUSchedulerNode@23@I@Z$0"},{"address":{"type":"absolute","value":4435255},"name":"__ehhandler$?CreateVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@UAEPAVVirtualProcessorRoot@23@PAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4435400},"name":"__unwindfunclet$?Create@FreeThreadProxyFactory@details@Concurrency@@EAEPAVFreeThreadProxy@23@I@Z$0"},{"address":{"type":"absolute","value":4435413},"name":"__ehhandler$?Create@FreeThreadProxyFactory@details@Concurrency@@EAEPAVFreeThreadProxy@23@I@Z"},{"address":{"type":"absolute","value":4435489},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4435497},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4435524},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4435532},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4435559},"name":"__unwindfunclet$?Dispatch@InternalContextBase@details@Concurrency@@UAEXPAUDispatchState@3@@Z$0"},{"address":{"type":"absolute","value":4435584},"name":"__ehhandler$?Dispatch@InternalContextBase@details@Concurrency@@UAEXPAUDispatchState@3@@Z"},{"address":{"type":"absolute","value":4435667},"name":"__unwindfunclet$??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z$0"},{"address":{"type":"absolute","value":4435678},"name":"__unwindfunclet$??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z$1"},{"address":{"type":"absolute","value":4435689},"name":"__ehhandler$??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z"},{"address":{"type":"absolute","value":4435716},"name":"__unwindfunclet$??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z$0"},{"address":{"type":"absolute","value":4435727},"name":"__unwindfunclet$??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z$1"},{"address":{"type":"absolute","value":4435740},"name":"__ehhandler$??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z"},{"address":{"type":"absolute","value":4435802},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$0"},{"address":{"type":"absolute","value":4435813},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$1"},{"address":{"type":"absolute","value":4435821},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$2"},{"address":{"type":"absolute","value":4435832},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$3"},{"address":{"type":"absolute","value":4435843},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$4"},{"address":{"type":"absolute","value":4435857},"name":"__ehhandler$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z"},{"address":{"type":"absolute","value":4435922},"name":"__unwindfunclet$?DemandInitialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEXXZ$0"},{"address":{"type":"absolute","value":4435935},"name":"__ehhandler$?DemandInitialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4436002},"name":"__unwindfunclet$??0ExternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$0"},{"address":{"type":"absolute","value":4436010},"name":"__ehhandler$??0ExternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4436037},"name":"__unwindfunclet$?Create@ThreadScheduler@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z$0"},{"address":{"type":"absolute","value":4436053},"name":"__ehhandler$?Create@ThreadScheduler@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z"},{"address":{"type":"absolute","value":4436080},"name":"__unwindfunclet$?CreateInternalContext@ThreadScheduler@details@Concurrency@@MAEPAVInternalContextBase@23@XZ$0"},{"address":{"type":"absolute","value":4436096},"name":"__ehhandler$?CreateInternalContext@ThreadScheduler@details@Concurrency@@MAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4436123},"name":"__unwindfunclet$?CreateVirtualProcessor@ThreadScheduler@details@Concurrency@@UAEPAVVirtualProcessor@23@PAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z$0"},{"address":{"type":"absolute","value":4436139},"name":"__ehhandler$?CreateVirtualProcessor@ThreadScheduler@details@Concurrency@@UAEPAVVirtualProcessor@23@PAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4436263},"name":"__unwindfunclet$??0WorkQueue@details@Concurrency@@QAE@XZ$0"},{"address":{"type":"absolute","value":4436271},"name":"__unwindfunclet$??0WorkQueue@details@Concurrency@@QAE@XZ$1"},{"address":{"type":"absolute","value":4436282},"name":"__ehhandler$??0WorkQueue@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4436535},"name":"__ehhandler$?clear@?$vector@_NV?$allocator@_N@std@@@std@@QAEXXZ"}]}},"rules":{"hide graphical window":{"meta":{"name":"hide graphical window","namespace":"host-interaction/gui/window/hide","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Hide Artifacts","Hidden Window"],"tactic":"Defense Evasion","technique":"Hide Artifacts","subtechnique":"Hidden Window","id":"T1564.003"}],"mbc":[],"references":[],"examples":["39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: hide graphical window\r\n    namespace: host-interaction/gui/window/hide\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    att&ck:\r\n      - Defense Evasion::Hide Artifacts::Hidden Window [T1564.003]\r\n    examples:\r\n      - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250\r\n  features:\r\n    - and:\r\n      - number: 0x0 = SW_HIDE\r\n      - api: user32.ShowWindow\r\n","matches":[[{"type":"absolute","value":4204228},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"SW_HIDE"}},"children":[],"locations":[{"type":"absolute","value":4204228}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ShowWindow"}},"children":[],"locations":[{"type":"absolute","value":4204236}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4204349},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"SW_HIDE"}},"children":[],"locations":[{"type":"absolute","value":4204349}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ShowWindow"}},"children":[],"locations":[{"type":"absolute","value":4204357}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4207549},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"SW_HIDE"}},"children":[],"locations":[{"type":"absolute","value":4207557},{"type":"absolute","value":4207559},{"type":"absolute","value":4207751},{"type":"absolute","value":4207723},{"type":"absolute","value":4207596},{"type":"absolute","value":4207771},{"type":"absolute","value":4207670},{"type":"absolute","value":4207738},{"type":"absolute","value":4207611},{"type":"absolute","value":4207549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ShowWindow"}},"children":[],"locations":[{"type":"absolute","value":4207705}],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delay execution\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@ramen0x3f\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449770\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.Sleep\r\n          - api: kernel32.SleepEx\r\n          - api: kernel32.WaitForSingleObject\r\n          - api: kernel32.SignalObjectAndWait\r\n          - api: kernel32.WaitForSingleObjectEx\r\n          - api: kernel32.WaitForMultipleObjects\r\n          - api: kernel32.WaitForMultipleObjectsEx\r\n          - api: kernel32.RegisterWaitForSingleObject\r\n          - api: WaitOnAddress\r\n          - api: user32.MsgWaitForMultipleObjects\r\n          - api: user32.MsgWaitForMultipleObjectsEx\r\n          - api: NtDelayExecution\r\n          - api: KeWaitForSingleObject\r\n          - api: KeDelayExecutionThread\r\n      - and:\r\n        - os: linux\r\n        - or:\r\n          - api: sleep\r\n          - api: usleep\r\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4205930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4342566},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[{"type":"absolute","value":4342581}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4342589},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4342595}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4342778},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[{"type":"absolute","value":4342789}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: open process\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Open Process [C0065]\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - or:\r\n      - api: kernel32.OpenProcess\r\n      - api: NtOpenProcess\r\n      - api: ZwOpenProcess\r\n","matches":[[{"type":"absolute","value":4207549},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4207745}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inspect load icon resource":{"meta":{"name":"inspect load icon resource","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\r\nrule:\r\n  meta:\r\n    name: inspect load icon resource\r\n    namespace: anti-analysis\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires mnemonic features\r\n  features:\r\n    # check if call to LoadIcon fails when first argument is NULL\r\n    # and second argument is not a valid predefined icon - LoadIcon\r\n    # should return NULL here, but some sandboxes/emulation may instead\r\n    # return a valid handle\r\n    - and:\r\n      - api: user32.LoadIcon\r\n      - number: 0x0\r\n      - mnemonic: test\r\n      - not:\r\n        - or:\r\n          - description: predefined icon identifiers\r\n          - number: 0x7F05 = IDI_WINLOGO\r\n          - number: 0x7F06 = IDI_SHIELD\r\n          - number: 0x7F02 = IDI_QUESTION\r\n          - number: 0x7F00 = IDI_APPLICATION\r\n          - number: 0x7F04 = (IDI_ASTERISK | IDI_INFORMATION)\r\n          - number: 0x7F01 = (IDI_ERROR | IDI_HAND)\r\n          - number: 0x7F03 = (IDI_EXCLAMATION | IDI_WARNING)\r\n","matches":[[{"type":"absolute","value":4207549},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadIcon"}},"children":[],"locations":[{"type":"absolute","value":4207685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4207557},{"type":"absolute","value":4207559},{"type":"absolute","value":4207751},{"type":"absolute","value":4207723},{"type":"absolute","value":4207596},{"type":"absolute","value":4207771},{"type":"absolute","value":4207670},{"type":"absolute","value":4207738},{"type":"absolute","value":4207611},{"type":"absolute","value":4207549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"test"}},"children":[],"locations":[{"type":"absolute","value":4207795}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"predefined icon identifiers"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32517,"description":"IDI_WINLOGO"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32518,"description":"IDI_SHIELD"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32514,"description":"IDI_QUESTION"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32512,"description":"IDI_APPLICATION"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32516,"description":"(IDI_ASTERISK | IDI_INFORMATION)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32513,"description":"(IDI_ERROR | IDI_HAND)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32515,"description":"(IDI_EXCLAMATION | IDI_WARNING)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check mutex":{"meta":{"name":"check mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Check Mutex"],"objective":"Process","behavior":"Check Mutex","method":"","id":"C0043"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check mutex\r\n    namespace: host-interaction/mutex\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Check Mutex [C0043]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: kernel32.OpenMutex\r\n        - match: create mutex\r\n        - api: System.Threading.Mutex::OpenExisting\r\n        - api: System.Threading.Mutex::TryOpenExisting\r\n      - optional:\r\n        - or:\r\n          - api: kernel32.GetLastError\r\n          - number: 2 = ERROR_FILE_NOT_FOUND\r\n          - number: 0xB7 = ERROR_ALREADY_EXISTS\r\n","matches":[[{"type":"absolute","value":4207814},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenMutex"}},"children":[],"locations":[{"type":"absolute","value":4207826}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create mutex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::OpenExisting"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::TryOpenExisting"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"ERROR_FILE_NOT_FOUND"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":183,"description":"ERROR_ALREADY_EXISTS"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"PEB access":{"meta":{"name":"PEB access","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block","id":"B0001.019"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp"],"examples":["al-khaser_x86.exe_:0x420D20"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: PEB access\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x420D20\r\n  features:\r\n    - or:\r\n      - characteristic: peb access\r\n      - and:\r\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41\r\n        - arch: i386\r\n        - characteristic: fs access\r\n        - or:\r\n          # in 0f5d5d07c6533bc6d991836ce79daaa1\r\n          # then we have:\r\n          #\r\n          #     xor edx, edx\r\n          #     mov edx, fs:[edx+30h]\r\n          - offset: 0x30\r\n          - instruction:\r\n            # in the case of CallObfuscator, gs:[rax]\r\n            - mnemonic: add\r\n            - number: 0x30\r\n      - and:\r\n        - arch: amd64\r\n        - characteristic: gs access\r\n        - or:\r\n          - offset: 0x60\r\n          - instruction:\r\n            - mnemonic: add\r\n            - number: 0x60\r\n      - and:\r\n        # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000\r\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45\r\n        - characteristic: fs access\r\n        - instruction:\r\n          - mnemonic: sub\r\n          - number: 0x2000\r\n","matches":[[{"type":"absolute","value":4217776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4217968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217978},{"type":"absolute","value":4218002}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217978},{"type":"absolute","value":4218002}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4218131},{"type":"absolute","value":4218014}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4361594},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4361624},{"type":"absolute","value":4361604},{"type":"absolute","value":4361767}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4361624},{"type":"absolute","value":4361604},{"type":"absolute","value":4361767}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4361742}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[{"type":"absolute","value":4361709}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"access PEB ldr_data":{"meta":{"name":"access PEB ldr_data","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm","https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8"],"examples":["3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: access PEB ldr_data\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    references:\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm\r\n      - https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8\r\n    examples:\r\n      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7\r\n  features:\r\n    - or:\r\n      - and:\r\n        - arch: i386\r\n        - description: x32\r\n\r\n        - match: PEB access\r\n\r\n        # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0\r\n        # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives\r\n\r\n        - offset: 0x0C = PEB.LDR_DATA\r\n\r\n        - or:\r\n          - description: resolve a module list\r\n          - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList\r\n          - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList\r\n          - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList\r\n\r\n      - and:\r\n        - arch: amd64\r\n        - description: x64\r\n\r\n        - match: PEB access\r\n\r\n        - offset: 0x18 = PEB.LDR_DATA\r\n\r\n        - or:\r\n          - description: resolve a module list\r\n          - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList\r\n          - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList\r\n          - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList\r\n","matches":[[{"type":"absolute","value":4217776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4217776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4217862},{"type":"absolute","value":4217919}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217862},{"type":"absolute","value":4217919}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217868}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217928},{"type":"absolute","value":4217874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4217776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4217877}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217871}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217880},{"type":"absolute","value":4217901}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open file\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Create File [C0016]\r\n    examples:\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\r\n  features:\r\n    - or:\r\n      - api: CreateFile\r\n      - api: CreateFileEx\r\n      - api: IoCreateFile\r\n      - api: IoCreateFileEx\r\n      - api: ZwOpenFile\r\n      - api: ZwCreateFile\r\n      - api: NtOpenFile\r\n      - api: NtCreateFile\r\n      - api: LZCreateFile\r\n      - api: LZOpenFile\r\n      - api: fopen\r\n      - api: fopen64\r\n      - api: fdopen\r\n      - api: freopen\r\n      - api: open\r\n      - api: openat\r\n","matches":[[{"type":"absolute","value":4333998},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4334017}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create thread\r\n    namespace: host-interaction/thread/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Create Thread [C0038]\r\n    examples:\r\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.CreateThread\r\n          - api: _beginthread\r\n          - api: _beginthreadex\r\n          - api: PsCreateSystemThread\r\n          - api: SHCreateThread\r\n          - api: SHCreateThreadWithHandle\r\n          - api: kernel32.CreateRemoteThread\r\n          - api: kernel32.CreateRemoteThreadEx\r\n          - api: RtlCreateUserThread\r\n          - api: ntdll.NtCreateThread\r\n          - api: ntdll.NtCreateThreadEx\r\n          - api: ntdll.ZwCreateThread\r\n          - api: ntdll.ZwCreateThreadEx\r\n      - and:\r\n        - os: linux\r\n        - api: pthread_create\r\n      - and:\r\n        - api: System.Threading.Thread::Start\r\n        - optional:\r\n          - api: System.Threading.Thread::ctor\r\n","matches":[[{"type":"absolute","value":4341699},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[{"type":"absolute","value":4341720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain loop\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    examples:\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - characteristic: loop\r\n      - characteristic: tight loop\r\n      - characteristic: recursive call\r\n","matches":[[{"type":"absolute","value":4200352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4200352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4200896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4201744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4201779}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4201856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4201891}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4202976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4203024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4203104},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4203200}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4203280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4203365}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4204720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4204800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4204896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4205043}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4205440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4205568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4207024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4207104}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4207280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4207280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4208288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4208496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4208544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4210000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4210000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4213760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4213760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4213984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4213984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4218688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4218688}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4218756}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4220384},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4220384}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4220976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4220976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4226132},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4226132}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4226834},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4226834}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4226853},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4226853}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4227444},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227484}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4229112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4229112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4247142},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4247142}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4247740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4247740}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4252787},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4252787}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266237},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4266237}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266313},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4266313}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266515},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4266724}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266654},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4266724}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4278899},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4278899}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4297712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4297374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302275},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302275}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4301404},{"type":"absolute","value":4301310}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305373},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305373}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4304987}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305824}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4330510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4330510}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4343531},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4343576}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4391855},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4391888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4398750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4401716},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4401885}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4412625},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4412625}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4412864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4412864}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4372535}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4412876},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4412876}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436890},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227345}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227345}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436930},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4436930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436950},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4436950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227345}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get common file path\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\r\n      - 972B219F18379907A045431303F4DA7D:0x404887\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetTempPath\r\n      - api: kernel32.GetTempFileName\r\n      - api: kernel32.GetSystemDirectory\r\n      - api: kernel32.GetWindowsDirectory\r\n      - api: kernel32.GetSystemWow64Directory\r\n      - api: GetAllUsersProfileDirectory\r\n      - api: GetAppContainerFolderPath\r\n      - api: GetCurrentDirectory\r\n      - api: GetDefaultUserProfileDirectory\r\n      - api: GetProfilesDirectory\r\n      - api: GetUserProfileDirectory\r\n      - api: SHGetFolderPathAndSubDir\r\n      - api: shell32.SHGetFolderPath\r\n      - api: shell32.SHGetFolderLocation\r\n      - api: shell32.SHGetKnownFolderPath\r\n      - api: shell32.SHGetSpecialFolderPath\r\n      - api: shell32.SHGetSpecialFolderLocation\r\n      - api: System.IO.Directory::GetCurrentDirectory\r\n      - api: System.Environment::GetFolderPath\r\n      - property/read: System.Environment::SystemDirectory\r\n      - property/read: System.Environment::CurrentDirectory\r\n","matches":[[{"type":"absolute","value":4204896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4205001}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open clipboard":{"meta":{"name":"open clipboard","namespace":"host-interaction/clipboard","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Clipboard Data"],"tactic":"Collection","technique":"Clipboard Data","subtechnique":"","id":"T1115"}],"mbc":[],"references":[],"examples":["6f99a2c8944cb02ff28c6f9ced59b161:0x403180"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: open clipboard\r\n    namespace: host-interaction/clipboard\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Collection::Clipboard Data [T1115]\r\n    examples:\r\n      - 6f99a2c8944cb02ff28c6f9ced59b161:0x403180\r\n  features:\r\n    - and:\r\n      - api: user32.OpenClipboard\r\n      - optional:\r\n        - api: user32.CloseClipboard\r\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read clipboard data":{"meta":{"name":"read clipboard data","namespace":"host-interaction/clipboard","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Clipboard Data"],"tactic":"Collection","technique":"Clipboard Data","subtechnique":"","id":"T1115"}],"mbc":[],"references":["https://learn.microsoft.com/en-us/windows/win32/dataxchg/using-the-clipboard"],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x40156F","93dfc146f60bd796eb28d4e4f348f2e4:0x401050"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read clipboard data\r\n    namespace: host-interaction/clipboard\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Collection::Clipboard Data [T1115]\r\n    references:\r\n      - https://learn.microsoft.com/en-us/windows/win32/dataxchg/using-the-clipboard\r\n    examples:\r\n      - C91887D861D9BD4A5872249B641BC9F9:0x40156F\r\n      - 93dfc146f60bd796eb28d4e4f348f2e4:0x401050\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - match: open clipboard\r\n        - match: contain loop\r\n        - api: kernel32.GlobalAlloc\r\n        - api: kernel32.GlobalLock\r\n        - api: kernel32.GlobalUnlock\r\n      - or:\r\n        - basic block:\r\n          - and:\r\n            - api: user32.GetClipboardData\r\n            - optional:\r\n              - number: 0x1 = CF_TEXT\r\n              - number: 0x7 = CF_OEMTEXT\r\n              - number: 0xD = CF_UNICODETEXT\r\n        - call:\r\n          - and:\r\n            - api: user32.GetClipboardData\r\n            - optional:\r\n              - number: 0x1 = CF_TEXT\r\n              - number: 0x7 = CF_OEMTEXT\r\n              - number: 0xD = CF_UNICODETEXT\r\n        - api: System.Windows.Forms.Clipboard::GetAudioStream\r\n        - api: System.Windows.Forms.Clipboard::GetData\r\n        - api: System.Windows.Forms.Clipboard::GetDataObject\r\n        - api: System.Windows.Forms.Clipboard::GetFileDropList\r\n        - api: System.Windows.Forms.Clipboard::GetImage\r\n        - api: System.Windows.Forms.Clipboard::GetText\r\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open clipboard"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalLock"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalUnlock"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetClipboardData"}},"children":[],"locations":[{"type":"absolute","value":4205946}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"CF_TEXT"}},"children":[],"locations":[{"type":"absolute","value":4206010},{"type":"absolute","value":4206114},{"type":"absolute","value":4205894}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":7,"description":"CF_OEMTEXT"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"CF_UNICODETEXT"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read clipboard data/96a568c1bc94457cabd596cc1126c3b4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetAudioStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetData"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetDataObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetFileDropList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetText"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"capture screenshot via keybd event":{"meta":{"name":"capture screenshot via keybd event","namespace":"collection/screenshot","authors":["@_re_fox"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Screen Capture"],"tactic":"Collection","technique":"Screen Capture","subtechnique":"","id":"T1113"}],"mbc":[{"parts":["Collection","Screen Capture"],"objective":"Collection","behavior":"Screen Capture","method":"","id":"E1113"}],"references":[],"examples":["3f3bbcf8fd90bdcdcdc5494314ed4225:0x402D10"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: capture screenshot via keybd event\r\n    namespace: collection/screenshot\r\n    authors:\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Collection::Screen Capture [T1113]\r\n    mbc:\r\n      - Collection::Screen Capture [E1113]\r\n    examples:\r\n      - 3f3bbcf8fd90bdcdcdc5494314ed4225:0x402D10\r\n  features:\r\n    - and:\r\n      - or:\r\n        # static\r\n        - basic block:\r\n          - and:\r\n            - number: 0x2C = VK_SNAPSHOT\r\n            - count(api(user32.keybd_event)): 2\r\n            - or:\r\n              - number: 0x3 = KEYEVENTF_KEYUP|KEYEVENTF_EXTENDEDKEY\r\n              - number: 0x2 = KEYEVENTF_KEYUP\r\n        # dynamic\r\n        - call:\r\n          - and:\r\n            - number: 0x2C = VK_SNAPSHOT\r\n            - count(api(user32.keybd_event)): 2\r\n            - or:\r\n              - number: 0x3 = KEYEVENTF_KEYUP|KEYEVENTF_EXTENDEDKEY\r\n              - number: 0x2 = KEYEVENTF_KEYUP\r\n      - match: read clipboard data\r\n      - match: open clipboard\r\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"read clipboard data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open clipboard"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalLock"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalUnlock"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetClipboardData"}},"children":[],"locations":[{"type":"absolute","value":4205946}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"CF_TEXT"}},"children":[],"locations":[{"type":"absolute","value":4206010},{"type":"absolute","value":4206114},{"type":"absolute","value":4205894}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":7,"description":"CF_OEMTEXT"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"CF_UNICODETEXT"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read clipboard data/96a568c1bc94457cabd596cc1126c3b4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetAudioStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetData"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetDataObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetFileDropList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetText"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open clipboard"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":44,"description":"VK_SNAPSHOT"}},"children":[],"locations":[{"type":"absolute","value":4205914},{"type":"absolute","value":4205924}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":2,"child":{"type":"api","api":"keybd_event"}}},"children":[],"locations":[{"type":"absolute","value":4205916},{"type":"absolute","value":4205926}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"KEYEVENTF_KEYUP|KEYEVENTF_EXTENDEDKEY"}},"children":[],"locations":[{"type":"absolute","value":4205920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"KEYEVENTF_KEYUP"}},"children":[],"locations":[{"type":"absolute","value":4205944}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"capture screenshot via keybd event/52e5603bd5ca47859979223887ae2df1"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write file on Windows":{"meta":{"name":"write file on Windows","namespace":"host-interaction/file-system/write","authors":["william.ballenthin@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Writes File"],"objective":"File System","behavior":"Writes File","method":"","id":"C0052"}],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x4011FC","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: write file on Windows\r\n    namespace: host-interaction/file-system/write\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Writes File [C0052]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\r\n      # ntdll\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - optional:\r\n          - basic block:\r\n            - or:\r\n              - number: 0x40000000 = GENERIC_WRITE\r\n              - number: 0x2 = FILE_WRITE_DATA\r\n              - match: create or open file\r\n          - call:\r\n            - or:\r\n              - number: 0x40000000 = GENERIC_WRITE\r\n              - number: 0x2 = FILE_WRITE_DATA\r\n              - match: create or open file\r\n        - or:\r\n          - api: kernel32.WriteFile\r\n          - api: kernel32.WriteFileEx\r\n          - api: NtWriteFile\r\n          - api: ZwWriteFile\r\n          - api: _fwrite\r\n          - api: fwrite\r\n      - api: System.IO.File::WriteAllBytes\r\n      - api: System.IO.File::WriteAllBytesAsync\r\n      - api: System.IO.File::WriteAllLines\r\n      - api: System.IO.File::WriteAllLinesAsync\r\n      - api: System.IO.File::WriteAllText\r\n      - api: System.IO.File::WriteAllTextAsync\r\n      - api: System.IO.File::AppendAllLines\r\n      - api: System.IO.File::AppendAllLinesAsync\r\n      - api: System.IO.File::AppendAllText\r\n      - api: System.IO.File::AppendAllTextAsync\r\n      - api: System.IO.File::AppendText\r\n      - api: System.IO.FileInfo::AppendText\r\n","matches":[[{"type":"absolute","value":4209488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/5288e393f0714fcebc4149710147c7fc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[{"type":"absolute","value":4209686}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":4209686}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4210832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/5288e393f0714fcebc4149710147c7fc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[{"type":"absolute","value":4211141}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":4211141}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4215952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":4216034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4216034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/2ebd5da86ca1437ba1d1ba9ee6056687"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[{"type":"absolute","value":4216078}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":4216078}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read file on Windows\r\n    namespace: host-interaction/file-system/read\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Read File [C0051]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - optional:\r\n          - and:\r\n            - number: 0x80000000 = GENERIC_READ\r\n            - match: create or open file\r\n        - or:\r\n          - api: kernel32.ReadFile\r\n          - api: ReadFileEx\r\n          - api: NtReadFile\r\n          - api: ZwReadFile\r\n          - api: LZRead\r\n          - api: _read\r\n          - api: fread\r\n      - api: System.IO.File::ReadAllBytes\r\n      - api: System.IO.File::ReadAllBytesAsync\r\n      - api: System.IO.File::ReadAllLines\r\n      - api: System.IO.File::ReadAllLinesAsync\r\n      - api: System.IO.File::ReadAllText\r\n      - api: System.IO.File::ReadAllTextAsync\r\n      - api: System.IO.File::ReadLines\r\n","matches":[[{"type":"absolute","value":4209728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[{"type":"absolute","value":4209953}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4296367},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[{"type":"absolute","value":4296136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: link function at runtime on Windows\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - api: kernel32.GetProcAddress\r\n        - api: ntdll.LdrGetProcedureAddress\r\n      - optional:\r\n        - characteristic: indirect call\r\n        - api: kernel32.LoadLibrary\r\n        - api: kernel32.GetModuleHandle\r\n        - api: kernel32.GetModuleHandleEx\r\n        - api: ntdll.LdrLoadDll\r\n","matches":[[{"type":"absolute","value":4284455},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4284471}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4284494},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4284471}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set environment variable":{"meta":{"name":"set environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Environment Variable","Set Variable"],"objective":"Operating System","behavior":"Environment Variable","method":"Set Variable","id":"C0034.001"}],"references":[],"examples":["0731679c5f99e8ee65d8b29a3cabfc6b:0x43EA81"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set environment variable\r\n    namespace: host-interaction/environment-variable\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Environment Variable::Set Variable [C0034.001]\r\n    examples:\r\n      - 0731679c5f99e8ee65d8b29a3cabfc6b:0x43EA81\r\n  features:\r\n    - or:\r\n      - api: kernel32.SetEnvironmentStrings\r\n      - api: kernel32.SetEnvironmentVariable\r\n      - api: System.Environment::SetEnvironmentVariable\r\n","matches":[[{"type":"absolute","value":4305373},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":4305065}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::SetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get thread local storage value":{"meta":{"name":"get thread local storage value","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get thread local storage value\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n  features:\r\n    - and:\r\n      - api: kernel32.TlsGetValue\r\n","matches":[[{"type":"absolute","value":4342684},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TlsGetValue"}},"children":[],"locations":[{"type":"absolute","value":4342690}],"captures":{}}],"locations":[],"captures":{}}]]},"set thread local storage value":{"meta":{"name":"set thread local storage value","namespace":"host-interaction/thread/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Set Thread Local Storage Value"],"objective":"Process","behavior":"Set Thread Local Storage Value","method":"","id":"C0041"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x18000AE21"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set thread local storage value\r\n    namespace: host-interaction/thread/tls\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Set Thread Local Storage Value [C0041]\r\n    examples:\r\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x18000AE21\r\n  features:\r\n    - and:\r\n      - api: kernel32.TlsSetValue\r\n      - optional:\r\n        - match: allocate thread local storage\r\n","matches":[[{"type":"absolute","value":4342698},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TlsSetValue"}},"children":[],"locations":[{"type":"absolute","value":4342710}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate thread local storage"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"linked against CPP standard library":{"meta":{"name":"linked against CPP standard library","namespace":"linking/static","authors":["@mr-tz"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":["https://en.wikipedia.org/wiki/P._J._Plauger","https://www.dinkumware.com/"],"examples":["03b236b23b1ec37c663527c1f53af3fe"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: linked against CPP standard library\r\n    namespace: linking/static\r\n    authors:\r\n      - \"@mr-tz\"\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    references:\r\n      - https://en.wikipedia.org/wiki/P._J._Plauger\r\n      - https://www.dinkumware.com/\r\n    examples:\r\n      - 03b236b23b1ec37c663527c1f53af3fe\r\n  features:\r\n    - or:\r\n      - string: \"Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\"\r\n      - string: \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\"\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."}},"children":[],"locations":[{"type":"file","value":324128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference analysis tools strings\r\n    namespace: anti-analysis\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    mbc:\r\n      - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /ollydbg(\\.exe)?/i\r\n      - string: /ProcessHacker(\\.exe)?/i\r\n      - string: /tcpview(\\.exe)?/i\r\n      - string: /autoruns(\\.exe)?/i\r\n      - string: /autorunsc(\\.exe)?/i\r\n      - string: /filemon(\\.exe)?/i\r\n      - string: /procmon(\\.exe)?/i\r\n      - string: /regmon(\\.exe)?/i\r\n      - string: /procexp(\\.exe)?/i\r\n      - string: /(?<!\\w)ida[gqtuw]?(\\.exe)?$/i\r\n      - string: /ida[gqtuw]?64(\\.exe)?$/i\r\n      - string: /ImmunityDebugger(\\.exe)?/i\r\n      - string: /Wireshark(\\.exe)?/i\r\n      - string: /dumpcap(\\.exe)?/i\r\n      - string: /HookExplorer(\\.exe)?/i\r\n      - string: /ImportREC(\\.exe)?/i\r\n      - string: /PETools(\\.exe)?/i\r\n      - string: /LordPE(\\.exe)?/i\r\n      - string: /SysInspector(\\.exe)?/i\r\n      - string: /proc_analyzer(\\.exe)?/i\r\n      - string: /sysAnalyzer(\\.exe)?/i\r\n      - string: /sniff_hit(\\.exe)?/i\r\n      - string: /windbg(\\.exe)?/i\r\n      - string: /joeboxcontrol(\\.exe)?/i\r\n      - string: /joeboxserver(\\.exe)?/i\r\n      - string: /ResourceHacker(\\.exe)?/i\r\n      - string: /x32dbg(\\.exe)?/i\r\n      - string: /x64dbg(\\.exe)?/i\r\n      - string: /Fiddler(\\.exe)?/i\r\n      - string: /httpdebugger(\\.exe)?/i\r\n      - string: /fakenet(\\.exe)?/i\r\n      - string: /netmon(\\.exe)?/i\r\n      - string: /WPE PRO(\\.exe)?/i\r\n      - string: /decompile(\\.exe)?/i\r\n      - string: /scylla/i\r\n      - string: /megadumper/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/(?<!\\w)ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":366769}],"captures":{"IDAT":[{"type":"file","value":366769}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?64(\\.exe)?$/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
+{"meta":{"timestamp":"2024-06-10T17:51:22.019740","version":"7.0.1","argv":["./tests/data/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_","--json"],"sample":{"md5":"3f3bbcf8fd90bdcdcdc5494314ed4225","sha1":"ff1c877db4d0b6a37f4ba5d7b4bd4b3b980eddef","sha256":"ebe09a6ef73a572f7a19d2e1eccd8f5d1895ae2730e67a060d008a2703ab3ec2","path":"/Users/fariss/Desktop/capa/tests/data/3f3bbcf8fd90bdcdcdc5494314ed4225.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"i386","os":"windows","extractor":"VivisectFeatureExtractor","rules":["/Users/fariss/Desktop/capa/rules"],"base_address":{"type":"absolute","value":4194304},"layout":{"functions":[{"address":{"type":"absolute","value":4198784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4198864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198864}},{"address":{"type":"absolute","value":4198903}},{"address":{"type":"absolute","value":4198964}},{"address":{"type":"absolute","value":4198994}},{"address":{"type":"absolute","value":4199016}},{"address":{"type":"absolute","value":4199057}},{"address":{"type":"absolute","value":4199070}},{"address":{"type":"absolute","value":4199120}},{"address":{"type":"absolute","value":4199138}}]},{"address":{"type":"absolute","value":4199200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199200}}]},{"address":{"type":"absolute","value":4199392},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199392}}]},{"address":{"type":"absolute","value":4199520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199520}},{"address":{"type":"absolute","value":4199541}}]},{"address":{"type":"absolute","value":4199568},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199568}},{"address":{"type":"absolute","value":4199589}}]},{"address":{"type":"absolute","value":4199616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199616}},{"address":{"type":"absolute","value":4199640}}]},{"address":{"type":"absolute","value":4199680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4199680}}]},{"address":{"type":"absolute","value":4200000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200021}},{"address":{"type":"absolute","value":4200113}}]},{"address":{"type":"absolute","value":4200144},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200161}}]},{"address":{"type":"absolute","value":4200192},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200274}}]},{"address":{"type":"absolute","value":4200352},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200352}},{"address":{"type":"absolute","value":4200557}},{"address":{"type":"absolute","value":4200662}},{"address":{"type":"absolute","value":4200673}},{"address":{"type":"absolute","value":4200684}},{"address":{"type":"absolute","value":4200729}},{"address":{"type":"absolute","value":4200896}}]},{"address":{"type":"absolute","value":4200960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200960}}]},{"address":{"type":"absolute","value":4201456},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201456}}]},{"address":{"type":"absolute","value":4201744},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201744}},{"address":{"type":"absolute","value":4201779}}]},{"address":{"type":"absolute","value":4201856},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201856}},{"address":{"type":"absolute","value":4201891}}]},{"address":{"type":"absolute","value":4201952},"matched_basic_blocks":[{"address":{"type":"absolute","value":4201952}}]},{"address":{"type":"absolute","value":4202016},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202016}}]},{"address":{"type":"absolute","value":4202304},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202304}}]},{"address":{"type":"absolute","value":4202912},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202912}},{"address":{"type":"absolute","value":4202942}}]},{"address":{"type":"absolute","value":4202976},"matched_basic_blocks":[{"address":{"type":"absolute","value":4202976}}]},{"address":{"type":"absolute","value":4203104},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203157}}]},{"address":{"type":"absolute","value":4203280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203372}},{"address":{"type":"absolute","value":4203427}},{"address":{"type":"absolute","value":4203443}}]},{"address":{"type":"absolute","value":4203488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203550}},{"address":{"type":"absolute","value":4203566}}]},{"address":{"type":"absolute","value":4203616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203616}}]},{"address":{"type":"absolute","value":4203696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203696}}]},{"address":{"type":"absolute","value":4203776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203776}}]},{"address":{"type":"absolute","value":4203856},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203856}},{"address":{"type":"absolute","value":4203921}}]},{"address":{"type":"absolute","value":4203984},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203984}}]},{"address":{"type":"absolute","value":4204176},"matched_basic_blocks":[{"address":{"type":"absolute","value":4204176}},{"address":{"type":"absolute","value":4204228}},{"address":{"type":"absolute","value":4204349}},{"address":{"type":"absolute","value":4204550}},{"address":{"type":"absolute","value":4204662}}]},{"address":{"type":"absolute","value":4204720},"matched_basic_blocks":[{"address":{"type":"absolute","value":4204720}},{"address":{"type":"absolute","value":4204835}},{"address":{"type":"absolute","value":4204851}}]},{"address":{"type":"absolute","value":4204896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4204896}},{"address":{"type":"absolute","value":4205105}},{"address":{"type":"absolute","value":4205209}},{"address":{"type":"absolute","value":4205229}},{"address":{"type":"absolute","value":4205239}},{"address":{"type":"absolute","value":4205303}},{"address":{"type":"absolute","value":4205345}},{"address":{"type":"absolute","value":4205372}}]},{"address":{"type":"absolute","value":4205440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4205440}},{"address":{"type":"absolute","value":4205575}},{"address":{"type":"absolute","value":4205592}},{"address":{"type":"absolute","value":4205649}},{"address":{"type":"absolute","value":4205671}},{"address":{"type":"absolute","value":4205721}},{"address":{"type":"absolute","value":4205767}},{"address":{"type":"absolute","value":4205783}}]},{"address":{"type":"absolute","value":4205840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4205840}},{"address":{"type":"absolute","value":4206136}},{"address":{"type":"absolute","value":4206215}},{"address":{"type":"absolute","value":4206283}},{"address":{"type":"absolute","value":4206600}},{"address":{"type":"absolute","value":4206622}},{"address":{"type":"absolute","value":4206681}},{"address":{"type":"absolute","value":4206750}},{"address":{"type":"absolute","value":4206765}},{"address":{"type":"absolute","value":4206781}}]},{"address":{"type":"absolute","value":4206832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4206832}}]},{"address":{"type":"absolute","value":4207024},"matched_basic_blocks":[{"address":{"type":"absolute","value":4207111}},{"address":{"type":"absolute","value":4207160}},{"address":{"type":"absolute","value":4207176}}]},{"address":{"type":"absolute","value":4207280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4207280}},{"address":{"type":"absolute","value":4207549}},{"address":{"type":"absolute","value":4207814}},{"address":{"type":"absolute","value":4207889}},{"address":{"type":"absolute","value":4207898}},{"address":{"type":"absolute","value":4207919}},{"address":{"type":"absolute","value":4207928}},{"address":{"type":"absolute","value":4207953}},{"address":{"type":"absolute","value":4207962}},{"address":{"type":"absolute","value":4208020}},{"address":{"type":"absolute","value":4208048}},{"address":{"type":"absolute","value":4208072}},{"address":{"type":"absolute","value":4208100}},{"address":{"type":"absolute","value":4208111}},{"address":{"type":"absolute","value":4208143}},{"address":{"type":"absolute","value":4208152}},{"address":{"type":"absolute","value":4208203}},{"address":{"type":"absolute","value":4208222}}]},{"address":{"type":"absolute","value":4208496},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208516}},{"address":{"type":"absolute","value":4208550}},{"address":{"type":"absolute","value":4208568}}]},{"address":{"type":"absolute","value":4208608},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208707}},{"address":{"type":"absolute","value":4208746}},{"address":{"type":"absolute","value":4208761}}]},{"address":{"type":"absolute","value":4208896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208931}}]},{"address":{"type":"absolute","value":4208976},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208976}},{"address":{"type":"absolute","value":4209039}}]},{"address":{"type":"absolute","value":4209200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4209200}},{"address":{"type":"absolute","value":4209250}},{"address":{"type":"absolute","value":4209313}},{"address":{"type":"absolute","value":4209331}}]},{"address":{"type":"absolute","value":4209488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4209488}},{"address":{"type":"absolute","value":4209618}},{"address":{"type":"absolute","value":4209681}}]},{"address":{"type":"absolute","value":4209728},"matched_basic_blocks":[{"address":{"type":"absolute","value":4209728}},{"address":{"type":"absolute","value":4209866}},{"address":{"type":"absolute","value":4209936}}]},{"address":{"type":"absolute","value":4210000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4210139}},{"address":{"type":"absolute","value":4210163}},{"address":{"type":"absolute","value":4210268}},{"address":{"type":"absolute","value":4210345}},{"address":{"type":"absolute","value":4210441}},{"address":{"type":"absolute","value":4210459}},{"address":{"type":"absolute","value":4210481}},{"address":{"type":"absolute","value":4210535}}]},{"address":{"type":"absolute","value":4210656},"matched_basic_blocks":[{"address":{"type":"absolute","value":4210739}},{"address":{"type":"absolute","value":4210779}},{"address":{"type":"absolute","value":4210792}}]},{"address":{"type":"absolute","value":4210832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4210832}},{"address":{"type":"absolute","value":4210987}},{"address":{"type":"absolute","value":4211081}},{"address":{"type":"absolute","value":4211134}}]},{"address":{"type":"absolute","value":4211232},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211369}}]},{"address":{"type":"absolute","value":4211600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211600}},{"address":{"type":"absolute","value":4211659}},{"address":{"type":"absolute","value":4211728}},{"address":{"type":"absolute","value":4211737}},{"address":{"type":"absolute","value":4211774}},{"address":{"type":"absolute","value":4211783}}]},{"address":{"type":"absolute","value":4211872},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211999}},{"address":{"type":"absolute","value":4212061}},{"address":{"type":"absolute","value":4212109}},{"address":{"type":"absolute","value":4212118}},{"address":{"type":"absolute","value":4212153}},{"address":{"type":"absolute","value":4212162}}]},{"address":{"type":"absolute","value":4212432},"matched_basic_blocks":[{"address":{"type":"absolute","value":4212432}},{"address":{"type":"absolute","value":4212524}},{"address":{"type":"absolute","value":4212545}},{"address":{"type":"absolute","value":4212592}},{"address":{"type":"absolute","value":4212629}},{"address":{"type":"absolute","value":4212666}},{"address":{"type":"absolute","value":4212737}},{"address":{"type":"absolute","value":4212785}},{"address":{"type":"absolute","value":4212803}}]},{"address":{"type":"absolute","value":4213248},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213409}},{"address":{"type":"absolute","value":4213481}}]},{"address":{"type":"absolute","value":4213443},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213443}}]},{"address":{"type":"absolute","value":4213468},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213468}}]},{"address":{"type":"absolute","value":4213760},"matched_basic_blocks":[{"address":{"type":"absolute","value":4213851}},{"address":{"type":"absolute","value":4213916}},{"address":{"type":"absolute","value":4213931}}]},{"address":{"type":"absolute","value":4213984},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214075}},{"address":{"type":"absolute","value":4214137}},{"address":{"type":"absolute","value":4214157}}]},{"address":{"type":"absolute","value":4214320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4214592},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214592}},{"address":{"type":"absolute","value":4214741}}]},{"address":{"type":"absolute","value":4214784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214784}},{"address":{"type":"absolute","value":4214876}}]},{"address":{"type":"absolute","value":4214912},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214912}},{"address":{"type":"absolute","value":4215004}}]},{"address":{"type":"absolute","value":4215184},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215184}},{"address":{"type":"absolute","value":4215249}}]},{"address":{"type":"absolute","value":4215280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215280}}]},{"address":{"type":"absolute","value":4215952},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215952}},{"address":{"type":"absolute","value":4216034}},{"address":{"type":"absolute","value":4216071}}]},{"address":{"type":"absolute","value":4216144},"matched_basic_blocks":[{"address":{"type":"absolute","value":4216144}},{"address":{"type":"absolute","value":4216272}}]},{"address":{"type":"absolute","value":4216592},"matched_basic_blocks":[{"address":{"type":"absolute","value":4216592}},{"address":{"type":"absolute","value":4216642}},{"address":{"type":"absolute","value":4216661}}]},{"address":{"type":"absolute","value":4216800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4216800}}]},{"address":{"type":"absolute","value":4217424},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217424}},{"address":{"type":"absolute","value":4217520}},{"address":{"type":"absolute","value":4217566}}]},{"address":{"type":"absolute","value":4217632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217694}},{"address":{"type":"absolute","value":4217715}}]},{"address":{"type":"absolute","value":4217776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217776}}]},{"address":{"type":"absolute","value":4217968},"matched_basic_blocks":[{"address":{"type":"absolute","value":4217968}},{"address":{"type":"absolute","value":4218263}}]},{"address":{"type":"absolute","value":4218304},"matched_basic_blocks":[{"address":{"type":"absolute","value":4218304}},{"address":{"type":"absolute","value":4218521}},{"address":{"type":"absolute","value":4218567}}]},{"address":{"type":"absolute","value":4218688},"matched_basic_blocks":[{"address":{"type":"absolute","value":4218854}},{"address":{"type":"absolute","value":4218955}},{"address":{"type":"absolute","value":4219065}},{"address":{"type":"absolute","value":4219194}},{"address":{"type":"absolute","value":4219265}}]},{"address":{"type":"absolute","value":4219227},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219227}}]},{"address":{"type":"absolute","value":4219252},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219252}}]},{"address":{"type":"absolute","value":4219376},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219376}},{"address":{"type":"absolute","value":4219427}},{"address":{"type":"absolute","value":4219449}},{"address":{"type":"absolute","value":4219467}},{"address":{"type":"absolute","value":4219510}},{"address":{"type":"absolute","value":4219525}},{"address":{"type":"absolute","value":4219568}},{"address":{"type":"absolute","value":4219581}},{"address":{"type":"absolute","value":4219599}},{"address":{"type":"absolute","value":4219609}},{"address":{"type":"absolute","value":4219638}}]},{"address":{"type":"absolute","value":4219696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4219696}},{"address":{"type":"absolute","value":4219764}},{"address":{"type":"absolute","value":4219781}},{"address":{"type":"absolute","value":4219788}},{"address":{"type":"absolute","value":4219810}},{"address":{"type":"absolute","value":4219856}},{"address":{"type":"absolute","value":4219874}},{"address":{"type":"absolute","value":4219904}},{"address":{"type":"absolute","value":4219948}},{"address":{"type":"absolute","value":4219966}},{"address":{"type":"absolute","value":4219989}}]},{"address":{"type":"absolute","value":4220048},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220237}},{"address":{"type":"absolute","value":4220283}}]},{"address":{"type":"absolute","value":4220384},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220419}},{"address":{"type":"absolute","value":4220437}},{"address":{"type":"absolute","value":4220447}}]},{"address":{"type":"absolute","value":4220496},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220496}},{"address":{"type":"absolute","value":4220551}},{"address":{"type":"absolute","value":4220568}},{"address":{"type":"absolute","value":4220575}},{"address":{"type":"absolute","value":4220597}},{"address":{"type":"absolute","value":4220643}},{"address":{"type":"absolute","value":4220683}},{"address":{"type":"absolute","value":4220719}},{"address":{"type":"absolute","value":4220737}},{"address":{"type":"absolute","value":4220760}}]},{"address":{"type":"absolute","value":4220816},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220816}}]},{"address":{"type":"absolute","value":4220976},"matched_basic_blocks":[{"address":{"type":"absolute","value":4220976}},{"address":{"type":"absolute","value":4221101}},{"address":{"type":"absolute","value":4221209}},{"address":{"type":"absolute","value":4221502}}]},{"address":{"type":"absolute","value":4221464},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221464}}]},{"address":{"type":"absolute","value":4221489},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221489}}]},{"address":{"type":"absolute","value":4221616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221616}},{"address":{"type":"absolute","value":4221686}},{"address":{"type":"absolute","value":4221695}},{"address":{"type":"absolute","value":4221714}},{"address":{"type":"absolute","value":4221723}},{"address":{"type":"absolute","value":4221738}},{"address":{"type":"absolute","value":4221747}}]},{"address":{"type":"absolute","value":4221784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214784}},{"address":{"type":"absolute","value":4214876}}]},{"address":{"type":"absolute","value":4221792},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214516}}]},{"address":{"type":"absolute","value":4221800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214912}},{"address":{"type":"absolute","value":4215004}}]},{"address":{"type":"absolute","value":4221808},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214592}},{"address":{"type":"absolute","value":4214741}}]},{"address":{"type":"absolute","value":4221816},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214420}}]},{"address":{"type":"absolute","value":4221824},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221906}}]},{"address":{"type":"absolute","value":4221906},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221906}}]},{"address":{"type":"absolute","value":4226132},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226165}}]},{"address":{"type":"absolute","value":4226544},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226567}},{"address":{"type":"absolute","value":4226572}}]},{"address":{"type":"absolute","value":4226556},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226567}},{"address":{"type":"absolute","value":4226572}}]},{"address":{"type":"absolute","value":4226626},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226626}}]},{"address":{"type":"absolute","value":4226834},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226834}},{"address":{"type":"absolute","value":4337648}}]},{"address":{"type":"absolute","value":4226853},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226853}}]},{"address":{"type":"absolute","value":4227175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4226567}},{"address":{"type":"absolute","value":4226572}}]},{"address":{"type":"absolute","value":4227211},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227211}}]},{"address":{"type":"absolute","value":4227365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4229112},"matched_basic_blocks":[{"address":{"type":"absolute","value":4228986}},{"address":{"type":"absolute","value":4229030}},{"address":{"type":"absolute","value":4229063}},{"address":{"type":"absolute","value":4229088}}]},{"address":{"type":"absolute","value":4229121},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229121}}]},{"address":{"type":"absolute","value":4229563},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229508}},{"address":{"type":"absolute","value":4229586}},{"address":{"type":"absolute","value":4229591}},{"address":{"type":"absolute","value":4339665}}]},{"address":{"type":"absolute","value":4229575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229508}},{"address":{"type":"absolute","value":4229586}},{"address":{"type":"absolute","value":4229591}},{"address":{"type":"absolute","value":4339665}}]},{"address":{"type":"absolute","value":4229645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4229645}}]},{"address":{"type":"absolute","value":4230088},"matched_basic_blocks":[{"address":{"type":"absolute","value":4230088}}]},{"address":{"type":"absolute","value":4230128},"matched_basic_blocks":[{"address":{"type":"absolute","value":4230128}}]},{"address":{"type":"absolute","value":4230696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4230696}}]},{"address":{"type":"absolute","value":4236240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4221906}}]},{"address":{"type":"absolute","value":4240433},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241323}},{"address":{"type":"absolute","value":4241334}},{"address":{"type":"absolute","value":4241346}},{"address":{"type":"absolute","value":4241374}},{"address":{"type":"absolute","value":4241420}},{"address":{"type":"absolute","value":4241431}},{"address":{"type":"absolute","value":4241443}},{"address":{"type":"absolute","value":4241471}},{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}},{"address":{"type":"absolute","value":4242005}},{"address":{"type":"absolute","value":4242016}},{"address":{"type":"absolute","value":4242028}},{"address":{"type":"absolute","value":4242056}},{"address":{"type":"absolute","value":4242098}},{"address":{"type":"absolute","value":4242109}},{"address":{"type":"absolute","value":4242121}},{"address":{"type":"absolute","value":4242149}},{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242716}},{"address":{"type":"absolute","value":4242727}},{"address":{"type":"absolute","value":4242739}},{"address":{"type":"absolute","value":4242767}},{"address":{"type":"absolute","value":4242813}},{"address":{"type":"absolute","value":4242824}},{"address":{"type":"absolute","value":4242836}},{"address":{"type":"absolute","value":4242864}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4243415}},{"address":{"type":"absolute","value":4243427}},{"address":{"type":"absolute","value":4243439}},{"address":{"type":"absolute","value":4243467}},{"address":{"type":"absolute","value":4243513}},{"address":{"type":"absolute","value":4243524}},{"address":{"type":"absolute","value":4243536}},{"address":{"type":"absolute","value":4243564}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4241315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241323}},{"address":{"type":"absolute","value":4241334}},{"address":{"type":"absolute","value":4241346}},{"address":{"type":"absolute","value":4241374}},{"address":{"type":"absolute","value":4241420}},{"address":{"type":"absolute","value":4241431}},{"address":{"type":"absolute","value":4241443}},{"address":{"type":"absolute","value":4241471}},{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241412},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241420}},{"address":{"type":"absolute","value":4241431}},{"address":{"type":"absolute","value":4241443}},{"address":{"type":"absolute","value":4241471}},{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241509},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241517}},{"address":{"type":"absolute","value":4241528}},{"address":{"type":"absolute","value":4241540}},{"address":{"type":"absolute","value":4241568}},{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241606},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241614}},{"address":{"type":"absolute","value":4241625}},{"address":{"type":"absolute","value":4241637}},{"address":{"type":"absolute","value":4241665}},{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241703},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241711}},{"address":{"type":"absolute","value":4241723}},{"address":{"type":"absolute","value":4241735}},{"address":{"type":"absolute","value":4241763}},{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241801},"matched_basic_blocks":[{"address":{"type":"absolute","value":4241809}},{"address":{"type":"absolute","value":4241820}},{"address":{"type":"absolute","value":4241832}},{"address":{"type":"absolute","value":4241860}},{"address":{"type":"absolute","value":4241902}},{"address":{"type":"absolute","value":4241913}},{"address":{"type":"absolute","value":4241925}},{"address":{"type":"absolute","value":4241953}}]},{"address":{"type":"absolute","value":4241997},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242005}},{"address":{"type":"absolute","value":4242016}},{"address":{"type":"absolute","value":4242028}},{"address":{"type":"absolute","value":4242056}},{"address":{"type":"absolute","value":4242098}},{"address":{"type":"absolute","value":4242109}},{"address":{"type":"absolute","value":4242121}},{"address":{"type":"absolute","value":4242149}},{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242098}},{"address":{"type":"absolute","value":4242109}},{"address":{"type":"absolute","value":4242121}},{"address":{"type":"absolute","value":4242149}},{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242187},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242195}},{"address":{"type":"absolute","value":4242206}},{"address":{"type":"absolute","value":4242218}},{"address":{"type":"absolute","value":4242246}},{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242284},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242292}},{"address":{"type":"absolute","value":4242303}},{"address":{"type":"absolute","value":4242315}},{"address":{"type":"absolute","value":4242343}},{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242381},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242389}},{"address":{"type":"absolute","value":4242400}},{"address":{"type":"absolute","value":4242412}},{"address":{"type":"absolute","value":4242440}},{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242478},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242486}},{"address":{"type":"absolute","value":4242498}},{"address":{"type":"absolute","value":4242510}},{"address":{"type":"absolute","value":4242538}},{"address":{"type":"absolute","value":4242584}},{"address":{"type":"absolute","value":4242595}},{"address":{"type":"absolute","value":4242607}},{"address":{"type":"absolute","value":4242635}},{"address":{"type":"absolute","value":4242673}}]},{"address":{"type":"absolute","value":4242708},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242716}},{"address":{"type":"absolute","value":4242727}},{"address":{"type":"absolute","value":4242739}},{"address":{"type":"absolute","value":4242767}},{"address":{"type":"absolute","value":4242813}},{"address":{"type":"absolute","value":4242824}},{"address":{"type":"absolute","value":4242836}},{"address":{"type":"absolute","value":4242864}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4242805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242813}},{"address":{"type":"absolute","value":4242824}},{"address":{"type":"absolute","value":4242836}},{"address":{"type":"absolute","value":4242864}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4242902},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4242910}},{"address":{"type":"absolute","value":4242921}},{"address":{"type":"absolute","value":4242933}},{"address":{"type":"absolute","value":4242961}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4242999},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243007}},{"address":{"type":"absolute","value":4243018}},{"address":{"type":"absolute","value":4243030}},{"address":{"type":"absolute","value":4243058}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243096},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243104}},{"address":{"type":"absolute","value":4243115}},{"address":{"type":"absolute","value":4243127}},{"address":{"type":"absolute","value":4243155}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243193},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243201}},{"address":{"type":"absolute","value":4243213}},{"address":{"type":"absolute","value":4243225}},{"address":{"type":"absolute","value":4243253}},{"address":{"type":"absolute","value":4243299}},{"address":{"type":"absolute","value":4243310}},{"address":{"type":"absolute","value":4243322}},{"address":{"type":"absolute","value":4243350}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243407},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243415}},{"address":{"type":"absolute","value":4243427}},{"address":{"type":"absolute","value":4243439}},{"address":{"type":"absolute","value":4243467}},{"address":{"type":"absolute","value":4243513}},{"address":{"type":"absolute","value":4243524}},{"address":{"type":"absolute","value":4243536}},{"address":{"type":"absolute","value":4243564}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243513}},{"address":{"type":"absolute","value":4243524}},{"address":{"type":"absolute","value":4243536}},{"address":{"type":"absolute","value":4243564}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243602},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243610}},{"address":{"type":"absolute","value":4243621}},{"address":{"type":"absolute","value":4243633}},{"address":{"type":"absolute","value":4243661}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243699},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243707}},{"address":{"type":"absolute","value":4243718}},{"address":{"type":"absolute","value":4243730}},{"address":{"type":"absolute","value":4243758}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243796},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243804}},{"address":{"type":"absolute","value":4243816}},{"address":{"type":"absolute","value":4243828}},{"address":{"type":"absolute","value":4243856}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4243894},"matched_basic_blocks":[{"address":{"type":"absolute","value":4242673}},{"address":{"type":"absolute","value":4243902}},{"address":{"type":"absolute","value":4243913}},{"address":{"type":"absolute","value":4243925}},{"address":{"type":"absolute","value":4243953}},{"address":{"type":"absolute","value":4243999}},{"address":{"type":"absolute","value":4244010}},{"address":{"type":"absolute","value":4244022}},{"address":{"type":"absolute","value":4244050}},{"address":{"type":"absolute","value":4244088}},{"address":{"type":"absolute","value":4244100}}]},{"address":{"type":"absolute","value":4244309},"matched_basic_blocks":[{"address":{"type":"absolute","value":4244309}}]},{"address":{"type":"absolute","value":4247142},"matched_basic_blocks":[{"address":{"type":"absolute","value":4247142}},{"address":{"type":"absolute","value":4247253}}]},{"address":{"type":"absolute","value":4247600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4247695}},{"address":{"type":"absolute","value":4247772}}]},{"address":{"type":"absolute","value":4247740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4247695}},{"address":{"type":"absolute","value":4247772}}]},{"address":{"type":"absolute","value":4250305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250356}}]},{"address":{"type":"absolute","value":4250384},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250356}}]},{"address":{"type":"absolute","value":4250444},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250444}}]},{"address":{"type":"absolute","value":4250783},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250869}}]},{"address":{"type":"absolute","value":4250869},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250869}}]},{"address":{"type":"absolute","value":4251022},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251022}}]},{"address":{"type":"absolute","value":4251046},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251049}}]},{"address":{"type":"absolute","value":4251049},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251049}}]},{"address":{"type":"absolute","value":4251572},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251572}},{"address":{"type":"absolute","value":4251637}},{"address":{"type":"absolute","value":4251766}},{"address":{"type":"absolute","value":4251786}},{"address":{"type":"absolute","value":4251821}},{"address":{"type":"absolute","value":4251863}},{"address":{"type":"absolute","value":4251881}},{"address":{"type":"absolute","value":4251928}},{"address":{"type":"absolute","value":4251951}},{"address":{"type":"absolute","value":4251964}}]},{"address":{"type":"absolute","value":4252787},"matched_basic_blocks":[{"address":{"type":"absolute","value":4251572}},{"address":{"type":"absolute","value":4251637}},{"address":{"type":"absolute","value":4251766}},{"address":{"type":"absolute","value":4251786}},{"address":{"type":"absolute","value":4251821}},{"address":{"type":"absolute","value":4251863}},{"address":{"type":"absolute","value":4251881}},{"address":{"type":"absolute","value":4251928}},{"address":{"type":"absolute","value":4251951}},{"address":{"type":"absolute","value":4251964}}]},{"address":{"type":"absolute","value":4253354},"matched_basic_blocks":[{"address":{"type":"absolute","value":4253279}}]},{"address":{"type":"absolute","value":4253365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4253461}}]},{"address":{"type":"absolute","value":4259929},"matched_basic_blocks":[{"address":{"type":"absolute","value":4259929}}]},{"address":{"type":"absolute","value":4259949},"matched_basic_blocks":[{"address":{"type":"absolute","value":4259949}}]},{"address":{"type":"absolute","value":4261130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4260877}}]},{"address":{"type":"absolute","value":4266197},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266302}}]},{"address":{"type":"absolute","value":4266237},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266302}}]},{"address":{"type":"absolute","value":4266313},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266302}}]},{"address":{"type":"absolute","value":4266485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266555}},{"address":{"type":"absolute","value":4266585}},{"address":{"type":"absolute","value":4266614}},{"address":{"type":"absolute","value":4266654}},{"address":{"type":"absolute","value":4266735}}]},{"address":{"type":"absolute","value":4266515},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266555}},{"address":{"type":"absolute","value":4266585}},{"address":{"type":"absolute","value":4266614}},{"address":{"type":"absolute","value":4266654}},{"address":{"type":"absolute","value":4266735}}]},{"address":{"type":"absolute","value":4266654},"matched_basic_blocks":[{"address":{"type":"absolute","value":4266654}},{"address":{"type":"absolute","value":4266735}}]},{"address":{"type":"absolute","value":4272637},"matched_basic_blocks":[{"address":{"type":"absolute","value":4272637}}]},{"address":{"type":"absolute","value":4272709},"matched_basic_blocks":[{"address":{"type":"absolute","value":4272709}}]},{"address":{"type":"absolute","value":4276119},"matched_basic_blocks":[{"address":{"type":"absolute","value":4278946}},{"address":{"type":"absolute","value":4278994}},{"address":{"type":"absolute","value":4279013}},{"address":{"type":"absolute","value":4279041}},{"address":{"type":"absolute","value":4279074}}]},{"address":{"type":"absolute","value":4278899},"matched_basic_blocks":[{"address":{"type":"absolute","value":4278899}},{"address":{"type":"absolute","value":4278946}},{"address":{"type":"absolute","value":4278994}},{"address":{"type":"absolute","value":4279013}},{"address":{"type":"absolute","value":4279041}},{"address":{"type":"absolute","value":4279074}}]},{"address":{"type":"absolute","value":4284349},"matched_basic_blocks":[{"address":{"type":"absolute","value":4284349}}]},{"address":{"type":"absolute","value":4290246},"matched_basic_blocks":[{"address":{"type":"absolute","value":4289811}},{"address":{"type":"absolute","value":4289887}},{"address":{"type":"absolute","value":4289904}},{"address":{"type":"absolute","value":4290018}}]},{"address":{"type":"absolute","value":4291637},"matched_basic_blocks":[{"address":{"type":"absolute","value":4291261}},{"address":{"type":"absolute","value":4291305}},{"address":{"type":"absolute","value":4291335}}]},{"address":{"type":"absolute","value":4293588},"matched_basic_blocks":[{"address":{"type":"absolute","value":4293740}}]},{"address":{"type":"absolute","value":4296367},"matched_basic_blocks":[{"address":{"type":"absolute","value":4296069}},{"address":{"type":"absolute","value":4296083}},{"address":{"type":"absolute","value":4296111}},{"address":{"type":"absolute","value":4296205}},{"address":{"type":"absolute","value":4296258}},{"address":{"type":"absolute","value":4296333}}]},{"address":{"type":"absolute","value":4297712},"matched_basic_blocks":[{"address":{"type":"absolute","value":4297284}},{"address":{"type":"absolute","value":4297380}}]},{"address":{"type":"absolute","value":4300559},"matched_basic_blocks":[{"address":{"type":"absolute","value":4300559}}]},{"address":{"type":"absolute","value":4300568},"matched_basic_blocks":[{"address":{"type":"absolute","value":4300893}},{"address":{"type":"absolute","value":4300918}}]},{"address":{"type":"absolute","value":4300768},"matched_basic_blocks":[{"address":{"type":"absolute","value":4300893}},{"address":{"type":"absolute","value":4300918}}]},{"address":{"type":"absolute","value":4302087},"matched_basic_blocks":[{"address":{"type":"absolute","value":4302120}}]},{"address":{"type":"absolute","value":4302275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4301202}},{"address":{"type":"absolute","value":4301222}},{"address":{"type":"absolute","value":4301247}},{"address":{"type":"absolute","value":4301262}},{"address":{"type":"absolute","value":4301317}},{"address":{"type":"absolute","value":4301346}},{"address":{"type":"absolute","value":4301411}},{"address":{"type":"absolute","value":4301445}}]},{"address":{"type":"absolute","value":4305373},"matched_basic_blocks":[{"address":{"type":"absolute","value":4304710}},{"address":{"type":"absolute","value":4304751}},{"address":{"type":"absolute","value":4304859}},{"address":{"type":"absolute","value":4304896}},{"address":{"type":"absolute","value":4304924}},{"address":{"type":"absolute","value":4304994}},{"address":{"type":"absolute","value":4305018}},{"address":{"type":"absolute","value":4305037}}]},{"address":{"type":"absolute","value":4305824},"matched_basic_blocks":[{"address":{"type":"absolute","value":4305705}},{"address":{"type":"absolute","value":4305718}},{"address":{"type":"absolute","value":4305740}}]},{"address":{"type":"absolute","value":4306162},"matched_basic_blocks":[{"address":{"type":"absolute","value":4306162}}]},{"address":{"type":"absolute","value":4306345},"matched_basic_blocks":[{"address":{"type":"absolute","value":4306345}}]},{"address":{"type":"absolute","value":4323799},"matched_basic_blocks":[{"address":{"type":"absolute","value":4323805}},{"address":{"type":"absolute","value":4323826}}]},{"address":{"type":"absolute","value":4327092},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327158}},{"address":{"type":"absolute","value":4327175}}]},{"address":{"type":"absolute","value":4328671},"matched_basic_blocks":[{"address":{"type":"absolute","value":4328671}}]},{"address":{"type":"absolute","value":4330510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4330414}}]},{"address":{"type":"absolute","value":4333998},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333998}}]},{"address":{"type":"absolute","value":4337648},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337648}}]},{"address":{"type":"absolute","value":4339665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339665}}]},{"address":{"type":"absolute","value":4341699},"matched_basic_blocks":[{"address":{"type":"absolute","value":4341699}}]},{"address":{"type":"absolute","value":4342566},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342566}}]},{"address":{"type":"absolute","value":4342589},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342589}}]},{"address":{"type":"absolute","value":4342778},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342778}}]},{"address":{"type":"absolute","value":4346025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346207}}]},{"address":{"type":"absolute","value":4361594},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361594}}]},{"address":{"type":"absolute","value":4364549},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369296}}]},{"address":{"type":"absolute","value":4369163},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369296}}]},{"address":{"type":"absolute","value":4375835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375835}}]},{"address":{"type":"absolute","value":4377354},"matched_basic_blocks":[{"address":{"type":"absolute","value":4377364}}]},{"address":{"type":"absolute","value":4391855},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391888}}]},{"address":{"type":"absolute","value":4393121},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393130}}]},{"address":{"type":"absolute","value":4401716},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401951}}]},{"address":{"type":"absolute","value":4402695},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402695}}]},{"address":{"type":"absolute","value":4412502},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361594}},{"address":{"type":"absolute","value":4412502}}]},{"address":{"type":"absolute","value":4412625},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412625}}]},{"address":{"type":"absolute","value":4412835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412835}}]},{"address":{"type":"absolute","value":4412856},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412835}}]},{"address":{"type":"absolute","value":4412864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412864}}]},{"address":{"type":"absolute","value":4412876},"matched_basic_blocks":[{"address":{"type":"absolute","value":4373365}},{"address":{"type":"absolute","value":4373430}},{"address":{"type":"absolute","value":4373496}},{"address":{"type":"absolute","value":4373583}},{"address":{"type":"absolute","value":4412876}}]},{"address":{"type":"absolute","value":4413649},"matched_basic_blocks":[{"address":{"type":"absolute","value":4413649}}]},{"address":{"type":"absolute","value":4413743},"matched_basic_blocks":[{"address":{"type":"absolute","value":4413743}}]},{"address":{"type":"absolute","value":4425184},"matched_basic_blocks":[{"address":{"type":"absolute","value":4425225}},{"address":{"type":"absolute","value":4425255}}]},{"address":{"type":"absolute","value":4426376},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426376}}]},{"address":{"type":"absolute","value":4426762},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426762}}]},{"address":{"type":"absolute","value":4429982},"matched_basic_blocks":[{"address":{"type":"absolute","value":4429982}},{"address":{"type":"absolute","value":4430054}},{"address":{"type":"absolute","value":4430218}},{"address":{"type":"absolute","value":4430243}},{"address":{"type":"absolute","value":4430436}},{"address":{"type":"absolute","value":4430482}},{"address":{"type":"absolute","value":4430622}}]},{"address":{"type":"absolute","value":4430791},"matched_basic_blocks":[{"address":{"type":"absolute","value":4430791}}]},{"address":{"type":"absolute","value":4431190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431190}}]},{"address":{"type":"absolute","value":4431241},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431241}}]},{"address":{"type":"absolute","value":4431312},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4431386},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431424},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431456},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431496},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431504},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431552},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203984}}]},{"address":{"type":"absolute","value":4431691},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431702},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431784},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431824},"matched_basic_blocks":[{"address":{"type":"absolute","value":4208393}},{"address":{"type":"absolute","value":4208406}},{"address":{"type":"absolute","value":4208424}}]},{"address":{"type":"absolute","value":4431832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4200274}}]},{"address":{"type":"absolute","value":4431840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4431885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4206832}}]},{"address":{"type":"absolute","value":4431896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431936},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4431944},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4431984},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432032},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4432040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432112},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4432151},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432208},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432328},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432368},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432368}}]},{"address":{"type":"absolute","value":4432379},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432416},"matched_basic_blocks":[{"address":{"type":"absolute","value":4214320}}]},{"address":{"type":"absolute","value":4432444},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432488},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432528},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4432648},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432648}}]},{"address":{"type":"absolute","value":4432671},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432768},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4432776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432776}}]},{"address":{"type":"absolute","value":4432799},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432891},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432918},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432945},"matched_basic_blocks":[{"address":{"type":"absolute","value":4198806}},{"address":{"type":"absolute","value":4198824}}]},{"address":{"type":"absolute","value":4432953},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4432990},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4432998},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227380}}]},{"address":{"type":"absolute","value":4433033},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433138},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433183},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433218},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433266},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433312},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433404},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433444},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433561},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433628},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433760},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433857},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4433892},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434049},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434076},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434103},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434146},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434189},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434241},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434284},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434327},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434354},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434397},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434558},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434621},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434648},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375835}}]},{"address":{"type":"absolute","value":4434656},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434731},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434769},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434796},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434839},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434866},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375835}}]},{"address":{"type":"absolute","value":4434874},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434917},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434952},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4434989},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435024},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435051},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435180},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435362},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435362}}]},{"address":{"type":"absolute","value":4435373},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435413},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435440}}]},{"address":{"type":"absolute","value":4435451},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435451}}]},{"address":{"type":"absolute","value":4435462},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435497},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435532},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435584},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435689},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435857},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435884},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435884}}]},{"address":{"type":"absolute","value":4435895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4435975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436010},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436053},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436096},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436139},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436166},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436201},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436236},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436282},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436317},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436344},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436379},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436406},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436446},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436473},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436500},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4235834}}]},{"address":{"type":"absolute","value":4436640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4250444}},{"address":{"type":"absolute","value":4436665}},{"address":{"type":"absolute","value":4436683}}]},{"address":{"type":"absolute","value":4436736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436746}},{"address":{"type":"absolute","value":4436807}},{"address":{"type":"absolute","value":4436825}}]},{"address":{"type":"absolute","value":4436880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4203984}}]},{"address":{"type":"absolute","value":4436890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227345}}]},{"address":{"type":"absolute","value":4436900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4215280}}]},{"address":{"type":"absolute","value":4436910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4211369}}]},{"address":{"type":"absolute","value":4436920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227345}}]},{"address":{"type":"absolute","value":4436960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4227345}}]}]},"feature_counts":{"file":5683,"functions":[{"address":{"type":"absolute","value":4198432},"count":12},{"address":{"type":"absolute","value":4198448},"count":16},{"address":{"type":"absolute","value":4198473},"count":14},{"address":{"type":"absolute","value":4198495},"count":18},{"address":{"type":"absolute","value":4198584},"count":17},{"address":{"type":"absolute","value":4198594},"count":14},{"address":{"type":"absolute","value":4198616},"count":12},{"address":{"type":"absolute","value":4198628},"count":12},{"address":{"type":"absolute","value":4198640},"count":12},{"address":{"type":"absolute","value":4198652},"count":14},{"address":{"type":"absolute","value":4198674},"count":14},{"address":{"type":"absolute","value":4198704},"count":12},{"address":{"type":"absolute","value":4198716},"count":12},{"address":{"type":"absolute","value":4198753},"count":9},{"address":{"type":"absolute","value":4198768},"count":7},{"address":{"type":"absolute","value":4198864},"count":79},{"address":{"type":"absolute","value":4199184},"count":9},{"address":{"type":"absolute","value":4199200},"count":36},{"address":{"type":"absolute","value":4199392},"count":24},{"address":{"type":"absolute","value":4199456},"count":25},{"address":{"type":"absolute","value":4199520},"count":18},{"address":{"type":"absolute","value":4199568},"count":18},{"address":{"type":"absolute","value":4199616},"count":16},{"address":{"type":"absolute","value":4199664},"count":16},{"address":{"type":"absolute","value":4199680},"count":40},{"address":{"type":"absolute","value":4199777},"count":14},{"address":{"type":"absolute","value":4199796},"count":19},{"address":{"type":"absolute","value":4199872},"count":14},{"address":{"type":"absolute","value":4199904},"count":21},{"address":{"type":"absolute","value":4200000},"count":42},{"address":{"type":"absolute","value":4200144},"count":21},{"address":{"type":"absolute","value":4200192},"count":53},{"address":{"type":"absolute","value":4200352},"count":109},{"address":{"type":"absolute","value":4200960},"count":37},{"address":{"type":"absolute","value":4201456},"count":29},{"address":{"type":"absolute","value":4201744},"count":35},{"address":{"type":"absolute","value":4201856},"count":35},{"address":{"type":"absolute","value":4201952},"count":16},{"address":{"type":"absolute","value":4202016},"count":16},{"address":{"type":"absolute","value":4202304},"count":39},{"address":{"type":"absolute","value":4202912},"count":33},{"address":{"type":"absolute","value":4202960},"count":7},{"address":{"type":"absolute","value":4202976},"count":38},{"address":{"type":"absolute","value":4203088},"count":7},{"address":{"type":"absolute","value":4203104},"count":45},{"address":{"type":"absolute","value":4203280},"count":65},{"address":{"type":"absolute","value":4203488},"count":58},{"address":{"type":"absolute","value":4203616},"count":37},{"address":{"type":"absolute","value":4203696},"count":37},{"address":{"type":"absolute","value":4203776},"count":36},{"address":{"type":"absolute","value":4203856},"count":36},{"address":{"type":"absolute","value":4204176},"count":82},{"address":{"type":"absolute","value":4204720},"count":58},{"address":{"type":"absolute","value":4204896},"count":88},{"address":{"type":"absolute","value":4205440},"count":80},{"address":{"type":"absolute","value":4205840},"count":150},{"address":{"type":"absolute","value":4206832},"count":72},{"address":{"type":"absolute","value":4207024},"count":57},{"address":{"type":"absolute","value":4207280},"count":167},{"address":{"type":"absolute","value":4208496},"count":36},{"address":{"type":"absolute","value":4208608},"count":64},{"address":{"type":"absolute","value":4208896},"count":33},{"address":{"type":"absolute","value":4208976},"count":79},{"address":{"type":"absolute","value":4209200},"count":83},{"address":{"type":"absolute","value":4209488},"count":66},{"address":{"type":"absolute","value":4209728},"count":65},{"address":{"type":"absolute","value":4210000},"count":118},{"address":{"type":"absolute","value":4210656},"count":66},{"address":{"type":"absolute","value":4210832},"count":94},{"address":{"type":"absolute","value":4211200},"count":14},{"address":{"type":"absolute","value":4211216},"count":14},{"address":{"type":"absolute","value":4211408},"count":59},{"address":{"type":"absolute","value":4211600},"count":78},{"address":{"type":"absolute","value":4211872},"count":82},{"address":{"type":"absolute","value":4212432},"count":94},{"address":{"type":"absolute","value":4213248},"count":66},{"address":{"type":"absolute","value":4213443},"count":20},{"address":{"type":"absolute","value":4213468},"count":46},{"address":{"type":"absolute","value":4213616},"count":7},{"address":{"type":"absolute","value":4213632},"count":7},{"address":{"type":"absolute","value":4213760},"count":62},{"address":{"type":"absolute","value":4213984},"count":59},{"address":{"type":"absolute","value":4214256},"count":8},{"address":{"type":"absolute","value":4214304},"count":6},{"address":{"type":"absolute","value":4214320},"count":28},{"address":{"type":"absolute","value":4214592},"count":66},{"address":{"type":"absolute","value":4215184},"count":36},{"address":{"type":"absolute","value":4215488},"count":8},{"address":{"type":"absolute","value":4215504},"count":32},{"address":{"type":"absolute","value":4215616},"count":45},{"address":{"type":"absolute","value":4215808},"count":65},{"address":{"type":"absolute","value":4215952},"count":61},{"address":{"type":"absolute","value":4216144},"count":91},{"address":{"type":"absolute","value":4216592},"count":59},{"address":{"type":"absolute","value":4216800},"count":61},{"address":{"type":"absolute","value":4217216},"count":20},{"address":{"type":"absolute","value":4217248},"count":28},{"address":{"type":"absolute","value":4217344},"count":30},{"address":{"type":"absolute","value":4217424},"count":59},{"address":{"type":"absolute","value":4217632},"count":52},{"address":{"type":"absolute","value":4217755},"count":7},{"address":{"type":"absolute","value":4217776},"count":83},{"address":{"type":"absolute","value":4217968},"count":96},{"address":{"type":"absolute","value":4218304},"count":82},{"address":{"type":"absolute","value":4218688},"count":103},{"address":{"type":"absolute","value":4219227},"count":20},{"address":{"type":"absolute","value":4219252},"count":44},{"address":{"type":"absolute","value":4219376},"count":72},{"address":{"type":"absolute","value":4219696},"count":77},{"address":{"type":"absolute","value":4220048},"count":73},{"address":{"type":"absolute","value":4220384},"count":56},{"address":{"type":"absolute","value":4220496},"count":84},{"address":{"type":"absolute","value":4220816},"count":29},{"address":{"type":"absolute","value":4220896},"count":9},{"address":{"type":"absolute","value":4220912},"count":21},{"address":{"type":"absolute","value":4220944},"count":21},{"address":{"type":"absolute","value":4220976},"count":95},{"address":{"type":"absolute","value":4221464},"count":20},{"address":{"type":"absolute","value":4221489},"count":44},{"address":{"type":"absolute","value":4221616},"count":48},{"address":{"type":"absolute","value":4221784},"count":53},{"address":{"type":"absolute","value":4221792},"count":31},{"address":{"type":"absolute","value":4221800},"count":53},{"address":{"type":"absolute","value":4221808},"count":69},{"address":{"type":"absolute","value":4221816},"count":30},{"address":{"type":"absolute","value":4221906},"count":37},{"address":{"type":"absolute","value":4222396},"count":11},{"address":{"type":"absolute","value":4222410},"count":32},{"address":{"type":"absolute","value":4222415},"count":32},{"address":{"type":"absolute","value":4222420},"count":11},{"address":{"type":"absolute","value":4222936},"count":18},{"address":{"type":"absolute","value":4223006},"count":19},{"address":{"type":"absolute","value":4223194},"count":12},{"address":{"type":"absolute","value":4223206},"count":12},{"address":{"type":"absolute","value":4223273},"count":17},{"address":{"type":"absolute","value":4223309},"count":15},{"address":{"type":"absolute","value":4223597},"count":26},{"address":{"type":"absolute","value":4223784},"count":14},{"address":{"type":"absolute","value":4223803},"count":14},{"address":{"type":"absolute","value":4223989},"count":24},{"address":{"type":"absolute","value":4224203},"count":11},{"address":{"type":"absolute","value":4224510},"count":14},{"address":{"type":"absolute","value":4224530},"count":29},{"address":{"type":"absolute","value":4224611},"count":18},{"address":{"type":"absolute","value":4224638},"count":20},{"address":{"type":"absolute","value":4224662},"count":18},{"address":{"type":"absolute","value":4224689},"count":20},{"address":{"type":"absolute","value":4225219},"count":11},{"address":{"type":"absolute","value":4225231},"count":38},{"address":{"type":"absolute","value":4225296},"count":9},{"address":{"type":"absolute","value":4225810},"count":7},{"address":{"type":"absolute","value":4225961},"count":9},{"address":{"type":"absolute","value":4226029},"count":7},{"address":{"type":"absolute","value":4226076},"count":7},{"address":{"type":"absolute","value":4226082},"count":7},{"address":{"type":"absolute","value":4226132},"count":27},{"address":{"type":"absolute","value":4226176},"count":18},{"address":{"type":"absolute","value":4226203},"count":19},{"address":{"type":"absolute","value":4226234},"count":18},{"address":{"type":"absolute","value":4226261},"count":19},{"address":{"type":"absolute","value":4226292},"count":18},{"address":{"type":"absolute","value":4226319},"count":17},{"address":{"type":"absolute","value":4226544},"count":50},{"address":{"type":"absolute","value":4226556},"count":47},{"address":{"type":"absolute","value":4226626},"count":31},{"address":{"type":"absolute","value":4226834},"count":48},{"address":{"type":"absolute","value":4226842},"count":16},{"address":{"type":"absolute","value":4226853},"count":48},{"address":{"type":"absolute","value":4226861},"count":16},{"address":{"type":"absolute","value":4227175},"count":50},{"address":{"type":"absolute","value":4227211},"count":16},{"address":{"type":"absolute","value":4227396},"count":10},{"address":{"type":"absolute","value":4227408},"count":10},{"address":{"type":"absolute","value":4227444},"count":42},{"address":{"type":"absolute","value":4228101},"count":7},{"address":{"type":"absolute","value":4228647},"count":21},{"address":{"type":"absolute","value":4229112},"count":55},{"address":{"type":"absolute","value":4229121},"count":17},{"address":{"type":"absolute","value":4229563},"count":66},{"address":{"type":"absolute","value":4229575},"count":63},{"address":{"type":"absolute","value":4229645},"count":12},{"address":{"type":"absolute","value":4229653},"count":15},{"address":{"type":"absolute","value":4229672},"count":15},{"address":{"type":"absolute","value":4229683},"count":16},{"address":{"type":"absolute","value":4230088},"count":44},{"address":{"type":"absolute","value":4230128},"count":38},{"address":{"type":"absolute","value":4230184},"count":15},{"address":{"type":"absolute","value":4230195},"count":16},{"address":{"type":"absolute","value":4230696},"count":24},{"address":{"type":"absolute","value":4232765},"count":17},{"address":{"type":"absolute","value":4233434},"count":12},{"address":{"type":"absolute","value":4233471},"count":12},{"address":{"type":"absolute","value":4233485},"count":12},{"address":{"type":"absolute","value":4234263},"count":20},{"address":{"type":"absolute","value":4235207},"count":40},{"address":{"type":"absolute","value":4235984},"count":8},{"address":{"type":"absolute","value":4236039},"count":7},{"address":{"type":"absolute","value":4241315},"count":77},{"address":{"type":"absolute","value":4241412},"count":69},{"address":{"type":"absolute","value":4241509},"count":61},{"address":{"type":"absolute","value":4241606},"count":53},{"address":{"type":"absolute","value":4241703},"count":45},{"address":{"type":"absolute","value":4241801},"count":37},{"address":{"type":"absolute","value":4241997},"count":79},{"address":{"type":"absolute","value":4242090},"count":71},{"address":{"type":"absolute","value":4242187},"count":63},{"address":{"type":"absolute","value":4242284},"count":55},{"address":{"type":"absolute","value":4242381},"count":47},{"address":{"type":"absolute","value":4242478},"count":39},{"address":{"type":"absolute","value":4242708},"count":81},{"address":{"type":"absolute","value":4242805},"count":73},{"address":{"type":"absolute","value":4242902},"count":65},{"address":{"type":"absolute","value":4242999},"count":57},{"address":{"type":"absolute","value":4243096},"count":49},{"address":{"type":"absolute","value":4243193},"count":41},{"address":{"type":"absolute","value":4243407},"count":83},{"address":{"type":"absolute","value":4243505},"count":75},{"address":{"type":"absolute","value":4243602},"count":67},{"address":{"type":"absolute","value":4243699},"count":59},{"address":{"type":"absolute","value":4243796},"count":51},{"address":{"type":"absolute","value":4243894},"count":43},{"address":{"type":"absolute","value":4244309},"count":21},{"address":{"type":"absolute","value":4245044},"count":7},{"address":{"type":"absolute","value":4245048},"count":8},{"address":{"type":"absolute","value":4245217},"count":7},{"address":{"type":"absolute","value":4245221},"count":7},{"address":{"type":"absolute","value":4246941},"count":18},{"address":{"type":"absolute","value":4246968},"count":20},{"address":{"type":"absolute","value":4247132},"count":10},{"address":{"type":"absolute","value":4247142},"count":49},{"address":{"type":"absolute","value":4247314},"count":51},{"address":{"type":"absolute","value":4247320},"count":52},{"address":{"type":"absolute","value":4247730},"count":11},{"address":{"type":"absolute","value":4247740},"count":48},{"address":{"type":"absolute","value":4247803},"count":21},{"address":{"type":"absolute","value":4247806},"count":21},{"address":{"type":"absolute","value":4248567},"count":7},{"address":{"type":"absolute","value":4250285},"count":12},{"address":{"type":"absolute","value":4250384},"count":28},{"address":{"type":"absolute","value":4250869},"count":44},{"address":{"type":"absolute","value":4251022},"count":15},{"address":{"type":"absolute","value":4251038},"count":7},{"address":{"type":"absolute","value":4251046},"count":13},{"address":{"type":"absolute","value":4251049},"count":13},{"address":{"type":"absolute","value":4251556},"count":10},{"address":{"type":"absolute","value":4251562},"count":10},{"address":{"type":"absolute","value":4252776},"count":39},{"address":{"type":"absolute","value":4252787},"count":107},{"address":{"type":"absolute","value":4253085},"count":10},{"address":{"type":"absolute","value":4253091},"count":10},{"address":{"type":"absolute","value":4253328},"count":13},{"address":{"type":"absolute","value":4253331},"count":13},{"address":{"type":"absolute","value":4253354},"count":49},{"address":{"type":"absolute","value":4253365},"count":40},{"address":{"type":"absolute","value":4254462},"count":10},{"address":{"type":"absolute","value":4254468},"count":10},{"address":{"type":"absolute","value":4254507},"count":12},{"address":{"type":"absolute","value":4254510},"count":12},{"address":{"type":"absolute","value":4254594},"count":10},{"address":{"type":"absolute","value":4254600},"count":10},{"address":{"type":"absolute","value":4255045},"count":10},{"address":{"type":"absolute","value":4255048},"count":10},{"address":{"type":"absolute","value":4255309},"count":10},{"address":{"type":"absolute","value":4255312},"count":10},{"address":{"type":"absolute","value":4259202},"count":10},{"address":{"type":"absolute","value":4259205},"count":10},{"address":{"type":"absolute","value":4259255},"count":7},{"address":{"type":"absolute","value":4259259},"count":9},{"address":{"type":"absolute","value":4259929},"count":18},{"address":{"type":"absolute","value":4259949},"count":18},{"address":{"type":"absolute","value":4260109},"count":26},{"address":{"type":"absolute","value":4260175},"count":12},{"address":{"type":"absolute","value":4260178},"count":13},{"address":{"type":"absolute","value":4260190},"count":15},{"address":{"type":"absolute","value":4260950},"count":12},{"address":{"type":"absolute","value":4260953},"count":12},{"address":{"type":"absolute","value":4261130},"count":29},{"address":{"type":"absolute","value":4261232},"count":26},{"address":{"type":"absolute","value":4261298},"count":12},{"address":{"type":"absolute","value":4261301},"count":13},{"address":{"type":"absolute","value":4261313},"count":15},{"address":{"type":"absolute","value":4262558},"count":32},{"address":{"type":"absolute","value":4262900},"count":10},{"address":{"type":"absolute","value":4262906},"count":10},{"address":{"type":"absolute","value":4263797},"count":10},{"address":{"type":"absolute","value":4263803},"count":10},{"address":{"type":"absolute","value":4263951},"count":12},{"address":{"type":"absolute","value":4264109},"count":12},{"address":{"type":"absolute","value":4264112},"count":12},{"address":{"type":"absolute","value":4265836},"count":15},{"address":{"type":"absolute","value":4265863},"count":15},{"address":{"type":"absolute","value":4265890},"count":20},{"address":{"type":"absolute","value":4265955},"count":26},{"address":{"type":"absolute","value":4266021},"count":12},{"address":{"type":"absolute","value":4266024},"count":13},{"address":{"type":"absolute","value":4266036},"count":26},{"address":{"type":"absolute","value":4266102},"count":12},{"address":{"type":"absolute","value":4266105},"count":13},{"address":{"type":"absolute","value":4266117},"count":15},{"address":{"type":"absolute","value":4266157},"count":15},{"address":{"type":"absolute","value":4266237},"count":47},{"address":{"type":"absolute","value":4266313},"count":45},{"address":{"type":"absolute","value":4266410},"count":29},{"address":{"type":"absolute","value":4266515},"count":69},{"address":{"type":"absolute","value":4266654},"count":54},{"address":{"type":"absolute","value":4266806},"count":13},{"address":{"type":"absolute","value":4266882},"count":24},{"address":{"type":"absolute","value":4266954},"count":14},{"address":{"type":"absolute","value":4267231},"count":7},{"address":{"type":"absolute","value":4267277},"count":12},{"address":{"type":"absolute","value":4267635},"count":24},{"address":{"type":"absolute","value":4267949},"count":25},{"address":{"type":"absolute","value":4267993},"count":14},{"address":{"type":"absolute","value":4268008},"count":28},{"address":{"type":"absolute","value":4268063},"count":13},{"address":{"type":"absolute","value":4268075},"count":15},{"address":{"type":"absolute","value":4268563},"count":12},{"address":{"type":"absolute","value":4268647},"count":12},{"address":{"type":"absolute","value":4272418},"count":7},{"address":{"type":"absolute","value":4272637},"count":17},{"address":{"type":"absolute","value":4272709},"count":17},{"address":{"type":"absolute","value":4272732},"count":12},{"address":{"type":"absolute","value":4273428},"count":12},{"address":{"type":"absolute","value":4273431},"count":12},{"address":{"type":"absolute","value":4275390},"count":14},{"address":{"type":"absolute","value":4278899},"count":70},{"address":{"type":"absolute","value":4281618},"count":31},{"address":{"type":"absolute","value":4282030},"count":31},{"address":{"type":"absolute","value":4282098},"count":13},{"address":{"type":"absolute","value":4282110},"count":39},{"address":{"type":"absolute","value":4282195},"count":13},{"address":{"type":"absolute","value":4282207},"count":30},{"address":{"type":"absolute","value":4282270},"count":13},{"address":{"type":"absolute","value":4282282},"count":31},{"address":{"type":"absolute","value":4282342},"count":13},{"address":{"type":"absolute","value":4282354},"count":15},{"address":{"type":"absolute","value":4282394},"count":15},{"address":{"type":"absolute","value":4282434},"count":15},{"address":{"type":"absolute","value":4282474},"count":15},{"address":{"type":"absolute","value":4283247},"count":23},{"address":{"type":"absolute","value":4283292},"count":23},{"address":{"type":"absolute","value":4284051},"count":12},{"address":{"type":"absolute","value":4284054},"count":12},{"address":{"type":"absolute","value":4284177},"count":40},{"address":{"type":"absolute","value":4284294},"count":12},{"address":{"type":"absolute","value":4284297},"count":13},{"address":{"type":"absolute","value":4284309},"count":15},{"address":{"type":"absolute","value":4284349},"count":16},{"address":{"type":"absolute","value":4284455},"count":28},{"address":{"type":"absolute","value":4284494},"count":29},{"address":{"type":"absolute","value":4284502},"count":22},{"address":{"type":"absolute","value":4284732},"count":26},{"address":{"type":"absolute","value":4286609},"count":10},{"address":{"type":"absolute","value":4287055},"count":10},{"address":{"type":"absolute","value":4287064},"count":10},{"address":{"type":"absolute","value":4288773},"count":10},{"address":{"type":"absolute","value":4288779},"count":10},{"address":{"type":"absolute","value":4290246},"count":74},{"address":{"type":"absolute","value":4290433},"count":12},{"address":{"type":"absolute","value":4290436},"count":12},{"address":{"type":"absolute","value":4291637},"count":50},{"address":{"type":"absolute","value":4291861},"count":56},{"address":{"type":"absolute","value":4291998},"count":12},{"address":{"type":"absolute","value":4292001},"count":13},{"address":{"type":"absolute","value":4292013},"count":15},{"address":{"type":"absolute","value":4293588},"count":67},{"address":{"type":"absolute","value":4293776},"count":10},{"address":{"type":"absolute","value":4293782},"count":10},{"address":{"type":"absolute","value":4294652},"count":53},{"address":{"type":"absolute","value":4294767},"count":12},{"address":{"type":"absolute","value":4294770},"count":13},{"address":{"type":"absolute","value":4294782},"count":15},{"address":{"type":"absolute","value":4294822},"count":53},{"address":{"type":"absolute","value":4296367},"count":95},{"address":{"type":"absolute","value":4296632},"count":12},{"address":{"type":"absolute","value":4296939},"count":7},{"address":{"type":"absolute","value":4296945},"count":7},{"address":{"type":"absolute","value":4296951},"count":7},{"address":{"type":"absolute","value":4296957},"count":7},{"address":{"type":"absolute","value":4296963},"count":24},{"address":{"type":"absolute","value":4297007},"count":24},{"address":{"type":"absolute","value":4297051},"count":24},{"address":{"type":"absolute","value":4297712},"count":101},{"address":{"type":"absolute","value":4299658},"count":12},{"address":{"type":"absolute","value":4299729},"count":12},{"address":{"type":"absolute","value":4299732},"count":12},{"address":{"type":"absolute","value":4300241},"count":30},{"address":{"type":"absolute","value":4300316},"count":12},{"address":{"type":"absolute","value":4300319},"count":13},{"address":{"type":"absolute","value":4300331},"count":15},{"address":{"type":"absolute","value":4300559},"count":16},{"address":{"type":"absolute","value":4300768},"count":70},{"address":{"type":"absolute","value":4300927},"count":50},{"address":{"type":"absolute","value":4301001},"count":22},{"address":{"type":"absolute","value":4301016},"count":20},{"address":{"type":"absolute","value":4302087},"count":27},{"address":{"type":"absolute","value":4302275},"count":78},{"address":{"type":"absolute","value":4302286},"count":28},{"address":{"type":"absolute","value":4302341},"count":13},{"address":{"type":"absolute","value":4302353},"count":15},{"address":{"type":"absolute","value":4303700},"count":12},{"address":{"type":"absolute","value":4303703},"count":12},{"address":{"type":"absolute","value":4305373},"count":89},{"address":{"type":"absolute","value":4305401},"count":11},{"address":{"type":"absolute","value":4305824},"count":48},{"address":{"type":"absolute","value":4306150},"count":12},{"address":{"type":"absolute","value":4306153},"count":12},{"address":{"type":"absolute","value":4306162},"count":26},{"address":{"type":"absolute","value":4306345},"count":26},{"address":{"type":"absolute","value":4306642},"count":12},{"address":{"type":"absolute","value":4306645},"count":12},{"address":{"type":"absolute","value":4311059},"count":12},{"address":{"type":"absolute","value":4311062},"count":12},{"address":{"type":"absolute","value":4319057},"count":17},{"address":{"type":"absolute","value":4320310},"count":13},{"address":{"type":"absolute","value":4323505},"count":11},{"address":{"type":"absolute","value":4323799},"count":55},{"address":{"type":"absolute","value":4323983},"count":15},{"address":{"type":"absolute","value":4324325},"count":18},{"address":{"type":"absolute","value":4324348},"count":14},{"address":{"type":"absolute","value":4324440},"count":14},{"address":{"type":"absolute","value":4327092},"count":59},{"address":{"type":"absolute","value":4327246},"count":36},{"address":{"type":"absolute","value":4327252},"count":37},{"address":{"type":"absolute","value":4328671},"count":15},{"address":{"type":"absolute","value":4330510},"count":44},{"address":{"type":"absolute","value":4333998},"count":20},{"address":{"type":"absolute","value":4334029},"count":17},{"address":{"type":"absolute","value":4335597},"count":28},{"address":{"type":"absolute","value":4339697},"count":18},{"address":{"type":"absolute","value":4339766},"count":10},{"address":{"type":"absolute","value":4339774},"count":24},{"address":{"type":"absolute","value":4340409},"count":10},{"address":{"type":"absolute","value":4340735},"count":10},{"address":{"type":"absolute","value":4340743},"count":9},{"address":{"type":"absolute","value":4340860},"count":7},{"address":{"type":"absolute","value":4341255},"count":22},{"address":{"type":"absolute","value":4341584},"count":12},{"address":{"type":"absolute","value":4341607},"count":12},{"address":{"type":"absolute","value":4341699},"count":16},{"address":{"type":"absolute","value":4341807},"count":14},{"address":{"type":"absolute","value":4342312},"count":12},{"address":{"type":"absolute","value":4342326},"count":17},{"address":{"type":"absolute","value":4342500},"count":28},{"address":{"type":"absolute","value":4342566},"count":13},{"address":{"type":"absolute","value":4342589},"count":13},{"address":{"type":"absolute","value":4342603},"count":7},{"address":{"type":"absolute","value":4342670},"count":12},{"address":{"type":"absolute","value":4342684},"count":12},{"address":{"type":"absolute","value":4342698},"count":28},{"address":{"type":"absolute","value":4342764},"count":12},{"address":{"type":"absolute","value":4342778},"count":15},{"address":{"type":"absolute","value":4342849},"count":30},{"address":{"type":"absolute","value":4343531},"count":32},{"address":{"type":"absolute","value":4343596},"count":17},{"address":{"type":"absolute","value":4343607},"count":11},{"address":{"type":"absolute","value":4343616},"count":14},{"address":{"type":"absolute","value":4344014},"count":18},{"address":{"type":"absolute","value":4344041},"count":19},{"address":{"type":"absolute","value":4344058},"count":18},{"address":{"type":"absolute","value":4344309},"count":23},{"address":{"type":"absolute","value":4346022},"count":7},{"address":{"type":"absolute","value":4346025},"count":38},{"address":{"type":"absolute","value":4351283},"count":9},{"address":{"type":"absolute","value":4351287},"count":25},{"address":{"type":"absolute","value":4351865},"count":26},{"address":{"type":"absolute","value":4351870},"count":26},{"address":{"type":"absolute","value":4351875},"count":26},{"address":{"type":"absolute","value":4351880},"count":9},{"address":{"type":"absolute","value":4360206},"count":32},{"address":{"type":"absolute","value":4360262},"count":32},{"address":{"type":"absolute","value":4361210},"count":18},{"address":{"type":"absolute","value":4361237},"count":18},{"address":{"type":"absolute","value":4361779},"count":23},{"address":{"type":"absolute","value":4362106},"count":24},{"address":{"type":"absolute","value":4362141},"count":24},{"address":{"type":"absolute","value":4362176},"count":22},{"address":{"type":"absolute","value":4362211},"count":22},{"address":{"type":"absolute","value":4362379},"count":24},{"address":{"type":"absolute","value":4362914},"count":29},{"address":{"type":"absolute","value":4363746},"count":34},{"address":{"type":"absolute","value":4363758},"count":34},{"address":{"type":"absolute","value":4364549},"count":67},{"address":{"type":"absolute","value":4364993},"count":10},{"address":{"type":"absolute","value":4365359},"count":23},{"address":{"type":"absolute","value":4366872},"count":21},{"address":{"type":"absolute","value":4366923},"count":9},{"address":{"type":"absolute","value":4367212},"count":9},{"address":{"type":"absolute","value":4367839},"count":9},{"address":{"type":"absolute","value":4369059},"count":36},{"address":{"type":"absolute","value":4372270},"count":28},{"address":{"type":"absolute","value":4374900},"count":7},{"address":{"type":"absolute","value":4375126},"count":19},{"address":{"type":"absolute","value":4375143},"count":19},{"address":{"type":"absolute","value":4375160},"count":18},{"address":{"type":"absolute","value":4375187},"count":19},{"address":{"type":"absolute","value":4375204},"count":19},{"address":{"type":"absolute","value":4375221},"count":19},{"address":{"type":"absolute","value":4375238},"count":18},{"address":{"type":"absolute","value":4375265},"count":19},{"address":{"type":"absolute","value":4375282},"count":18},{"address":{"type":"absolute","value":4375309},"count":19},{"address":{"type":"absolute","value":4375326},"count":19},{"address":{"type":"absolute","value":4375343},"count":25},{"address":{"type":"absolute","value":4375372},"count":25},{"address":{"type":"absolute","value":4375401},"count":19},{"address":{"type":"absolute","value":4375835},"count":29},{"address":{"type":"absolute","value":4375979},"count":22},{"address":{"type":"absolute","value":4376538},"count":29},{"address":{"type":"absolute","value":4376981},"count":31},{"address":{"type":"absolute","value":4376993},"count":35},{"address":{"type":"absolute","value":4377354},"count":26},{"address":{"type":"absolute","value":4377655},"count":16},{"address":{"type":"absolute","value":4377663},"count":16},{"address":{"type":"absolute","value":4377680},"count":23},{"address":{"type":"absolute","value":4377685},"count":23},{"address":{"type":"absolute","value":4377899},"count":8},{"address":{"type":"absolute","value":4377903},"count":9},{"address":{"type":"absolute","value":4378998},"count":29},{"address":{"type":"absolute","value":4379072},"count":10},{"address":{"type":"absolute","value":4379087},"count":21},{"address":{"type":"absolute","value":4379118},"count":11},{"address":{"type":"absolute","value":4379863},"count":18},{"address":{"type":"absolute","value":4379890},"count":19},{"address":{"type":"absolute","value":4380132},"count":18},{"address":{"type":"absolute","value":4380551},"count":22},{"address":{"type":"absolute","value":4380605},"count":28},{"address":{"type":"absolute","value":4380717},"count":24},{"address":{"type":"absolute","value":4382803},"count":11},{"address":{"type":"absolute","value":4383174},"count":9},{"address":{"type":"absolute","value":4384065},"count":18},{"address":{"type":"absolute","value":4384092},"count":18},{"address":{"type":"absolute","value":4384119},"count":18},{"address":{"type":"absolute","value":4384581},"count":19},{"address":{"type":"absolute","value":4385180},"count":8},{"address":{"type":"absolute","value":4385184},"count":8},{"address":{"type":"absolute","value":4391794},"count":14},{"address":{"type":"absolute","value":4391828},"count":14},{"address":{"type":"absolute","value":4391855},"count":34},{"address":{"type":"absolute","value":4392288},"count":22},{"address":{"type":"absolute","value":4392416},"count":8},{"address":{"type":"absolute","value":4393121},"count":21},{"address":{"type":"absolute","value":4394714},"count":31},{"address":{"type":"absolute","value":4396036},"count":42},{"address":{"type":"absolute","value":4398750},"count":51},{"address":{"type":"absolute","value":4399438},"count":18},{"address":{"type":"absolute","value":4399465},"count":18},{"address":{"type":"absolute","value":4399492},"count":18},{"address":{"type":"absolute","value":4399519},"count":18},{"address":{"type":"absolute","value":4399622},"count":23},{"address":{"type":"absolute","value":4399676},"count":24},{"address":{"type":"absolute","value":4401625},"count":9},{"address":{"type":"absolute","value":4401629},"count":13},{"address":{"type":"absolute","value":4401716},"count":80},{"address":{"type":"absolute","value":4402695},"count":37},{"address":{"type":"absolute","value":4405241},"count":31},{"address":{"type":"absolute","value":4407563},"count":31},{"address":{"type":"absolute","value":4412502},"count":87},{"address":{"type":"absolute","value":4412522},"count":33},{"address":{"type":"absolute","value":4412530},"count":23},{"address":{"type":"absolute","value":4412625},"count":64},{"address":{"type":"absolute","value":4412806},"count":10},{"address":{"type":"absolute","value":4412856},"count":22},{"address":{"type":"absolute","value":4412864},"count":64},{"address":{"type":"absolute","value":4412876},"count":96},{"address":{"type":"absolute","value":4412954},"count":13},{"address":{"type":"absolute","value":4413649},"count":27},{"address":{"type":"absolute","value":4413743},"count":27},{"address":{"type":"absolute","value":4414144},"count":13},{"address":{"type":"absolute","value":4414150},"count":13},{"address":{"type":"absolute","value":4414986},"count":39},{"address":{"type":"absolute","value":4415262},"count":8},{"address":{"type":"absolute","value":4415266},"count":8},{"address":{"type":"absolute","value":4417172},"count":17},{"address":{"type":"absolute","value":4417347},"count":8},{"address":{"type":"absolute","value":4417351},"count":12},{"address":{"type":"absolute","value":4423380},"count":7},{"address":{"type":"absolute","value":4424201},"count":14},{"address":{"type":"absolute","value":4424220},"count":13},{"address":{"type":"absolute","value":4425129},"count":19},{"address":{"type":"absolute","value":4425184},"count":50},{"address":{"type":"absolute","value":4425519},"count":12},{"address":{"type":"absolute","value":4425525},"count":12},{"address":{"type":"absolute","value":4425545},"count":7},{"address":{"type":"absolute","value":4425664},"count":9},{"address":{"type":"absolute","value":4426376},"count":17},{"address":{"type":"absolute","value":4426762},"count":75},{"address":{"type":"absolute","value":4428322},"count":18},{"address":{"type":"absolute","value":4428349},"count":18},{"address":{"type":"absolute","value":4429308},"count":20},{"address":{"type":"absolute","value":4429336},"count":21},{"address":{"type":"absolute","value":4429531},"count":14},{"address":{"type":"absolute","value":4429982},"count":133},{"address":{"type":"absolute","value":4430791},"count":20},{"address":{"type":"absolute","value":4431190},"count":21},{"address":{"type":"absolute","value":4431241},"count":25},{"address":{"type":"absolute","value":4431424},"count":31},{"address":{"type":"absolute","value":4431456},"count":31},{"address":{"type":"absolute","value":4431488},"count":50},{"address":{"type":"absolute","value":4431552},"count":50},{"address":{"type":"absolute","value":4431560},"count":31},{"address":{"type":"absolute","value":4431600},"count":31},{"address":{"type":"absolute","value":4431632},"count":50},{"address":{"type":"absolute","value":4431640},"count":31},{"address":{"type":"absolute","value":4431680},"count":73},{"address":{"type":"absolute","value":4431691},"count":50},{"address":{"type":"absolute","value":4431702},"count":55},{"address":{"type":"absolute","value":4431736},"count":33},{"address":{"type":"absolute","value":4431776},"count":50},{"address":{"type":"absolute","value":4431784},"count":33},{"address":{"type":"absolute","value":4431824},"count":45},{"address":{"type":"absolute","value":4431832},"count":53},{"address":{"type":"absolute","value":4431840},"count":37},{"address":{"type":"absolute","value":4431885},"count":72},{"address":{"type":"absolute","value":4431896},"count":33},{"address":{"type":"absolute","value":4431984},"count":33},{"address":{"type":"absolute","value":4432032},"count":50},{"address":{"type":"absolute","value":4432080},"count":31},{"address":{"type":"absolute","value":4432192},"count":30},{"address":{"type":"absolute","value":4432200},"count":32},{"address":{"type":"absolute","value":4432208},"count":31},{"address":{"type":"absolute","value":4432240},"count":31},{"address":{"type":"absolute","value":4432272},"count":30},{"address":{"type":"absolute","value":4432280},"count":31},{"address":{"type":"absolute","value":4432368},"count":25},{"address":{"type":"absolute","value":4432379},"count":31},{"address":{"type":"absolute","value":4432480},"count":32},{"address":{"type":"absolute","value":4432528},"count":31},{"address":{"type":"absolute","value":4432560},"count":31},{"address":{"type":"absolute","value":4432592},"count":32},{"address":{"type":"absolute","value":4432600},"count":31},{"address":{"type":"absolute","value":4432640},"count":28},{"address":{"type":"absolute","value":4432648},"count":13},{"address":{"type":"absolute","value":4432663},"count":18},{"address":{"type":"absolute","value":4432671},"count":33},{"address":{"type":"absolute","value":4432720},"count":30},{"address":{"type":"absolute","value":4432728},"count":32},{"address":{"type":"absolute","value":4432768},"count":28},{"address":{"type":"absolute","value":4432776},"count":13},{"address":{"type":"absolute","value":4432791},"count":18},{"address":{"type":"absolute","value":4432799},"count":33},{"address":{"type":"absolute","value":4432848},"count":30},{"address":{"type":"absolute","value":4432856},"count":32},{"address":{"type":"absolute","value":4432891},"count":31},{"address":{"type":"absolute","value":4432918},"count":31},{"address":{"type":"absolute","value":4433025},"count":28},{"address":{"type":"absolute","value":4433033},"count":31},{"address":{"type":"absolute","value":4433060},"count":31},{"address":{"type":"absolute","value":4433087},"count":24},{"address":{"type":"absolute","value":4433095},"count":31},{"address":{"type":"absolute","value":4433175},"count":24},{"address":{"type":"absolute","value":4433183},"count":31},{"address":{"type":"absolute","value":4433655},"count":31},{"address":{"type":"absolute","value":4433682},"count":23},{"address":{"type":"absolute","value":4433690},"count":31},{"address":{"type":"absolute","value":4433787},"count":23},{"address":{"type":"absolute","value":4433795},"count":31},{"address":{"type":"absolute","value":4433822},"count":23},{"address":{"type":"absolute","value":4433830},"count":31},{"address":{"type":"absolute","value":4433857},"count":31},{"address":{"type":"absolute","value":4434076},"count":31},{"address":{"type":"absolute","value":4434103},"count":31},{"address":{"type":"absolute","value":4434268},"count":14},{"address":{"type":"absolute","value":4434276},"count":16},{"address":{"type":"absolute","value":4434284},"count":31},{"address":{"type":"absolute","value":4434354},"count":31},{"address":{"type":"absolute","value":4434648},"count":29},{"address":{"type":"absolute","value":4434656},"count":31},{"address":{"type":"absolute","value":4434683},"count":11},{"address":{"type":"absolute","value":4434696},"count":31},{"address":{"type":"absolute","value":4434723},"count":23},{"address":{"type":"absolute","value":4434731},"count":31},{"address":{"type":"absolute","value":4434796},"count":31},{"address":{"type":"absolute","value":4434866},"count":29},{"address":{"type":"absolute","value":4434874},"count":31},{"address":{"type":"absolute","value":4434989},"count":31},{"address":{"type":"absolute","value":4435132},"count":23},{"address":{"type":"absolute","value":4435140},"count":31},{"address":{"type":"absolute","value":4435167},"count":11},{"address":{"type":"absolute","value":4435180},"count":31},{"address":{"type":"absolute","value":4435207},"count":23},{"address":{"type":"absolute","value":4435215},"count":31},{"address":{"type":"absolute","value":4435282},"count":23},{"address":{"type":"absolute","value":4435290},"count":31},{"address":{"type":"absolute","value":4435317},"count":23},{"address":{"type":"absolute","value":4435325},"count":33},{"address":{"type":"absolute","value":4435362},"count":17},{"address":{"type":"absolute","value":4435373},"count":31},{"address":{"type":"absolute","value":4435440},"count":19},{"address":{"type":"absolute","value":4435451},"count":20},{"address":{"type":"absolute","value":4435462},"count":31},{"address":{"type":"absolute","value":4435611},"count":17},{"address":{"type":"absolute","value":4435640},"count":31},{"address":{"type":"absolute","value":4435767},"count":12},{"address":{"type":"absolute","value":4435775},"count":31},{"address":{"type":"absolute","value":4435884},"count":18},{"address":{"type":"absolute","value":4435895},"count":31},{"address":{"type":"absolute","value":4435962},"count":11},{"address":{"type":"absolute","value":4435975},"count":31},{"address":{"type":"absolute","value":4436166},"count":31},{"address":{"type":"absolute","value":4436193},"count":22},{"address":{"type":"absolute","value":4436201},"count":31},{"address":{"type":"absolute","value":4436228},"count":22},{"address":{"type":"absolute","value":4436236},"count":31},{"address":{"type":"absolute","value":4436309},"count":23},{"address":{"type":"absolute","value":4436317},"count":31},{"address":{"type":"absolute","value":4436344},"count":31},{"address":{"type":"absolute","value":4436371},"count":44},{"address":{"type":"absolute","value":4436379},"count":31},{"address":{"type":"absolute","value":4436406},"count":31},{"address":{"type":"absolute","value":4436433},"count":11},{"address":{"type":"absolute","value":4436446},"count":31},{"address":{"type":"absolute","value":4436473},"count":31},{"address":{"type":"absolute","value":4436500},"count":31},{"address":{"type":"absolute","value":4436527},"count":25},{"address":{"type":"absolute","value":4436576},"count":16},{"address":{"type":"absolute","value":4436640},"count":45},{"address":{"type":"absolute","value":4436736},"count":47},{"address":{"type":"absolute","value":4436880},"count":73},{"address":{"type":"absolute","value":4436890},"count":25},{"address":{"type":"absolute","value":4436900},"count":45},{"address":{"type":"absolute","value":4436910},"count":70},{"address":{"type":"absolute","value":4436920},"count":25},{"address":{"type":"absolute","value":4436930},"count":19},{"address":{"type":"absolute","value":4436940},"count":32},{"address":{"type":"absolute","value":4436950},"count":36},{"address":{"type":"absolute","value":4436960},"count":25},{"address":{"type":"absolute","value":4436970},"count":36},{"address":{"type":"absolute","value":4436992},"count":10},{"address":{"type":"absolute","value":4437004},"count":19}]},"library_functions":[{"address":{"type":"absolute","value":4198400},"name":"??__EDEFAULT_CHANNEL@CryptoPP@@YAXXZ"},{"address":{"type":"absolute","value":4198526},"name":"??__Efout@std@@YAXXZ"},{"address":{"type":"absolute","value":4198728},"name":"??__Eg_DebugOutFilePtr@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4198742},"name":"??__E?s_cookie@Security@details@Concurrency@@2KA@@YAXXZ"},{"address":{"type":"absolute","value":4198784},"name":"?"},{"address":{"type":"absolute","value":4199280},"name":"??0exception@std@@QAE@ABV01@@Z"},{"address":{"type":"absolute","value":4199328},"name":"?what@exception@std@@UBEPBDXZ"},{"address":{"type":"absolute","value":4199344},"name":"?"},{"address":{"type":"absolute","value":4199424},"name":"?"},{"address":{"type":"absolute","value":4199504},"name":"?"},{"address":{"type":"absolute","value":4199856},"name":"?"},{"address":{"type":"absolute","value":4199952},"name":"??_H@YGXPAXIIP6EPAX0@Z@Z"},{"address":{"type":"absolute","value":4201056},"name":"??0_Locinfo@std@@QAE@PBD@Z"},{"address":{"type":"absolute","value":4201248},"name":"??0exception_ptr@std@@QAE@XZ"},{"address":{"type":"absolute","value":4201520},"name":"??_G_Facet_base@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4201568},"name":"?"},{"address":{"type":"absolute","value":4201584},"name":"?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ"},{"address":{"type":"absolute","value":4201616},"name":"??1locale@std@@QAE@XZ"},{"address":{"type":"absolute","value":4201696},"name":"?"},{"address":{"type":"absolute","value":4201712},"name":"?do_tolower@?$ctype@D@std@@MBEDD@Z"},{"address":{"type":"absolute","value":4201824},"name":"?do_toupper@?$ctype@D@std@@MBEDD@Z"},{"address":{"type":"absolute","value":4201936},"name":"?do_widen@?$ctype@D@std@@MBEDD@Z"},{"address":{"type":"absolute","value":4202000},"name":"?do_narrow@?$ctype@D@std@@MBEDDD@Z"},{"address":{"type":"absolute","value":4202064},"name":"??_G?$ctype@D@std@@MAEPAXI@Z"},{"address":{"type":"absolute","value":4202160},"name":"?default_error_condition@error_category@std@@UBE?AVerror_condition@2@H@Z"},{"address":{"type":"absolute","value":4202192},"name":"?equivalent@error_category@std@@UBE_NHABVerror_condition@2@@Z"},{"address":{"type":"absolute","value":4202256},"name":"?equivalent@error_category@std@@UBE_NABVerror_code@2@H@Z"},{"address":{"type":"absolute","value":4202368},"name":"?DecodeBody@Inflator@CryptoPP@@AAE_NXZ"},{"address":{"type":"absolute","value":4203056},"name":"??_G_Iostream_error_category2@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4203232},"name":"?"},{"address":{"type":"absolute","value":4203952},"name":"??$_Fputc@D@std@@YA_NDPAU_iobuf@@@Z"},{"address":{"type":"absolute","value":4203984},"name":"??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4208816},"name":"?imbue@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z"},{"address":{"type":"absolute","value":4208848},"name":"?sync@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4210592},"name":"?underflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4211232},"name":"??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ"},{"address":{"type":"absolute","value":4212240},"name":"?underflow@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4212336},"name":"?pbackfail@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAEHH@Z"},{"address":{"type":"absolute","value":4212880},"name":"??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ"},{"address":{"type":"absolute","value":4213648},"name":"?"},{"address":{"type":"absolute","value":4213664},"name":"?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z"},{"address":{"type":"absolute","value":4213712},"name":"?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z"},{"address":{"type":"absolute","value":4214208},"name":"?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ"},{"address":{"type":"absolute","value":4214272},"name":"?"},{"address":{"type":"absolute","value":4214288},"name":"?"},{"address":{"type":"absolute","value":4214448},"name":"??_G?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4214544},"name":"??_G?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4214784},"name":"??_G?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4214912},"name":"??_G?$basic_istream@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4215040},"name":"??_G?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4215280},"name":"??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4215392},"name":"?do_length@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z"},{"address":{"type":"absolute","value":4215424},"name":"?"},{"address":{"type":"absolute","value":4215456},"name":"?"},{"address":{"type":"absolute","value":4215760},"name":"?_Reset_back@?$basic_filebuf@DU?$char_traits@D@std@@@std@@AAEXXZ"},{"address":{"type":"absolute","value":4216400},"name":"?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ"},{"address":{"type":"absolute","value":4216992},"name":"??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z"},{"address":{"type":"absolute","value":4217152},"name":"?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ"},{"address":{"type":"absolute","value":4217184},"name":"?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ"},{"address":{"type":"absolute","value":4217296},"name":"?"},{"address":{"type":"absolute","value":4221824},"name":"@__security_check_cookie@4"},{"address":{"type":"absolute","value":4221841},"name":"___raise_securityfailure"},{"address":{"type":"absolute","value":4222130},"name":"___report_rangecheckfailure"},{"address":{"type":"absolute","value":4222142},"name":"___report_securityfailure"},{"address":{"type":"absolute","value":4222348},"name":"??2@YAPAXI@Z"},{"address":{"type":"absolute","value":4222434},"name":"?__scrt_initialize_thread_safe_statics@@YAHXZ"},{"address":{"type":"absolute","value":4222473},"name":"?"},{"address":{"type":"absolute","value":4222502},"name":"?__scrt_initialize_thread_safe_statics_platform_specific@@YAXXZ"},{"address":{"type":"absolute","value":4222769},"name":"__Init_thread_footer"},{"address":{"type":"absolute","value":4222843},"name":"__Init_thread_header"},{"address":{"type":"absolute","value":4222993},"name":"__Init_thread_wait"},{"address":{"type":"absolute","value":4223089},"name":"??_M@YGXPAXIIP6EX0@Z@Z"},{"address":{"type":"absolute","value":4223222},"name":"?__ArrayUnwind@@YGXPAXIIP6EX0@Z@Z"},{"address":{"type":"absolute","value":4223343},"name":"?find_pe_section@@YAPAU_IMAGE_SECTION_HEADER@@QAEI@Z"},{"address":{"type":"absolute","value":4223411},"name":"___scrt_acquire_startup_lock"},{"address":{"type":"absolute","value":4223461},"name":"___scrt_initialize_crt"},{"address":{"type":"absolute","value":4223518},"name":"___scrt_initialize_onexit_tables"},{"address":{"type":"absolute","value":4223683},"name":"___scrt_is_nonwritable_in_current_image"},{"address":{"type":"absolute","value":4223831},"name":"___scrt_release_startup_lock"},{"address":{"type":"absolute","value":4223860},"name":"___scrt_uninitialize_crt"},{"address":{"type":"absolute","value":4223900},"name":"__onexit"},{"address":{"type":"absolute","value":4223959},"name":"_atexit"},{"address":{"type":"absolute","value":4223980},"name":"?"},{"address":{"type":"absolute","value":4224195},"name":"?post_pgo_initialization@@YAHXZ"},{"address":{"type":"absolute","value":4224601},"name":"_mainCRTStartup"},{"address":{"type":"absolute","value":4224713},"name":"?"},{"address":{"type":"absolute","value":4224816},"name":"___scrt_fastfail"},{"address":{"type":"absolute","value":4225098},"name":"___scrt_get_show_window_mode"},{"address":{"type":"absolute","value":4225152},"name":"?"},{"address":{"type":"absolute","value":4225312},"name":"__SEH_prolog4"},{"address":{"type":"absolute","value":4225382},"name":"__SEH_epilog4"},{"address":{"type":"absolute","value":4225403},"name":"___isa_available_init"},{"address":{"type":"absolute","value":4225814},"name":"_Curl_tls_keylog_enabled"},{"address":{"type":"absolute","value":4225826},"name":"___get_entropy"},{"address":{"type":"absolute","value":4225903},"name":"___security_init_cookie"},{"address":{"type":"absolute","value":4226035},"name":"___scrt_initialize_default_local_stdio_options"},{"address":{"type":"absolute","value":4226397},"name":"??1GlobalCore@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4226410},"name":"??_EGlobalCore@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4226634},"name":"?"},{"address":{"type":"absolute","value":4226872},"name":"?wait@stl_condition_variable_concrt@details@Concurrency@@UAEXPAVstl_critical_section_interface@23@@Z"},{"address":{"type":"absolute","value":4226894},"name":"?wait@stl_condition_variable_vista@details@Concurrency@@UAEXPAVstl_critical_section_interface@23@@Z"},{"address":{"type":"absolute","value":4226921},"name":"?wait@stl_condition_variable_win7@details@Concurrency@@UAEXPAVstl_critical_section_interface@23@@Z"},{"address":{"type":"absolute","value":4226948},"name":"?wait_for@stl_condition_variable_concrt@details@Concurrency@@UAE_NPAVstl_critical_section_interface@23@I@Z"},{"address":{"type":"absolute","value":4226973},"name":"?wait_for@stl_condition_variable_vista@details@Concurrency@@UAE_NPAVstl_critical_section_interface@23@I@Z"},{"address":{"type":"absolute","value":4227007},"name":"?wait_for@stl_condition_variable_win7@details@Concurrency@@UAE_NPAVstl_critical_section_interface@23@I@Z"},{"address":{"type":"absolute","value":4227043},"name":"__Cnd_broadcast"},{"address":{"type":"absolute","value":4227074},"name":"__Cnd_destroy"},{"address":{"type":"absolute","value":4227100},"name":"__Cnd_destroy_in_situ"},{"address":{"type":"absolute","value":4227129},"name":"__Cnd_init"},{"address":{"type":"absolute","value":4227180},"name":"__Cnd_signal"},{"address":{"type":"absolute","value":4227232},"name":"??0_Init_locks@std@@QAE@XZ"},{"address":{"type":"absolute","value":4227277},"name":"??0_Lockit@std@@QAE@H@Z"},{"address":{"type":"absolute","value":4227365},"name":"??1_Lockit@std@@QAE@XZ"},{"address":{"type":"absolute","value":4227420},"name":"?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z"},{"address":{"type":"absolute","value":4227548},"name":"?_Throw_C_error@std@@YAXH@Z"},{"address":{"type":"absolute","value":4227593},"name":"?_Throw_Cpp_error@std@@YAXH@Z"},{"address":{"type":"absolute","value":4227735},"name":"??0_Locimp@locale@std@@AAE@_N@Z"},{"address":{"type":"absolute","value":4227800},"name":"??1_Fac_node@std@@QAE@XZ"},{"address":{"type":"absolute","value":4227934},"name":"??1_Locimp@locale@std@@MAE@XZ"},{"address":{"type":"absolute","value":4228023},"name":"??_G_Locimp@locale@std@@MAEPAXI@Z"},{"address":{"type":"absolute","value":4228057},"name":"?_Facet_Register@std@@YAXPAV_Facet_base@1@@Z"},{"address":{"type":"absolute","value":4228107},"name":"?_Init@locale@std@@CAPAV_Locimp@12@_N@Z"},{"address":{"type":"absolute","value":4228251},"name":"?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4228370},"name":"?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z"},{"address":{"type":"absolute","value":4228445},"name":"?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z"},{"address":{"type":"absolute","value":4228471},"name":"?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z"},{"address":{"type":"absolute","value":4228506},"name":"?_Setgloballocale@locale@std@@CAXPAX@Z"},{"address":{"type":"absolute","value":4228546},"name":"__Deletegloballocale"},{"address":{"type":"absolute","value":4228605},"name":"_tidy_global"},{"address":{"type":"absolute","value":4228652},"name":"?_Syserror_map@std@@YAPBDH@Z"},{"address":{"type":"absolute","value":4228689},"name":"?_Addstd@ios_base@std@@SAXPAV12@@Z"},{"address":{"type":"absolute","value":4228765},"name":"?_Callfns@ios_base@std@@AAEXW4event@12@@Z"},{"address":{"type":"absolute","value":4228816},"name":"?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z"},{"address":{"type":"absolute","value":4228880},"name":"?_Tidy@ios_base@std@@AAEXXZ"},{"address":{"type":"absolute","value":4229150},"name":"__Getctype"},{"address":{"type":"absolute","value":4229254},"name":"__Tolower"},{"address":{"type":"absolute","value":4229664},"name":"?lock@stl_critical_section_concrt@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4229694},"name":"?mtx_do_lock@@YAHPAU_Mtx_internal_imp_t@@PBUxtime@@@Z"},{"address":{"type":"absolute","value":4230096},"name":"?try_lock@stl_critical_section_vista@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4230112},"name":"?try_lock@stl_critical_section_win7@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4230140},"name":"?try_lock_for@stl_critical_section_vista@details@Concurrency@@UAE_NI@Z"},{"address":{"type":"absolute","value":4230158},"name":"?try_lock_for@stl_critical_section_win7@details@Concurrency@@UAE_NI@Z"},{"address":{"type":"absolute","value":4230176},"name":"?unlock@stl_critical_section_concrt@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4230206},"name":"__Mtx_clear_owner"},{"address":{"type":"absolute","value":4230221},"name":"__Mtx_destroy"},{"address":{"type":"absolute","value":4230247},"name":"__Mtx_destroy_in_situ"},{"address":{"type":"absolute","value":4230278},"name":"__Mtx_getconcrtcs"},{"address":{"type":"absolute","value":4230289},"name":"__Mtx_init"},{"address":{"type":"absolute","value":4230339},"name":"__Mtx_init_in_situ"},{"address":{"type":"absolute","value":4230372},"name":"__Mtx_lock"},{"address":{"type":"absolute","value":4230389},"name":"__Mtx_reset_owner"},{"address":{"type":"absolute","value":4230409},"name":"__Mtx_unlock"},{"address":{"type":"absolute","value":4230452},"name":"__Cnd_do_broadcast_at_thread_exit"},{"address":{"type":"absolute","value":4230622},"name":"__Thrd_current"},{"address":{"type":"absolute","value":4230720},"name":"__Thrd_equal"},{"address":{"type":"absolute","value":4230736},"name":"__Thrd_start"},{"address":{"type":"absolute","value":4230781},"name":"__Toupper"},{"address":{"type":"absolute","value":4231035},"name":"__Xtime_diff_to_millis2"},{"address":{"type":"absolute","value":4231099},"name":"__Xtime_get_ticks"},{"address":{"type":"absolute","value":4231138},"name":"_xtime_diff"},{"address":{"type":"absolute","value":4231317},"name":"_xtime_get"},{"address":{"type":"absolute","value":4231386},"name":"?initialize_pointers@@YAHXZ"},{"address":{"type":"absolute","value":4232324},"name":"?"},{"address":{"type":"absolute","value":4232356},"name":"?"},{"address":{"type":"absolute","value":4232390},"name":"?"},{"address":{"type":"absolute","value":4232424},"name":"___crtCreateEventExW"},{"address":{"type":"absolute","value":4232494},"name":"___crtCreateSemaphoreExW"},{"address":{"type":"absolute","value":4232582},"name":"?"},{"address":{"type":"absolute","value":4232626},"name":"?"},{"address":{"type":"absolute","value":4232670},"name":"___crtFlushProcessWriteBuffers"},{"address":{"type":"absolute","value":4232697},"name":"?"},{"address":{"type":"absolute","value":4232734},"name":"___crtGetCurrentProcessorNumber"},{"address":{"type":"absolute","value":4232844},"name":"___crtInitOnceExecuteOnce"},{"address":{"type":"absolute","value":4232986},"name":"?"},{"address":{"type":"absolute","value":4233018},"name":"___crtInitializeCriticalSectionEx"},{"address":{"type":"absolute","value":4233075},"name":"?"},{"address":{"type":"absolute","value":4233107},"name":"?"},{"address":{"type":"absolute","value":4233139},"name":"___crtSetThreadpoolTimer"},{"address":{"type":"absolute","value":4233182},"name":"___crtSetThreadpoolWait"},{"address":{"type":"absolute","value":4233222},"name":"?"},{"address":{"type":"absolute","value":4233260},"name":"___crtSleepConditionVariableSRW"},{"address":{"type":"absolute","value":4233301},"name":"?"},{"address":{"type":"absolute","value":4233333},"name":"?"},{"address":{"type":"absolute","value":4233370},"name":"?"},{"address":{"type":"absolute","value":4233402},"name":"?"},{"address":{"type":"absolute","value":4233448},"name":"__Mtxinit"},{"address":{"type":"absolute","value":4233499},"name":"??1_Init_atexit@@QAE@XZ"},{"address":{"type":"absolute","value":4233598},"name":"?_Atexit@@YAXP6AXXZ@Z"},{"address":{"type":"absolute","value":4233644},"name":"___crtLCMapStringA"},{"address":{"type":"absolute","value":4234113},"name":"__freea"},{"address":{"type":"absolute","value":4234143},"name":"_GetTableIndexFromLocaleName"},{"address":{"type":"absolute","value":4234221},"name":"___crtDownlevelLocaleNameToLCID"},{"address":{"type":"absolute","value":4234350},"name":"___wcsnicmp_ascii"},{"address":{"type":"absolute","value":4234454},"name":"??0CAtlBaseModule@ATL@@QAE@XZ"},{"address":{"type":"absolute","value":4234537},"name":"??0_ATL_BASE_MODULE70@ATL@@QAE@XZ"},{"address":{"type":"absolute","value":4234624},"name":"??0_com_error@@QAE@ABV0@@Z"},{"address":{"type":"absolute","value":4234688},"name":"??0_com_error@@QAE@JPAUIErrorInfo@@_N@Z"},{"address":{"type":"absolute","value":4234768},"name":"??1_com_error@@UAE@XZ"},{"address":{"type":"absolute","value":4234832},"name":"??_G_com_error@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4234912},"name":"?_com_raise_error@@YGXJPAUIErrorInfo@@@Z"},{"address":{"type":"absolute","value":4234949},"name":"?GetRangeOfTrysToCheck@__FrameHandler3@@SA?AU?$pair@Viterator@TryBlockMap@__FrameHandler3@@V123@@std@@AAVTryBlockMap@1@HH@Z"},{"address":{"type":"absolute","value":4235079},"name":"?_CallCatchBlock2@@YAPAXPAUEHRegistrationNode@@PBU_s_FuncInfo@@PAXHK@Z"},{"address":{"type":"absolute","value":4235173},"name":"?_CallSETranslator@@YAHPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAX2PBU_s_FuncInfo@@H1@Z"},{"address":{"type":"absolute","value":4235392},"name":"?_JumpToContinuation@@YGXPAXPAUEHRegistrationNode@@@Z"},{"address":{"type":"absolute","value":4235440},"name":"?_UnwindNestedFrames@@YGXPAUEHRegistrationNode@@PAUEHExceptionRecord@@@Z"},{"address":{"type":"absolute","value":4235523},"name":"?"},{"address":{"type":"absolute","value":4235572},"name":"__CreateFrameInfo"},{"address":{"type":"absolute","value":4235608},"name":"__FindAndUnlinkFrame"},{"address":{"type":"absolute","value":4235677},"name":"?"},{"address":{"type":"absolute","value":4235888},"name":"___DestructExceptionObject"},{"address":{"type":"absolute","value":4236048},"name":"?_CallMemberFunction0@@YGXQAX0@Z"},{"address":{"type":"absolute","value":4236061},"name":"__IsExceptionObjectToBeDestroyed"},{"address":{"type":"absolute","value":4236099},"name":"___AdjustPointer"},{"address":{"type":"absolute","value":4236136},"name":"___FrameUnwindFilter"},{"address":{"type":"absolute","value":4236205},"name":"___current_exception"},{"address":{"type":"absolute","value":4236214},"name":"___processing_throw"},{"address":{"type":"absolute","value":4236223},"name":"___std_terminate"},{"address":{"type":"absolute","value":4236240},"name":"_ValidateLocalCookies"},{"address":{"type":"absolute","value":4236304},"name":"__except_handler4"},{"address":{"type":"absolute","value":4236647},"name":"___std_exception_copy"},{"address":{"type":"absolute","value":4236746},"name":"___std_exception_destroy"},{"address":{"type":"absolute","value":4236777},"name":"___std_type_info_compare"},{"address":{"type":"absolute","value":4236837},"name":"__get_purecall_handler"},{"address":{"type":"absolute","value":4236858},"name":"__purecall"},{"address":{"type":"absolute","value":4236886},"name":"___vcrt_initialize"},{"address":{"type":"absolute","value":4236927},"name":"___vcrt_uninitialize"},{"address":{"type":"absolute","value":4236958},"name":"__CxxThrowException@8"},{"address":{"type":"absolute","value":4237072},"name":"_memset"},{"address":{"type":"absolute","value":4237424},"name":"?"},{"address":{"type":"absolute","value":4238028},"name":"?"},{"address":{"type":"absolute","value":4238092},"name":"?"},{"address":{"type":"absolute","value":4238268},"name":"?"},{"address":{"type":"absolute","value":4238832},"name":"?"},{"address":{"type":"absolute","value":4239436},"name":"?"},{"address":{"type":"absolute","value":4239500},"name":"?"},{"address":{"type":"absolute","value":4239676},"name":"?"},{"address":{"type":"absolute","value":4240413},"name":"___uncaught_exception"},{"address":{"type":"absolute","value":4240433},"name":"_memcmp"},{"address":{"type":"absolute","value":4244437},"name":"___vcrt_freefls@4"},{"address":{"type":"absolute","value":4244465},"name":"___vcrt_getptd"},{"address":{"type":"absolute","value":4244479},"name":"___vcrt_getptd_noexit"},{"address":{"type":"absolute","value":4244625},"name":"___vcrt_getptd_noinit"},{"address":{"type":"absolute","value":4244680},"name":"___vcrt_initialize_ptd"},{"address":{"type":"absolute","value":4244731},"name":"___vcrt_uninitialize_ptd"},{"address":{"type":"absolute","value":4244758},"name":"??$BuildCatchObjectHelperInternal@$$CBU_s_HandlerType@@@@YAHPAUEHExceptionRecord@@PAXPBU_s_HandlerType@@PBU_s_CatchableType@@@Z"},{"address":{"type":"absolute","value":4245077},"name":"??$BuildCatchObjectInternal@$$CBU_s_HandlerType@@@@YAXPAUEHExceptionRecord@@PAXPBU_s_HandlerType@@PBU_s_CatchableType@@@Z"},{"address":{"type":"absolute","value":4245230},"name":"??$CatchIt@V__FrameHandler3@@@@YAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@PBU_s_HandlerType@@PBU_s_CatchableType@@PBU_s_TryBlockMapEntry@@H1E@Z"},{"address":{"type":"absolute","value":4245358},"name":"??$FindHandler@V__FrameHandler3@@@@YAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@EH1@Z"},{"address":{"type":"absolute","value":4246268},"name":"??$FindHandlerForForeignException@V__FrameHandler3@@@@YAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@HH1@Z"},{"address":{"type":"absolute","value":4246541},"name":"?"},{"address":{"type":"absolute","value":4246683},"name":"??$__InternalCxxFrameHandler@V__FrameHandler3@@@@YA?AW4_EXCEPTION_DISPOSITION@@PAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PAXPBU_s_FuncInfo@@H1E@Z"},{"address":{"type":"absolute","value":4246992},"name":"?CallCatchBlock@@YAPAXPAUEHExceptionRecord@@PAUEHRegistrationNode@@PAU_CONTEXT@@PBU_s_FuncInfo@@PAXHK@Z"},{"address":{"type":"absolute","value":4247444},"name":"?CallUnexpected@@YAXPBU_s_ESTypeList@@@Z"},{"address":{"type":"absolute","value":4247476},"name":"__catch$?CallUnexpected@@YAXPBU_s_ESTypeList@@@Z$0"},{"address":{"type":"absolute","value":4247502},"name":"?ExFilterRethrow@@YAHPAU_EXCEPTION_POINTERS@@@Z"},{"address":{"type":"absolute","value":4247576},"name":"?FrameUnwindToEmptyState@__FrameHandler3@@SAXPAUEHRegistrationNode@@PAXPBU_s_FuncInfo@@@Z"},{"address":{"type":"absolute","value":4247600},"name":"?FrameUnwindToState@__FrameHandler3@@SAXPAUEHRegistrationNode@@PAXPBU_s_FuncInfo@@H@Z"},{"address":{"type":"absolute","value":4247832},"name":"?IsInExceptionSpec@@YAEPAUEHExceptionRecord@@PBU_s_ESTypeList@@@Z"},{"address":{"type":"absolute","value":4247986},"name":"?_CallMemberFunction1@@YGXQAX00@Z"},{"address":{"type":"absolute","value":4248002},"name":"?_CallMemberFunction2@@YGXQAX00H@Z"},{"address":{"type":"absolute","value":4248021},"name":"?"},{"address":{"type":"absolute","value":4248032},"name":"__CallSettingFrame@12"},{"address":{"type":"absolute","value":4248108},"name":"___except_validate_context_record"},{"address":{"type":"absolute","value":4248156},"name":"___except_validate_jump_buffer"},{"address":{"type":"absolute","value":4248208},"name":"__local_unwind4"},{"address":{"type":"absolute","value":4248352},"name":"__unwind_handler4"},{"address":{"type":"absolute","value":4248464},"name":"@_EH4_CallFilterFunc@8"},{"address":{"type":"absolute","value":4248488},"name":"@_EH4_TransferToHandler@8"},{"address":{"type":"absolute","value":4248516},"name":"@_EH4_GlobalUnwind2@8"},{"address":{"type":"absolute","value":4248544},"name":"@_EH4_LocalUnwind@16"},{"address":{"type":"absolute","value":4248578},"name":"___vcrt_initialize_locks"},{"address":{"type":"absolute","value":4248638},"name":"___vcrt_uninitialize_locks"},{"address":{"type":"absolute","value":4248685},"name":"?try_get_first_available_module@@YAPAUHINSTANCE__@@QBW4module_id@?A0xbf9eb92d@@0@Z"},{"address":{"type":"absolute","value":4248881},"name":"?try_get_function@@YAPAXW4function_id@?A0xbf9eb92d@@QBDQBW4module_id@2@2@Z"},{"address":{"type":"absolute","value":4248992},"name":"___vcrt_FlsAlloc"},{"address":{"type":"absolute","value":4249051},"name":"___vcrt_FlsFree"},{"address":{"type":"absolute","value":4249110},"name":"___vcrt_FlsGetValue"},{"address":{"type":"absolute","value":4249169},"name":"___vcrt_FlsSetValue"},{"address":{"type":"absolute","value":4249231},"name":"___vcrt_InitializeCriticalSectionEx"},{"address":{"type":"absolute","value":4249302},"name":"___vcrt_initialize_winapi_thunks"},{"address":{"type":"absolute","value":4249343},"name":"___vcrt_uninitialize_winapi_thunks"},{"address":{"type":"absolute","value":4249393},"name":"_unexpected"},{"address":{"type":"absolute","value":4249422},"name":"?GetCurrentState@__FrameHandler3@@SAHPAUEHRegistrationNode@@PAXPBU_s_FuncInfo@@@Z"},{"address":{"type":"absolute","value":4249451},"name":"?SetState@__FrameHandler3@@SAXPAUEHRegistrationNode@@PBU_s_FuncInfo@@H@Z"},{"address":{"type":"absolute","value":4249472},"name":"__global_unwind2"},{"address":{"type":"absolute","value":4249505},"name":"__unwind_handler"},{"address":{"type":"absolute","value":4249574},"name":"__local_unwind2"},{"address":{"type":"absolute","value":4249740},"name":"_at_done"},{"address":{"type":"absolute","value":4249744},"name":"__NLG_Notify1"},{"address":{"type":"absolute","value":4249756},"name":"__NLG_Notify"},{"address":{"type":"absolute","value":4249787},"name":"__NLG_Call"},{"address":{"type":"absolute","value":4249790},"name":"??0_LocaleUpdate@@QAE@QAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4249921},"name":"?"},{"address":{"type":"absolute","value":4249970},"name":"___acrt_call_reportfault"},{"address":{"type":"absolute","value":4250305},"name":"__invalid_parameter"},{"address":{"type":"absolute","value":4250428},"name":"__invalid_parameter_noinfo"},{"address":{"type":"absolute","value":4250444},"name":"__invalid_parameter_noinfo_noreturn"},{"address":{"type":"absolute","value":4250473},"name":"__invoke_watson"},{"address":{"type":"absolute","value":4250524},"name":"__resetstkoflw"},{"address":{"type":"absolute","value":4250733},"name":"?"},{"address":{"type":"absolute","value":4250764},"name":"?atexit_exception_filter@@YAHK@Z"},{"address":{"type":"absolute","value":4250783},"name":"?common_exit@@YAXHW4_crt_exit_cleanup_mode@@W4_crt_exit_return_mode@@@Z"},{"address":{"type":"absolute","value":4251064},"name":"?exit_or_terminate_process@@YAXI@Z"},{"address":{"type":"absolute","value":4251129},"name":"?"},{"address":{"type":"absolute","value":4251197},"name":"?try_cor_exit_process@@YAXI@Z"},{"address":{"type":"absolute","value":4251303},"name":"?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z"},{"address":{"type":"absolute","value":4251318},"name":"__c_exit"},{"address":{"type":"absolute","value":4251333},"name":"__cexit"},{"address":{"type":"absolute","value":4251348},"name":"?"},{"address":{"type":"absolute","value":4251370},"name":"__register_thread_local_exe_atexit_callback"},{"address":{"type":"absolute","value":4251426},"name":"_exit"},{"address":{"type":"absolute","value":4251572},"name":"??$common_ftell_nolock@_J@@YA_JV__crt_stdio_stream@@@Z"},{"address":{"type":"absolute","value":4251977},"name":"?common_ftell_read_mode_nolock@@YA_JV__crt_stdio_stream@@_J1@Z"},{"address":{"type":"absolute","value":4252365},"name":"?common_ftell_translated_utf8_nolock@@YA_JV__crt_stdio_stream@@_J@Z"},{"address":{"type":"absolute","value":4252798},"name":"__fputc_nolock"},{"address":{"type":"absolute","value":4252839},"name":"_fputc"},{"address":{"type":"absolute","value":4253099},"name":"_calloc"},{"address":{"type":"absolute","value":4253143},"name":"_srand"},{"address":{"type":"absolute","value":4253485},"name":"?_mbstowcs_l_helper@@YAIPA_WPBDIPAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4253862},"name":"__mbstowcs_s_l"},{"address":{"type":"absolute","value":4254089},"name":"_mbstowcs_s"},{"address":{"type":"absolute","value":4254121},"name":"___acrt_stdio_flush_nolock"},{"address":{"type":"absolute","value":4254223},"name":"__fflush_nolock"},{"address":{"type":"absolute","value":4254294},"name":"__flushall"},{"address":{"type":"absolute","value":4254303},"name":"_common_flush_all"},{"address":{"type":"absolute","value":4254519},"name":"_fflush"},{"address":{"type":"absolute","value":4254608},"name":"?unget@?$c_string_character_source@D@__crt_strtox@@QAEXD@Z"},{"address":{"type":"absolute","value":4254648},"name":"?unget@?$c_string_character_source@_W@__crt_strtox@@QAEX_W@Z"},{"address":{"type":"absolute","value":4254692},"name":"?"},{"address":{"type":"absolute","value":4254719},"name":"__chvalidchk_l"},{"address":{"type":"absolute","value":4254761},"name":"__ischartype_l"},{"address":{"type":"absolute","value":4254812},"name":"__fclose_nolock"},{"address":{"type":"absolute","value":4254930},"name":"_fclose"},{"address":{"type":"absolute","value":4255058},"name":"?LongLongSub@@YAJ_J0PA_J@Z"},{"address":{"type":"absolute","value":4255187},"name":"?common_fseek@@YAHV__crt_stdio_stream@@_JH@Z"},{"address":{"type":"absolute","value":4255322},"name":"?common_fseek_binary_mode_read_only_fast_track_nolock@@YA_NV__crt_stdio_stream@@_JH@Z"},{"address":{"type":"absolute","value":4255539},"name":"?common_fseek_nolock@@YAHV__crt_stdio_stream@@_JH@Z"},{"address":{"type":"absolute","value":4255756},"name":"__fseeki64"},{"address":{"type":"absolute","value":4255783},"name":"_fseek"},{"address":{"type":"absolute","value":4255810},"name":"__Strftime_l"},{"address":{"type":"absolute","value":4256113},"name":"_strftime"},{"address":{"type":"absolute","value":4256144},"name":"??$common_tox_l@$1?internal_isupper_l@@YA_NHQAU__crt_locale_pointers@@@Z$1?internal_map_lower@@YAHH0@Z@@YAHHKQAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4256474},"name":"?internal_isupper_l@@YA_NHQAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4256503},"name":"__tolower_l"},{"address":{"type":"absolute","value":4256529},"name":"??$is_overflow_condition@K@__crt_strtox@@YA_NIK@Z"},{"address":{"type":"absolute","value":4256580},"name":"??$parse_integer@KV?$c_string_character_source@D@__crt_strtox@@@__crt_strtox@@YAKQAU__crt_locale_pointers@@V?$c_string_character_source@D@0@H_N@Z"},{"address":{"type":"absolute","value":4257132},"name":"??$parse_integer@KV?$c_string_character_source@_W@__crt_strtox@@@__crt_strtox@@YAKQAU__crt_locale_pointers@@V?$c_string_character_source@_W@0@H_N@Z"},{"address":{"type":"absolute","value":4258897},"name":"__fgetc_nolock"},{"address":{"type":"absolute","value":4258957},"name":"_fgetc"},{"address":{"type":"absolute","value":4259215},"name":"_terminate"},{"address":{"type":"absolute","value":4259275},"name":"__strnicmp"},{"address":{"type":"absolute","value":4259383},"name":"__strnicmp_l"},{"address":{"type":"absolute","value":4259566},"name":"___acrt_initialize_stdio"},{"address":{"type":"absolute","value":4259766},"name":"___acrt_iob_func"},{"address":{"type":"absolute","value":4259783},"name":"___acrt_uninitialize_stdio"},{"address":{"type":"absolute","value":4259859},"name":"__get_stream_buffer_pointers"},{"address":{"type":"absolute","value":4259969},"name":"___acrt_errno_from_os_error"},{"address":{"type":"absolute","value":4260036},"name":"___acrt_errno_map_os_error"},{"address":{"type":"absolute","value":4260071},"name":"___doserrno"},{"address":{"type":"absolute","value":4260090},"name":"__errno"},{"address":{"type":"absolute","value":4260230},"name":"??R<lambda_b51c0495177f500e782686251704ae76>@@QBEIXZ"},{"address":{"type":"absolute","value":4260300},"name":"__fwrite_nolock"},{"address":{"type":"absolute","value":4260677},"name":"_fwrite"},{"address":{"type":"absolute","value":4260765},"name":"??$common_getenv_nolock@D@@YAPADQBD@Z"},{"address":{"type":"absolute","value":4260962},"name":"??$common_getenv_s_nolock@D@@YAHQAIQADIQBD@Z"},{"address":{"type":"absolute","value":4261141},"name":"_fgetpos"},{"address":{"type":"absolute","value":4261353},"name":"?"},{"address":{"type":"absolute","value":4261507},"name":"?set_buffer@@YAHV__crt_stdio_stream@@QADIH@Z"},{"address":{"type":"absolute","value":4261558},"name":"_setvbuf"},{"address":{"type":"absolute","value":4261676},"name":"??$common_timespec_get@U_timespec64@@@@YAHQAU_timespec64@@H@Z"},{"address":{"type":"absolute","value":4261803},"name":"?"},{"address":{"type":"absolute","value":4261869},"name":"??$common_localtime_s@_J@@YAHQAUtm@@QB_J@Z"},{"address":{"type":"absolute","value":4262519},"name":"?"},{"address":{"type":"absolute","value":4262563},"name":"__ungetc_nolock"},{"address":{"type":"absolute","value":4262802},"name":"_ungetc"},{"address":{"type":"absolute","value":4262914},"name":"__islower_l"},{"address":{"type":"absolute","value":4262970},"name":"__isupper_l"},{"address":{"type":"absolute","value":4263026},"name":"_islower"},{"address":{"type":"absolute","value":4263071},"name":"_isupper"},{"address":{"type":"absolute","value":4263116},"name":"_fsetpos"},{"address":{"type":"absolute","value":4263175},"name":"__fread_nolock_s"},{"address":{"type":"absolute","value":4263635},"name":"_fread"},{"address":{"type":"absolute","value":4263664},"name":"_fread_s"},{"address":{"type":"absolute","value":4263811},"name":"_memcpy_s"},{"address":{"type":"absolute","value":4263940},"name":"_malloc"},{"address":{"type":"absolute","value":4263971},"name":"__callnewh"},{"address":{"type":"absolute","value":4264039},"name":"__query_new_handler"},{"address":{"type":"absolute","value":4264121},"name":"__seh_filter_exe"},{"address":{"type":"absolute","value":4264492},"name":"??$common_configure_argv@D@@YAHW4_crt_argv_mode@@@Z"},{"address":{"type":"absolute","value":4264784},"name":"??$parse_command_line@D@@YAXPADPAPAD0PAI2@Z"},{"address":{"type":"absolute","value":4265157},"name":"___acrt_allocate_buffer_for_argv"},{"address":{"type":"absolute","value":4265242},"name":"__configure_narrow_argv"},{"address":{"type":"absolute","value":4265300},"name":"??$common_initialize_environment_nolock@D@@YAHXZ"},{"address":{"type":"absolute","value":4265389},"name":"??$create_environment@D@@YAQAPADQAD@Z"},{"address":{"type":"absolute","value":4265598},"name":"?"},{"address":{"type":"absolute","value":4265645},"name":"??$initialize_environment_by_cloning_nolock@D@@YAHXZ"},{"address":{"type":"absolute","value":4265772},"name":"?"},{"address":{"type":"absolute","value":4265895},"name":"___dcrt_uninitialize_environments_nolock"},{"address":{"type":"absolute","value":4266197},"name":"??R<lambda_275893d493268fdec8709772e3fcec0e>@@QBEHXZ"},{"address":{"type":"absolute","value":4266485},"name":"?"},{"address":{"type":"absolute","value":4266828},"name":"__execute_onexit_table"},{"address":{"type":"absolute","value":4266857},"name":"__initialize_onexit_table"},{"address":{"type":"absolute","value":4266918},"name":"__register_onexit_function"},{"address":{"type":"absolute","value":4266972},"name":"_initialize_c"},{"address":{"type":"absolute","value":4266998},"name":"_uninitialize_environment"},{"address":{"type":"absolute","value":4267006},"name":"_initialize_pointers"},{"address":{"type":"absolute","value":4267067},"name":"_uninitialize_vcruntime"},{"address":{"type":"absolute","value":4267076},"name":"_uninitialize_allocated_memory"},{"address":{"type":"absolute","value":4267195},"name":"___acrt_initialize"},{"address":{"type":"absolute","value":4267213},"name":"___acrt_uninitialize"},{"address":{"type":"absolute","value":4267237},"name":"?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z"},{"address":{"type":"absolute","value":4267252},"name":"___acrt_has_user_matherr"},{"address":{"type":"absolute","value":4267297},"name":"___acrt_invoke_user_matherr"},{"address":{"type":"absolute","value":4267370},"name":"___setusermatherr"},{"address":{"type":"absolute","value":4267391},"name":"?"},{"address":{"type":"absolute","value":4267474},"name":"__initterm"},{"address":{"type":"absolute","value":4267566},"name":"__initterm_e"},{"address":{"type":"absolute","value":4267679},"name":"__set_fmode"},{"address":{"type":"absolute","value":4267740},"name":"__setmode_nolock"},{"address":{"type":"absolute","value":4268115},"name":"??R<lambda_2af78c5f5901b1372d98f9ab3177dfa6>@@QBEXXZ"},{"address":{"type":"absolute","value":4268207},"name":"?"},{"address":{"type":"absolute","value":4268461},"name":"___acrt_copy_locale_name"},{"address":{"type":"absolute","value":4268574},"name":"___acrt_uninitialize_locale"},{"address":{"type":"absolute","value":4268656},"name":"___lc_lctowcs"},{"address":{"type":"absolute","value":4268768},"name":"___lc_wcstolc"},{"address":{"type":"absolute","value":4269071},"name":"__configthreadlocale"},{"address":{"type":"absolute","value":4269169},"name":"__copytlocinfo_nolock"},{"address":{"type":"absolute","value":4269216},"name":"__expandlocale"},{"address":{"type":"absolute","value":4270103},"name":"__wcscats"},{"address":{"type":"absolute","value":4270168},"name":"__wsetlocale"},{"address":{"type":"absolute","value":4270296},"name":"__wsetlocale_get_all"},{"address":{"type":"absolute","value":4270705},"name":"__wsetlocale_nolock"},{"address":{"type":"absolute","value":4271446},"name":"__wsetlocale_set_cat"},{"address":{"type":"absolute","value":4272424},"name":"__set_new_mode"},{"address":{"type":"absolute","value":4272477},"name":"__controlfp_s"},{"address":{"type":"absolute","value":4272572},"name":"___acrt_initialize_locks"},{"address":{"type":"absolute","value":4272660},"name":"___acrt_uninitialize_locks"},{"address":{"type":"absolute","value":4272750},"name":"_wcscpy_s"},{"address":{"type":"absolute","value":4272864},"name":"_strcspn"},{"address":{"type":"absolute","value":4272934},"name":"_call_wsetlocale"},{"address":{"type":"absolute","value":4273091},"name":"_setlocale"},{"address":{"type":"absolute","value":4274089},"name":"___pctype_func"},{"address":{"type":"absolute","value":4274127},"name":"__wcsdup"},{"address":{"type":"absolute","value":4274224},"name":"____lc_codepage_func"},{"address":{"type":"absolute","value":4274263},"name":"____lc_locale_name_func"},{"address":{"type":"absolute","value":4274304},"name":"___acrt_locale_initialize_ctype"},{"address":{"type":"absolute","value":4275230},"name":"_abort"},{"address":{"type":"absolute","value":4275297},"name":"??$thread_start@P6GIPAX@Z@@YGKQAX@Z"},{"address":{"type":"absolute","value":4275422},"name":"?"},{"address":{"type":"absolute","value":4275477},"name":"?common_end_thread@@YAXI@Z"},{"address":{"type":"absolute","value":4275564},"name":"?create_thread_parameter@@YAPAU__acrt_thread_parameter@@QAX0@Z"},{"address":{"type":"absolute","value":4275637},"name":"__beginthreadex"},{"address":{"type":"absolute","value":4275770},"name":"__endthreadex"},{"address":{"type":"absolute","value":4275784},"name":"?"},{"address":{"type":"absolute","value":4275849},"name":"?compute_iso_week@@YAHHHH@Z"},{"address":{"type":"absolute","value":4275927},"name":"?compute_iso_week_internal@@YAHHHH@Z"},{"address":{"type":"absolute","value":4276076},"name":"?compute_iso_year@@YAHHHH@Z"},{"address":{"type":"absolute","value":4276119},"name":"?expand_time@@YA_NPAU__crt_locale_pointers@@_WPBUtm@@PAPA_WPAIPBU__crt_lc_time_data@@_N@Z"},{"address":{"type":"absolute","value":4278931},"name":"?store_number@@YAXHHQAPA_WQAI_W@Z"},{"address":{"type":"absolute","value":4279093},"name":"?store_number_without_lead_zeroes@@YAXHQAPA_WQAI@Z"},{"address":{"type":"absolute","value":4279196},"name":"?store_string@@YAXPB_WQAPA_WQAI@Z"},{"address":{"type":"absolute","value":4279245},"name":"?store_winword@@YA_NQAU__crt_locale_pointers@@HQBUtm@@QAPA_WQAIQBU__crt_lc_time_data@@@Z"},{"address":{"type":"absolute","value":4280380},"name":"__Wcsftime_l"},{"address":{"type":"absolute","value":4280765},"name":"___strncnt"},{"address":{"type":"absolute","value":4280793},"name":"_wcsnlen"},{"address":{"type":"absolute","value":4281232},"name":"_strcpy_s"},{"address":{"type":"absolute","value":4281322},"name":"?"},{"address":{"type":"absolute","value":4281349},"name":"?"},{"address":{"type":"absolute","value":4281391},"name":"?"},{"address":{"type":"absolute","value":4281440},"name":"_strncmp"},{"address":{"type":"absolute","value":4281560},"name":"_wcsncmp"},{"address":{"type":"absolute","value":4281676},"name":"__malloc_base"},{"address":{"type":"absolute","value":4281754},"name":"__mbtowc_l"},{"address":{"type":"absolute","value":4282004},"name":"_mbtowc"},{"address":{"type":"absolute","value":4282514},"name":"?construct_ptd@@YAXQAU__acrt_ptd@@QAPAU__crt_locale_data@@@Z"},{"address":{"type":"absolute","value":4282635},"name":"?destroy_fls@@YGXPAX@Z"},{"address":{"type":"absolute","value":4282668},"name":"?destroy_ptd@@YAXQAU__acrt_ptd@@@Z"},{"address":{"type":"absolute","value":4282837},"name":"?replace_current_thread_locale_nolock@@YAXQAU__acrt_ptd@@QAU__crt_locale_data@@@Z"},{"address":{"type":"absolute","value":4282912},"name":"___acrt_getptd"},{"address":{"type":"absolute","value":4283044},"name":"___acrt_getptd_noexit"},{"address":{"type":"absolute","value":4283177},"name":"___acrt_initialize_ptd"},{"address":{"type":"absolute","value":4283221},"name":"___acrt_uninitialize_ptd"},{"address":{"type":"absolute","value":4283337},"name":"__fileno"},{"address":{"type":"absolute","value":4283375},"name":"___acrt_stdio_begin_temporary_buffering_nolock"},{"address":{"type":"absolute","value":4283556},"name":"___acrt_stdio_end_temporary_buffering_nolock"},{"address":{"type":"absolute","value":4283613},"name":"?initialize_inherited_file_handles_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4283795},"name":"?initialize_stdio_handles_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4283977},"name":"___acrt_initialize_lowio"},{"address":{"type":"absolute","value":4284063},"name":"___acrt_uninitialize_lowio"},{"address":{"type":"absolute","value":4284107},"name":"?"},{"address":{"type":"absolute","value":4284375},"name":"?try_get_function@@YAPAXW4function_id@?A0x352e5c4b@@QBDQBW4module_id@2@2@Z"},{"address":{"type":"absolute","value":4284531},"name":"?try_get_module@@YAPAUHINSTANCE__@@W4module_id@?A0x352e5c4b@@@Z"},{"address":{"type":"absolute","value":4284654},"name":"___acrt_AreFileApisANSI@0"},{"address":{"type":"absolute","value":4284848},"name":"___acrt_EnumSystemLocalesEx@16"},{"address":{"type":"absolute","value":4284957},"name":"___acrt_FlsAlloc@4"},{"address":{"type":"absolute","value":4285043},"name":"___acrt_FlsFree@4"},{"address":{"type":"absolute","value":4285129},"name":"___acrt_FlsGetValue@4"},{"address":{"type":"absolute","value":4285215},"name":"___acrt_FlsSetValue@8"},{"address":{"type":"absolute","value":4285304},"name":"___acrt_GetDateFormatEx@28"},{"address":{"type":"absolute","value":4285434},"name":"___acrt_GetLocaleInfoEx@16"},{"address":{"type":"absolute","value":4285540},"name":"___acrt_GetSystemTimePreciseAsFileTime@4"},{"address":{"type":"absolute","value":4285626},"name":"___acrt_GetTimeFormatEx@24"},{"address":{"type":"absolute","value":4285738},"name":"___acrt_GetUserDefaultLocaleName@8"},{"address":{"type":"absolute","value":4285841},"name":"___acrt_InitializeCriticalSectionEx@12"},{"address":{"type":"absolute","value":4285939},"name":"___acrt_IsValidLocaleName@4"},{"address":{"type":"absolute","value":4286038},"name":"___acrt_LCIDToLocaleName@16"},{"address":{"type":"absolute","value":4286144},"name":"___acrt_LCMapStringEx@36"},{"address":{"type":"absolute","value":4286280},"name":"___acrt_LocaleNameToLCID@8"},{"address":{"type":"absolute","value":4286372},"name":"___acrt_RoInitialize@4"},{"address":{"type":"absolute","value":4286454},"name":"___acrt_RoUninitialize@0"},{"address":{"type":"absolute","value":4286527},"name":"___acrt_SetThreadStackGuarantee@4"},{"address":{"type":"absolute","value":4286621},"name":"___acrt_initialize_winapi_thunks"},{"address":{"type":"absolute","value":4286659},"name":"___acrt_is_packaged_app"},{"address":{"type":"absolute","value":4286794},"name":"___acrt_uninitialize_winapi_thunks"},{"address":{"type":"absolute","value":4286848},"name":"??$common_lseek@_J@@YA_JH_JH@Z"},{"address":{"type":"absolute","value":4287109},"name":"??$common_lseek_nolock@_J@@YA_JH_JH@Z"},{"address":{"type":"absolute","value":4287235},"name":"__lseeki64"},{"address":{"type":"absolute","value":4287262},"name":"__lseeki64_nolock"},{"address":{"type":"absolute","value":4287289},"name":"??$translate_text_mode_nolock@D@@YAHHQADI@Z"},{"address":{"type":"absolute","value":4287632},"name":"??$translate_text_mode_nolock@_W@@YAHHQA_WI@Z"},{"address":{"type":"absolute","value":4288080},"name":"?translate_ansi_or_utf8_nolock@@YAHHQADIQA_WI@Z"},{"address":{"type":"absolute","value":4288416},"name":"?translate_utf16_from_console_nolock@@YAHHQA_WI@Z"},{"address":{"type":"absolute","value":4288545},"name":"__read"},{"address":{"type":"absolute","value":4288820},"name":"__read_nolock"},{"address":{"type":"absolute","value":4290042},"name":"??$write_buffer_nolock@D@@YA_NDV__crt_stdio_stream@@@Z"},{"address":{"type":"absolute","value":4290257},"name":"__calloc_base"},{"address":{"type":"absolute","value":4290350},"name":"?__acrt_stdio_allocate_stream@@YA?AV__crt_stdio_stream@@XZ"},{"address":{"type":"absolute","value":4290445},"name":"?__acrt_stdio_free_stream@@YAXV__crt_stdio_stream@@@Z"},{"address":{"type":"absolute","value":4290504},"name":"?find_or_allocate_unused_stream_nolock@@YA?AV__crt_stdio_stream@@XZ"},{"address":{"type":"absolute","value":4290699},"name":"??$__acrt_stdio_parse_mode@D@@YA?AU__acrt_stdio_stream_mode@@QBD@Z"},{"address":{"type":"absolute","value":4291394},"name":"?__acrt_stdio_parse_mode_D@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291421},"name":"?__acrt_stdio_parse_mode_T@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291452},"name":"?__acrt_stdio_parse_mode_b@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291484},"name":"?__acrt_stdio_parse_mode_c@@YA_NAAU__acrt_stdio_stream_mode@@AA_N@Z"},{"address":{"type":"absolute","value":4291518},"name":"?__acrt_stdio_parse_mode_n@@YA_NAAU__acrt_stdio_stream_mode@@AA_N@Z"},{"address":{"type":"absolute","value":4291552},"name":"?__acrt_stdio_parse_mode_plus@@YA_NAAU__acrt_stdio_stream_mode@@AA_N@Z"},{"address":{"type":"absolute","value":4291605},"name":"?__acrt_stdio_parse_mode_t@@YA_NAAU__acrt_stdio_stream_mode@@@Z"},{"address":{"type":"absolute","value":4291648},"name":"?"},{"address":{"type":"absolute","value":4291699},"name":"__realloc_base"},{"address":{"type":"absolute","value":4291804},"name":"__isleadbyte_l"},{"address":{"type":"absolute","value":4292053},"name":"__commit"},{"address":{"type":"absolute","value":4292164},"name":"?write_double_translated_ansi_nolock@@YA?AUwrite_result@?A0x47fa6670@@HQBDI@Z"},{"address":{"type":"absolute","value":4292599},"name":"?"},{"address":{"type":"absolute","value":4292708},"name":"?write_requires_double_translation_nolock@@YA_NH@Z"},{"address":{"type":"absolute","value":4292826},"name":"?"},{"address":{"type":"absolute","value":4293049},"name":"?write_text_utf16le_nolock@@YA?AUwrite_result@?A0x47fa6670@@HQBDI@Z"},{"address":{"type":"absolute","value":4293287},"name":"?write_text_utf8_nolock@@YA?AUwrite_result@?A0x47fa6670@@HQBDI@Z"},{"address":{"type":"absolute","value":4293823},"name":"__write_nolock"},{"address":{"type":"absolute","value":4294347},"name":"_iswctype"},{"address":{"type":"absolute","value":4294442},"name":"__isctype_l"},{"address":{"type":"absolute","value":4294949},"name":"__close_nolock"},{"address":{"type":"absolute","value":4295105},"name":"___acrt_stdio_free_buffer_nolock"},{"address":{"type":"absolute","value":4295167},"name":"___acrt_copy_path_to_wide_string"},{"address":{"type":"absolute","value":4295366},"name":"?__acrt_LCMapStringA_stat@@YAHPAU__crt_locale_pointers@@PB_WKPBDHPADHHH@Z"},{"address":{"type":"absolute","value":4295907},"name":"___acrt_LCMapStringA"},{"address":{"type":"absolute","value":4296384},"name":"___ascii_strnicmp"},{"address":{"type":"absolute","value":4296481},"name":"__fcloseall"},{"address":{"type":"absolute","value":4296641},"name":"__strnicoll"},{"address":{"type":"absolute","value":4296682},"name":"__strnicoll_l"},{"address":{"type":"absolute","value":4296884},"name":"___acrt_initialize_timeset"},{"address":{"type":"absolute","value":4297095},"name":"?"},{"address":{"type":"absolute","value":4297486},"name":"?compute_year@@YAHAA_JAA_N@Z"},{"address":{"type":"absolute","value":4297650},"name":"___getgmtimebuf"},{"address":{"type":"absolute","value":4297723},"name":"?_isindst_nolock@@YAHQAUtm@@@Z"},{"address":{"type":"absolute","value":4298210},"name":"?cvtdate@@YAXW4transition_type@?A0xdb49773f@@W4date_type@2@HHHHHHHHH@Z"},{"address":{"type":"absolute","value":4298546},"name":"?tzset_from_environment_nolock@@YAXPAD@Z"},{"address":{"type":"absolute","value":4299015},"name":"?tzset_from_system_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4299362},"name":"?tzset_nolock@@YAXXZ"},{"address":{"type":"absolute","value":4299586},"name":"___tzset"},{"address":{"type":"absolute","value":4299667},"name":"__isindst"},{"address":{"type":"absolute","value":4299741},"name":"___acrt_stdio_allocate_buffer_nolock"},{"address":{"type":"absolute","value":4299834},"name":"??$common_xtox@K_W@@YAHKQA_WII_N@Z"},{"address":{"type":"absolute","value":4299976},"name":"??$common_xtox_s@K_W@@YAHKQA_WII_N@Z"},{"address":{"type":"absolute","value":4300071},"name":"?"},{"address":{"type":"absolute","value":4300124},"name":"_wcscat_s"},{"address":{"type":"absolute","value":4300371},"name":"?get_global_action_nolock@@YAPAP6AXH@ZH@Z"},{"address":{"type":"absolute","value":4300437},"name":"?siglookup@@YAPAU__crt_signal_action_t@@HQAU1@@Z"},{"address":{"type":"absolute","value":4300477},"name":"___acrt_get_sigabrt_handler"},{"address":{"type":"absolute","value":4300500},"name":"___acrt_initialize_signal_handlers"},{"address":{"type":"absolute","value":4300568},"name":"_raise"},{"address":{"type":"absolute","value":4301088},"name":"?"},{"address":{"type":"absolute","value":4301512},"name":"??$copy_and_add_argument_to_buffer@D@@YAHQBD0IAAV?$argument_list@D@?A0xb0e4b824@@@Z"},{"address":{"type":"absolute","value":4301662},"name":"??$expand_argument_wildcards@D@@YAHQAD0AAV?$argument_list@D@?A0xb0e4b824@@@Z"},{"address":{"type":"absolute","value":4302050},"name":"?"},{"address":{"type":"absolute","value":4302140},"name":"?"},{"address":{"type":"absolute","value":4302393},"name":"??R<lambda_ad1ced32f4ac17aa236e5ef05d6b3b7c>@@QBEXXZ"},{"address":{"type":"absolute","value":4302589},"name":"?CPtoLocaleName@@YAPB_WH@Z"},{"address":{"type":"absolute","value":4302651},"name":"?getSystemCP@@YAHH@Z"},{"address":{"type":"absolute","value":4302766},"name":"?setSBCS@@YAXPAU__crt_multibyte_data@@@Z"},{"address":{"type":"absolute","value":4302867},"name":"?setSBUpLow@@YAXPAU__crt_multibyte_data@@@Z"},{"address":{"type":"absolute","value":4303271},"name":"?setmbcp_internal@@YAHH_N@Z"},{"address":{"type":"absolute","value":4303528},"name":"___acrt_initialize_multibyte"},{"address":{"type":"absolute","value":4303558},"name":"___acrt_update_thread_multibyte_data"},{"address":{"type":"absolute","value":4303720},"name":"__setmbcp_nolock"},{"address":{"type":"absolute","value":4304217},"name":"?x_ismbbtype_l@@YAHPAU__crt_locale_pointers@@IHH@Z"},{"address":{"type":"absolute","value":4304306},"name":"__ismbblead"},{"address":{"type":"absolute","value":4304330},"name":"___acrt_initialize_command_line"},{"address":{"type":"absolute","value":4304355},"name":"?find_end_of_double_null_terminated_sequence@@YAPB_WQB_W@Z"},{"address":{"type":"absolute","value":4304410},"name":"___dcrt_get_narrow_environment_from_os"},{"address":{"type":"absolute","value":4305112},"name":"??$copy_environment@D@@YAPAPADQAPAD@Z"},{"address":{"type":"absolute","value":4305289},"name":"??$find_in_environment_nolock@D@@YAHQBDI@Z"},{"address":{"type":"absolute","value":4305384},"name":"___acrt_initialize_heap"},{"address":{"type":"absolute","value":4305411},"name":"___acrt_execute_initializers"},{"address":{"type":"absolute","value":4305542},"name":"___acrt_execute_uninitializers"},{"address":{"type":"absolute","value":4305835},"name":"___acrt_lowio_create_handle_array"},{"address":{"type":"absolute","value":4305957},"name":"___acrt_lowio_destroy_handle_array"},{"address":{"type":"absolute","value":4306010},"name":"___acrt_lowio_ensure_fh_exists"},{"address":{"type":"absolute","value":4306197},"name":"___acrt_lowio_set_os_handle"},{"address":{"type":"absolute","value":4306380},"name":"__alloc_osfhnd"},{"address":{"type":"absolute","value":4306654},"name":"__free_osfhnd"},{"address":{"type":"absolute","value":4306799},"name":"__get_osfhandle"},{"address":{"type":"absolute","value":4306905},"name":"___acrt_locale_free_monetary"},{"address":{"type":"absolute","value":4307159},"name":"___acrt_locale_initialize_monetary"},{"address":{"type":"absolute","value":4308115},"name":"___acrt_locale_free_numeric"},{"address":{"type":"absolute","value":4308220},"name":"___acrt_locale_initialize_numeric"},{"address":{"type":"absolute","value":4308760},"name":"?free_crt_array_internal@@YAXQAPBXI@Z"},{"address":{"type":"absolute","value":4308820},"name":"?initialize_lc_time@@YA_NQAU__crt_lc_time_data@@QAU__crt_locale_data@@@Z"},{"address":{"type":"absolute","value":4309457},"name":"___acrt_locale_free_time"},{"address":{"type":"absolute","value":4309685},"name":"___acrt_locale_initialize_time"},{"address":{"type":"absolute","value":4309812},"name":"_wcscspn"},{"address":{"type":"absolute","value":4309892},"name":"_wcspbrk"},{"address":{"type":"absolute","value":4309961},"name":"___acrt_GetStringTypeA"},{"address":{"type":"absolute","value":4310246},"name":"___acrt_add_locale_ref"},{"address":{"type":"absolute","value":4310371},"name":"___acrt_free_locale"},{"address":{"type":"absolute","value":4310701},"name":"___acrt_locale_add_lc_time_reference"},{"address":{"type":"absolute","value":4310742},"name":"___acrt_locale_free_lc_time_if_unreferenced"},{"address":{"type":"absolute","value":4310790},"name":"___acrt_locale_release_lc_time_reference"},{"address":{"type":"absolute","value":4310831},"name":"___acrt_release_locale_ref"},{"address":{"type":"absolute","value":4310960},"name":"___acrt_update_thread_locale_data"},{"address":{"type":"absolute","value":4311079},"name":"__updatetlocinfoEx_nolock"},{"address":{"type":"absolute","value":4311159},"name":"_GetLocaleNameFromDefault"},{"address":{"type":"absolute","value":4311296},"name":"_GetLocaleNameFromLangCountry"},{"address":{"type":"absolute","value":4311450},"name":"_GetLocaleNameFromLanguage"},{"address":{"type":"absolute","value":4311541},"name":"_GetPrimaryLen"},{"address":{"type":"absolute","value":4311593},"name":"_LangCountryEnumProcEx@12"},{"address":{"type":"absolute","value":4312339},"name":"_LanguageEnumProcEx@12"},{"address":{"type":"absolute","value":4312532},"name":"_ProcessCodePage"},{"address":{"type":"absolute","value":4312763},"name":"_TestDefaultCountry"},{"address":{"type":"absolute","value":4312838},"name":"_TranslateName"},{"address":{"type":"absolute","value":4312949},"name":"___acrt_get_qualified_locale"},{"address":{"type":"absolute","value":4313412},"name":"_CountryEnumProc@4"},{"address":{"type":"absolute","value":4313581},"name":"_GetLcidFromCountry"},{"address":{"type":"absolute","value":4313656},"name":"_GetLcidFromLangCountry"},{"address":{"type":"absolute","value":4313811},"name":"_GetLcidFromLanguage"},{"address":{"type":"absolute","value":4313908},"name":"_GetPrimaryLen"},{"address":{"type":"absolute","value":4313952},"name":"_LangCountryEnumProc@4"},{"address":{"type":"absolute","value":4314544},"name":"_LanguageEnumProc@4"},{"address":{"type":"absolute","value":4314760},"name":"_LcidFromHexString"},{"address":{"type":"absolute","value":4314841},"name":"_ProcessCodePage"},{"address":{"type":"absolute","value":4315068},"name":"_TestDefaultCountry"},{"address":{"type":"absolute","value":4315104},"name":"_TestDefaultLanguage"},{"address":{"type":"absolute","value":4315216},"name":"_TranslateName"},{"address":{"type":"absolute","value":4315309},"name":"___acrt_get_qualified_locale_downlevel"},{"address":{"type":"absolute","value":4315828},"name":"___hw_cw_sse2"},{"address":{"type":"absolute","value":4315999},"name":"__control87"},{"address":{"type":"absolute","value":4316769},"name":"__hw_cw"},{"address":{"type":"absolute","value":4316922},"name":"__errcode"},{"address":{"type":"absolute","value":4316974},"name":"__except1"},{"address":{"type":"absolute","value":4317180},"name":"__handle_exc"},{"address":{"type":"absolute","value":4317660},"name":"__raise_exc"},{"address":{"type":"absolute","value":4317695},"name":"__raise_exc_ex"},{"address":{"type":"absolute","value":4318448},"name":"__set_errno_from_matherr"},{"address":{"type":"absolute","value":4318495},"name":"__umatherr"},{"address":{"type":"absolute","value":4318657},"name":"__decomp"},{"address":{"type":"absolute","value":4318869},"name":"__set_exp"},{"address":{"type":"absolute","value":4318916},"name":"__sptype"},{"address":{"type":"absolute","value":4319010},"name":"___set_fpsr_sse2"},{"address":{"type":"absolute","value":4319128},"name":"__clrfp"},{"address":{"type":"absolute","value":4319147},"name":"__ctrlfp"},{"address":{"type":"absolute","value":4319191},"name":"__set_statfp"},{"address":{"type":"absolute","value":4319282},"name":"__statfp"},{"address":{"type":"absolute","value":4319300},"name":"__fpclass"},{"address":{"type":"absolute","value":4319464},"name":"?_wcstombs_l_helper@@YAIPADPB_WIPAU__crt_locale_pointers@@@Z"},{"address":{"type":"absolute","value":4320105},"name":"__wcstombs_s_l"},{"address":{"type":"absolute","value":4320336},"name":"__CIpow_pentium4"},{"address":{"type":"absolute","value":4320361},"name":"__pow_pentium4"},{"address":{"type":"absolute","value":4323696},"name":"__trandisp1"},{"address":{"type":"absolute","value":4323822},"name":"cwdefault"},{"address":{"type":"absolute","value":4323975},"name":"dont_change_zerosign"},{"address":{"type":"absolute","value":4324012},"name":"_tossnan1"},{"address":{"type":"absolute","value":4324058},"name":"_tossnan2"},{"address":{"type":"absolute","value":4324121},"name":"_snan2"},{"address":{"type":"absolute","value":4324157},"name":"retj"},{"address":{"type":"absolute","value":4324176},"name":"dont_change_sign"},{"address":{"type":"absolute","value":4324195},"name":"chsifnegret"},{"address":{"type":"absolute","value":4324208},"name":"__startTwoArgErrorHandling"},{"address":{"type":"absolute","value":4324231},"name":"__startOneArgErrorHandling"},{"address":{"type":"absolute","value":4324700},"name":"__d_inttype"},{"address":{"type":"absolute","value":4324806},"name":"__powhlp"},{"address":{"type":"absolute","value":4325105},"name":"?InternalGetLocaleInfoA@@YAHQAU__crt_locale_pointers@@QB_WKQADH@Z"},{"address":{"type":"absolute","value":4325356},"name":"___acrt_GetLocaleInfoA"},{"address":{"type":"absolute","value":4325790},"name":"__wcsicmp"},{"address":{"type":"absolute","value":4325939},"name":"__wcsicmp_l"},{"address":{"type":"absolute","value":4326163},"name":"__isatty"},{"address":{"type":"absolute","value":4326249},"name":"?GetTableIndexFromLocaleName@@YAHPB_W@Z"},{"address":{"type":"absolute","value":4326437},"name":"___acrt_DownlevelLCIDToLocaleName"},{"address":{"type":"absolute","value":4326607},"name":"___acrt_DownlevelLocaleNameToLCID"},{"address":{"type":"absolute","value":4326651},"name":"__wcsnicmp"},{"address":{"type":"absolute","value":4326835},"name":"__wcsnicmp_l"},{"address":{"type":"absolute","value":4327296},"name":"?configure_text_mode@@YAHHUfile_options@?A0x704126de@@HAAW4__crt_lowio_text_mode@@@Z"},{"address":{"type":"absolute","value":4327885},"name":"?"},{"address":{"type":"absolute","value":4327922},"name":"?decode_open_create_flags@@YAKH@Z"},{"address":{"type":"absolute","value":4328034},"name":"?"},{"address":{"type":"absolute","value":4328414},"name":"?truncate_ctrl_z_if_present@@YAHH@Z"},{"address":{"type":"absolute","value":4328590},"name":"__sopen_nolock"},{"address":{"type":"absolute","value":4328703},"name":"__wsopen_nolock"},{"address":{"type":"absolute","value":4329512},"name":"__putwch_nolock"},{"address":{"type":"absolute","value":4329581},"name":"?InternalCompareStringA@@YAHPAU__crt_locale_pointers@@PB_WKPBDH2HH@Z"},{"address":{"type":"absolute","value":4330261},"name":"___acrt_CompareStringA"},{"address":{"type":"absolute","value":4330528},"name":"?shortsort@@YAXPAD0IP6AHPBX1@Z@Z"},{"address":{"type":"absolute","value":4330688},"name":"?swap@@YAXPAD0I@Z"},{"address":{"type":"absolute","value":4330752},"name":"_qsort"},{"address":{"type":"absolute","value":4331680},"name":"_strpbrk"},{"address":{"type":"absolute","value":4331744},"name":"__mbsdec"},{"address":{"type":"absolute","value":4331767},"name":"__mbsdec_l"},{"address":{"type":"absolute","value":4331908},"name":"?initialize_multibyte@@YAHXZ"},{"address":{"type":"absolute","value":4331923},"name":"___libm_error_support"},{"address":{"type":"absolute","value":4332459},"name":"__87except"},{"address":{"type":"absolute","value":4332726},"name":"__frnd"},{"address":{"type":"absolute","value":4332748},"name":"__towlower_l"},{"address":{"type":"absolute","value":4333597},"name":"__chsize_nolock"},{"address":{"type":"absolute","value":4334052},"name":"___acrt_LCMapStringW"},{"address":{"type":"absolute","value":4334128},"name":"__CIlog10_pentium4"},{"address":{"type":"absolute","value":4334158},"name":"start"},{"address":{"type":"absolute","value":4334784},"name":"__ceil_default"},{"address":{"type":"absolute","value":4334969},"name":"??0MultiWaitBlock@details@Concurrency@@QAE@I_N0@Z"},{"address":{"type":"absolute","value":4335029},"name":"??0MultiWaitBlockHolder@details@Concurrency@@QAE@_NI00@Z"},{"address":{"type":"absolute","value":4335164},"name":"??0TimedSingleWaitBlock@details@Concurrency@@QAE@_N@Z"},{"address":{"type":"absolute","value":4335211},"name":"??0WaitAnyBlock@details@Concurrency@@QAE@I_N0@Z"},{"address":{"type":"absolute","value":4335251},"name":"??0WaitBlock@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335312},"name":"??0event@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335361},"name":"??1MultiWaitBlockHolder@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335391},"name":"??1_Condition_variable@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335467},"name":"??1event@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4335641},"name":"?Destroy@EventWaitNode@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4335667},"name":"?Destroy@TimedSingleWaitBlock@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4335692},"name":"?Destroy@WaitAllBlock@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4335697},"name":"?DispatchEventTimer@MultiWaitBlock@details@Concurrency@@SGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4335791},"name":"?DispatchEventTimer@TimedSingleWaitBlock@details@Concurrency@@SGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4335842},"name":"?DispatchEventTimerXP@MultiWaitBlock@details@Concurrency@@SGXPAXE@Z"},{"address":{"type":"absolute","value":4335930},"name":"?DispatchEventTimerXP@TimedSingleWaitBlock@details@Concurrency@@SGXPAXE@Z"},{"address":{"type":"absolute","value":4335964},"name":"?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ"},{"address":{"type":"absolute","value":4336112},"name":"?NotifyCompletedNode@MultiWaitBlock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4336137},"name":"?Reset@WaitAllBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4336194},"name":"?Satisfy@EventWaitNode@details@Concurrency@@QAE_NPAPAVContext@3@@Z"},{"address":{"type":"absolute","value":4336228},"name":"?Satisfy@SingleWaitBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336318},"name":"?Satisfy@TimedSingleWaitBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336407},"name":"?Satisfy@WaitAllBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336478},"name":"?Satisfy@WaitAnyBlock@details@Concurrency@@UAE_NPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336545},"name":"?Set@StructuredEvent@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4336617},"name":"?SingleSatisfy@MultiWaitBlock@details@Concurrency@@MAEXPAPAVContext@3@PAVEventWaitNode@23@@Z"},{"address":{"type":"absolute","value":4336793},"name":"?Sweep@details@Concurrency@@YAPAVEventWaitNode@12@PAV312@_N@Z"},{"address":{"type":"absolute","value":4336851},"name":"?SweepResetNode@EventWaitNode@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4336876},"name":"?SweepResetNode@WaitAllBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4336927},"name":"?SweepWaitNode@EventWaitNode@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4336952},"name":"?SweepWaitNode@TimedSingleWaitBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4336988},"name":"?SweepWaitNode@WaitAllBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4337055},"name":"?SweepWaitNode@WaitAnyBlock@details@Concurrency@@UAE_NXZ"},{"address":{"type":"absolute","value":4337109},"name":"?"},{"address":{"type":"absolute","value":4337156},"name":"?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4337186},"name":"?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4337217},"name":"?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4337354},"name":"?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4337473},"name":"?createTimer@TimedSingleWaitBlock@details@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4337572},"name":"?destroyTimer@TimedSingleWaitBlock@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4337648},"name":"?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4337887},"name":"?set@event@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4338174},"name":"?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z"},{"address":{"type":"absolute","value":4338274},"name":"?wait@event@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4338494},"name":"?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z"},{"address":{"type":"absolute","value":4338726},"name":"?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z"},{"address":{"type":"absolute","value":4339464},"name":"??0LockQueueNode@details@Concurrency@@QAE@I@Z"},{"address":{"type":"absolute","value":4339628},"name":"?"},{"address":{"type":"absolute","value":4339649},"name":"??0_ReaderWriterLock@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4339665},"name":"??0critical_section@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4339724},"name":"?"},{"address":{"type":"absolute","value":4339828},"name":"?Block@LockQueueNode@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4339962},"name":"?CurrentContext@SchedulerBase@details@Concurrency@@SAPAVContextBase@23@XZ"},{"address":{"type":"absolute","value":4339996},"name":"?DerefTimerNode@LockQueueNode@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340027},"name":"?DispatchNodeTimeoutTimer@LockQueueNode@details@Concurrency@@SGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4340098},"name":"?DispatchNodeTimeoutTimerXP@LockQueueNode@details@Concurrency@@SGXPAXE@Z"},{"address":{"type":"absolute","value":4340175},"name":"?TryCompensateTimer@LockQueueNode@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340212},"name":"?Unblock@LockQueueNode@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4340262},"name":"?UpdateQueuePosition@LockQueueNode@details@Concurrency@@QAEXPAV123@@Z"},{"address":{"type":"absolute","value":4340366},"name":"?WaitForNextNode@LockQueueNode@details@Concurrency@@QAEPAV123@XZ"},{"address":{"type":"absolute","value":4340417},"name":"?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340465},"name":"?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340511},"name":"?_Acquire_lock@critical_section@Concurrency@@QAE_NPAX_N@Z"},{"address":{"type":"absolute","value":4340666},"name":"?_FlushWriteOwners@_ReaderWriterLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340688},"name":"?_Flush_current_owner@critical_section@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4340712},"name":"?_Initialize@_SpinCount@details@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4340747},"name":"?"},{"address":{"type":"absolute","value":4340758},"name":"?_Switch_to_active@critical_section@Concurrency@@AAEXPAX@Z"},{"address":{"type":"absolute","value":4340837},"name":"?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4340866},"name":"?_WaitEquals@_ReaderWriterLock@details@Concurrency@@CAXADJJJ@Z"},{"address":{"type":"absolute","value":4340927},"name":"?lock@critical_section@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4341142},"name":"?unlock@critical_section@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4341328},"name":"??1WaiterThreadPool@platform@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4341362},"name":"?"},{"address":{"type":"absolute","value":4341407},"name":"?InitializeSystemFunctionPointers@platform@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4341621},"name":"?__CreateAutoResetEvent@platform@details@Concurrency@@YAPAX_N@Z"},{"address":{"type":"absolute","value":4341728},"name":"?__CreateTimerQueueTimer@platform@details@Concurrency@@YAHPAPAXPAXP6GX1E@Z1KKK@Z"},{"address":{"type":"absolute","value":4341760},"name":"?__DeleteTimerQueueTimer@platform@details@Concurrency@@YAXPAX00@Z"},{"address":{"type":"absolute","value":4341841},"name":"?__GetLogicalProcessorInformation@platform@details@Concurrency@@YAPAU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@PAK@Z"},{"address":{"type":"absolute","value":4341976},"name":"?__GetLogicalProcessorInformationEx@platform@details@Concurrency@@YAPAU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@W4_LOGICAL_PROCESSOR_RELATIONSHIP@@PAK@Z"},{"address":{"type":"absolute","value":4342156},"name":"?__GetNumaHighestNodeNumber@platform@details@Concurrency@@YAKXZ"},{"address":{"type":"absolute","value":4342223},"name":"?__GetThreadGroupAffinity@platform@details@Concurrency@@YAHPAXPAU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4342331},"name":"?__InitializeCriticalSectionEx@platform@details@Concurrency@@YAHPAU_RTL_CRITICAL_SECTION@@K@Z"},{"address":{"type":"absolute","value":4342352},"name":"?__RegisterWaitForSingleObject@platform@details@Concurrency@@YAPAXPAXP6GX0E@Z0@Z"},{"address":{"type":"absolute","value":4342432},"name":"?__SetThreadGroupAffinity@platform@details@Concurrency@@YAHPAXPBU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4342609},"name":"?__TlsAlloc@platform@details@Concurrency@@YAKXZ"},{"address":{"type":"absolute","value":4342797},"name":"?notify@WaiterThread@platform@details@Concurrency@@AAEX_N@Z"},{"address":{"type":"absolute","value":4342863},"name":"?"},{"address":{"type":"absolute","value":4342876},"name":"?DeleteAsyncTimerAndUnloadLibrary@details@Concurrency@@YAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4342936},"name":"?FreeLibraryAndDestroyThread@details@Concurrency@@YAXK@Z"},{"address":{"type":"absolute","value":4342978},"name":"?InitializeCookie@Security@details@Concurrency@@SAKXZ"},{"address":{"type":"absolute","value":4343054},"name":"?LoadLibraryAndCreateThread@details@Concurrency@@YAPAXPAU_SECURITY_ATTRIBUTES@@KP6GKPAX@Z1KPAK@Z"},{"address":{"type":"absolute","value":4343124},"name":"?ReferenceLoadLibrary@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4343272},"name":"?RegisterAsyncTimerAndLoadLibrary@details@Concurrency@@YAPAU_TP_TIMER@@KP6GXPAU_TP_CALLBACK_INSTANCE@@PAXPAU3@@Z1_N@Z"},{"address":{"type":"absolute","value":4343367},"name":"?RegisterAsyncWaitAndLoadLibrary@details@Concurrency@@YAPAU_TP_WAIT@@PAXP6GXPAU_TP_CALLBACK_INSTANCE@@0PAU3@K@Z0@Z"},{"address":{"type":"absolute","value":4343424},"name":"?UnRegisterAsyncTimerAndUnloadLibrary@details@Concurrency@@YAXPAU_TP_CALLBACK_INSTANCE@@PAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4343478},"name":"?UnRegisterAsyncWaitAndUnloadLibrary@details@Concurrency@@YAXPAU_TP_CALLBACK_INSTANCE@@PAU_TP_WAIT@@@Z"},{"address":{"type":"absolute","value":4343547},"name":"?_Acquire@_NonReentrantLock@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4343648},"name":"?_TryAcquire@_NonReentrantLock@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4343669},"name":"?_UnderlyingYield@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4343708},"name":"?Block@Context@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4343737},"name":"?CurrentContext@Context@Concurrency@@SAPAV12@XZ"},{"address":{"type":"absolute","value":4343742},"name":"??0HardwareAffinity@details@Concurrency@@QAE@PAX@Z"},{"address":{"type":"absolute","value":4343775},"name":"??0ResourceManager@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4344003},"name":"??0SchedulerCore@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4344085},"name":"??1GlobalNode@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4344098},"name":"??1ResourceManager@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4344372},"name":"??_EGlobalNode@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4344506},"name":"??_GAffinityRestriction@ResourceManager@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4344547},"name":"?AddTail@?$List@VSchedulerProxy@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4344604},"name":"?AdjustDynamicAllocation@ResourceManager@details@Concurrency@@AAEIIII@Z"},{"address":{"type":"absolute","value":4344812},"name":"?ApplyAffinityLimits@AffinityRestriction@ResourceManager@details@Concurrency@@QAEXPAU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4344847},"name":"?ApplyAffinityRestrictions@ResourceManager@details@Concurrency@@CAXPAK@Z"},{"address":{"type":"absolute","value":4344890},"name":"?ApplyAffinityRestrictions@ResourceManager@details@Concurrency@@CAXPAU_GROUP_AFFINITY@@@Z"},{"address":{"type":"absolute","value":4344929},"name":"?ApplyTo@HardwareAffinity@details@Concurrency@@QAEXPAX@Z"},{"address":{"type":"absolute","value":4344947},"name":"?CaptureProcessAffinity@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4345240},"name":"?CleanupTopologyInformation@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4345267},"name":"?CommitStolenCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4345536},"name":"?ComputeDesiredHWThreadsWithExternalThread@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4345571},"name":"?ComputeMinHWThreadsWithExternalThread@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4345616},"name":"?CreateAllocatedNodeData@ResourceManager@details@Concurrency@@QAEPAUSchedulerNode@23@XZ"},{"address":{"type":"absolute","value":4345927},"name":"?CreateDynamicRMWorker@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4346030},"name":"?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4346275},"name":"?CurrentSubscriptionLevel@ResourceManager@details@Concurrency@@QAEIII@Z"},{"address":{"type":"absolute","value":4346381},"name":"?DesiredHWThreads@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4346406},"name":"?DestroyAllocatedNodeData@ResourceManager@details@Concurrency@@QAEXPAUSchedulerNode@23@@Z"},{"address":{"type":"absolute","value":4346464},"name":"?DetermineTopology@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4347250},"name":"?DiscardExistingSchedulerStatistics@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4347357},"name":"?DistributeCoresToSurvivingScheduler@ResourceManager@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4347766},"name":"?DistributeExclusiveCores@ResourceManager@details@Concurrency@@AAEXIIIII@Z"},{"address":{"type":"absolute","value":4348083},"name":"?DistributeIdleCores@ResourceManager@details@Concurrency@@AAEXII@Z"},{"address":{"type":"absolute","value":4348486},"name":"?DoCoreMigration@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4349054},"name":"?DynamicAssignCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@II_N@Z"},{"address":{"type":"absolute","value":4349163},"name":"?DynamicMigrateCores@ResourceManager@details@Concurrency@@AAEXPAUDynamicAllocationData@23@PAVSchedulerProxy@23@II@Z"},{"address":{"type":"absolute","value":4349517},"name":"?DynamicRMThreadProc@ResourceManager@details@Concurrency@@CGKPAX@Z"},{"address":{"type":"absolute","value":4349542},"name":"?DynamicResourceManager@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4349798},"name":"?FindBestFitExclusiveAllocation@ResourceManager@details@Concurrency@@AAEIAAI0PAUDynamicAllocationData@23@II@Z"},{"address":{"type":"absolute","value":4350636},"name":"?FindBestFitIdleAllocation@ResourceManager@details@Concurrency@@AAEIIPAUDynamicAllocationData@23@I@Z"},{"address":{"type":"absolute","value":4350918},"name":"?FindCoreForPartiallyFilledNode@ResourceManager@details@Concurrency@@AAE_NAAI0PAUDynamicAllocationData@23@I@Z"},{"address":{"type":"absolute","value":4351183},"name":"?FindGroupAffinity@AffinityRestriction@ResourceManager@details@Concurrency@@QAEPAUHardwareAffinity@34@G@Z"},{"address":{"type":"absolute","value":4351235},"name":"?FlushStoreBuffers@ResourceManager@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4351362},"name":"?GetCurrentNodeAndCore@ResourceManager@details@Concurrency@@QAEIPAI@Z"},{"address":{"type":"absolute","value":4351632},"name":"?"},{"address":{"type":"absolute","value":4351639},"name":"?GetFirstExecutionResource@TopologyObject@GlobalNode@details@Concurrency@@UBEPAUITopologyExecutionResource@4@XZ"},{"address":{"type":"absolute","value":4351649},"name":"?GetFirstNode@ResourceManager@details@Concurrency@@UBEPAUITopologyNode@3@XZ"},{"address":{"type":"absolute","value":4351656},"name":"?GetId@TopologyObject@GlobalNode@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4351663},"name":"?GetNext@TopologyObject@GlobalCore@details@Concurrency@@UBEPAUITopologyExecutionResource@4@XZ"},{"address":{"type":"absolute","value":4351686},"name":"?GetNext@TopologyObject@GlobalNode@details@Concurrency@@UBEPAUITopologyNode@4@XZ"},{"address":{"type":"absolute","value":4351709},"name":"?GetNextGlobalCore@GlobalNode@details@Concurrency@@QAEPAUGlobalCore@23@PBU423@@Z"},{"address":{"type":"absolute","value":4351746},"name":"?GetNextGlobalNode@ResourceManager@details@Concurrency@@QAEPAUGlobalNode@23@PBU423@@Z"},{"address":{"type":"absolute","value":4351858},"name":"?GetNumaNode@TopologyObject@GlobalNode@details@Concurrency@@UBEKXZ"},{"address":{"type":"absolute","value":4351893},"name":"?GetTopologyInformation@ResourceManager@details@Concurrency@@CAXW4_LOGICAL_PROCESSOR_RELATIONSHIP@@@Z"},{"address":{"type":"absolute","value":4351934},"name":"?HandleBorrowedCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@PAUAllocationData@23@@Z"},{"address":{"type":"absolute","value":4352219},"name":"?HandleSharedCores@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@PAUDynamicAllocationData@23@@Z"},{"address":{"type":"absolute","value":4352547},"name":"?IncreaseFullyLoadedSchedulerAllocations@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4352601},"name":"?Initialize@GlobalCore@details@Concurrency@@QAEXPAUGlobalNode@23@IE@Z"},{"address":{"type":"absolute","value":4352662},"name":"?Initialize@GlobalNode@details@Concurrency@@QAEXPAVResourceManager@23@GGKII@Z"},{"address":{"type":"absolute","value":4352937},"name":"?InitializeRMBuffers@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4353131},"name":"?InitializeSystemInformation@ResourceManager@details@Concurrency@@CAX_N@Z"},{"address":{"type":"absolute","value":4353687},"name":"?MinVprocHWThreads@SchedulerProxy@details@Concurrency@@QBEIXZ"},{"address":{"type":"absolute","value":4353712},"name":"?PerformAllocation@ResourceManager@details@Concurrency@@QAEPAVExecutionResource@23@PAVSchedulerProxy@23@_N1@Z"},{"address":{"type":"absolute","value":4354054},"name":"?PopulateCommonAllocationData@ResourceManager@details@Concurrency@@AAEXIPAVSchedulerProxy@23@PAUAllocationData@23@@Z"},{"address":{"type":"absolute","value":4354252},"name":"?PopulateDynamicAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4354527},"name":"?PreProcessDynamicAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4354726},"name":"?PreProcessStaticAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4354773},"name":"?PrepareReceiversForCoreTransfer@ResourceManager@details@Concurrency@@AAEII@Z"},{"address":{"type":"absolute","value":4355303},"name":"?RedistributeCoresAmongAll@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@III@Z"},{"address":{"type":"absolute","value":4356283},"name":"?"},{"address":{"type":"absolute","value":4356293},"name":"?RegisterScheduler@ResourceManager@details@Concurrency@@UAEPAUISchedulerProxy@3@PAUIScheduler@3@I@Z"},{"address":{"type":"absolute","value":4356361},"name":"?Release@ResourceManager@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4356532},"name":"?ReleaseCoresOnExistingSchedulers@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@II@Z"},{"address":{"type":"absolute","value":4356617},"name":"?ReleaseSchedulerResources@ResourceManager@details@Concurrency@@AAE_NPAVSchedulerProxy@23@0I@Z"},{"address":{"type":"absolute","value":4356861},"name":"?Remove@?$List@VSchedulerProxy@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4356915},"name":"?RemoveExecutionResource@ResourceManager@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4357034},"name":"?RequestInitialVirtualProcessors@ResourceManager@details@Concurrency@@QAEPAUIExecutionResource@3@PAVSchedulerProxy@23@_N@Z"},{"address":{"type":"absolute","value":4357311},"name":"?ReserveAtHigherUseCounts@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@I@Z"},{"address":{"type":"absolute","value":4357363},"name":"?ReserveCores@ResourceManager@details@Concurrency@@AAEIPAVSchedulerProxy@23@II@Z"},{"address":{"type":"absolute","value":4357838},"name":"?ResetGlobalAllocationData@ResourceManager@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4357925},"name":"?RetrieveSystemVersionInformation@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4358163},"name":"?RoundUpScaledAllocations@ResourceManager@details@Concurrency@@CAXPAPAUAllocationData@23@II@Z"},{"address":{"type":"absolute","value":4358603},"name":"?SafeReference@ResourceManager@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4358634},"name":"?SendResourceNotifications@ResourceManager@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4359111},"name":"?SetupStaticAllocationData@ResourceManager@details@Concurrency@@AAEXPAVSchedulerProxy@23@_N@Z"},{"address":{"type":"absolute","value":4359318},"name":"?Shutdown@ResourceManager@details@Concurrency@@QAEXPAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4359528},"name":"?SubscribeCurrentThread@ResourceManager@details@Concurrency@@QAEPAVExecutionResource@23@PAVSchedulerProxy@23@@Z"},{"address":{"type":"absolute","value":4359612},"name":"?ToggleRMIdleState@ResourceManager@details@Concurrency@@AAEXPAUSchedulerNode@23@PAUSchedulerCore@23@PAUGlobalNode@23@PAUGlobalCore@23@PAUAllocationData@23@@Z"},{"address":{"type":"absolute","value":4359717},"name":"?Version@ResourceManager@details@Concurrency@@SA?AW4OSVersion@IResourceManager@3@XZ"},{"address":{"type":"absolute","value":4359790},"name":"??$_InternalDeleteHelper@VExternalContextBase@details@Concurrency@@@details@Concurrency@@YAXPAVExternalContextBase@01@@Z"},{"address":{"type":"absolute","value":4359825},"name":"??$_InternalDeleteHelper@VInternalContextBase@details@Concurrency@@@details@Concurrency@@YAXPAVInternalContextBase@01@@Z"},{"address":{"type":"absolute","value":4359862},"name":"??$_InternalDeleteHelper@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@YAXPAVScheduleGroupBase@01@@Z"},{"address":{"type":"absolute","value":4359897},"name":"?"},{"address":{"type":"absolute","value":4359959},"name":"?"},{"address":{"type":"absolute","value":4360318},"name":"??0NumaInformation@SchedulerBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4360342},"name":"??0QuickBitSet@details@Concurrency@@QAE@I@Z"},{"address":{"type":"absolute","value":4360412},"name":"??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4361283},"name":"??1?$ListArray@VExternalStatistics@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361405},"name":"??1?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361524},"name":"??1NumaInformation@SchedulerBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361557},"name":"??1ReferenceCountedQuickBitSet@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4361594},"name":"??1SchedulerBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4361833},"name":"?"},{"address":{"type":"absolute","value":4361905},"name":"??_ENumaInformation@SchedulerBase@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4362034},"name":"?"},{"address":{"type":"absolute","value":4362069},"name":"?"},{"address":{"type":"absolute","value":4362246},"name":"??_GSchedulerBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4362283},"name":"??_GSubAllocator@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4362414},"name":"?Add@?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@QAEHPAVScheduleGroupBase@23@@Z"},{"address":{"type":"absolute","value":4362768},"name":"?AddContext@SchedulerBase@details@Concurrency@@QAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4362817},"name":"?AddHead@?$List@UBoostedObject@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUBoostedObject@23@@Z"},{"address":{"type":"absolute","value":4362869},"name":"?AddTail@?$List@VWaitNode@SchedulerBase@details@Concurrency@@VNoCount@CollectionTypes@34@@details@Concurrency@@QAEXPAVWaitNode@SchedulerBase@23@@Z"},{"address":{"type":"absolute","value":4363150},"name":"?AllocateSegment@CacheLocalScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4363209},"name":"?AllocateSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4363285},"name":"?Attach@SchedulerBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4363355},"name":"?AttachExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4363467},"name":"?AttemptSchedulerSweep@SchedulerBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4363502},"name":"?CancelAllContexts@SchedulerBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4363564},"name":"?ChangeThrottlingTimer@SchedulerBase@details@Concurrency@@AAEXK@Z"},{"address":{"type":"absolute","value":4363770},"name":"?CheckOneShotStaticDestruction@SchedulerBase@details@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4363808},"name":"?CheckStaticConstruction@SchedulerBase@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4363909},"name":"?Cleanup@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4364088},"name":"?CommitSafePoints@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4364155},"name":"?CommitToVersion@SchedulerBase@details@Concurrency@@AAEXK@Z"},{"address":{"type":"absolute","value":4364306},"name":"?ComputeSafePointCommitVersion@SchedulerBase@details@Concurrency@@AAEKXZ"},{"address":{"type":"absolute","value":4364443},"name":"?CopyFrom@QuickBitSet@details@Concurrency@@IAEXABV123@@Z"},{"address":{"type":"absolute","value":4364558},"name":"?CreateScheduleGroup@SchedulerBase@details@Concurrency@@UAEPAVScheduleGroup@3@XZ"},{"address":{"type":"absolute","value":4364589},"name":"?CreateWithoutInitializing@SchedulerBase@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z"},{"address":{"type":"absolute","value":4364627},"name":"?DecrementInternalContextCount@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4364652},"name":"?DeferredGetInternalContext@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4364682},"name":"?DeleteElements@?$ListArray@VExternalStatistics@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4364715},"name":"?DeleteElements@?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4364745},"name":"?Dequeue@?$SQueue@VInternalContextBase@details@Concurrency@@@details@Concurrency@@QAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4364774},"name":"?"},{"address":{"type":"absolute","value":4364852},"name":"?DestroySchedulerEventHandlers@SchedulerBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4364927},"name":"?DetachExternalContext@SchedulerBase@details@Concurrency@@AAEXPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4365006},"name":"?FastCurrentScheduler@SchedulerBase@details@Concurrency@@SAPAV123@XZ"},{"address":{"type":"absolute","value":4365032},"name":"?Fill@QuickBitSet@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4365061},"name":"?Finalize@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4365413},"name":"?FindCurrentNode@SchedulerBase@details@Concurrency@@QAEPAVSchedulingNode@23@XZ"},{"address":{"type":"absolute","value":4365478},"name":"?FindNodeByLocation@SchedulerBase@details@Concurrency@@QAEPAVSchedulingNode@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4365567},"name":"?FindScheduleGroupSegment@SchedulingRing@details@Concurrency@@AAEPAVScheduleGroupSegmentBase@23@HHPAHPAV?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@23@@Z"},{"address":{"type":"absolute","value":4365610},"name":"?FindVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@HHPAH@Z"},{"address":{"type":"absolute","value":4365657},"name":"?FoundAvailableVirtualProcessor@SchedulerBase@details@Concurrency@@QAE_NAAVClaimTicket@VirtualProcessor@23@Vlocation@3@K@Z"},{"address":{"type":"absolute","value":4365921},"name":"?FoundBlockedContexts@SchedulerBase@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4365963},"name":"?FoundUnstartedChores@SchedulerBase@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4366162},"name":"?GetAnonymousScheduleGroupSegment@SchedulerBase@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@XZ"},{"address":{"type":"absolute","value":4366171},"name":"?GetBitSet@SchedulerBase@details@Concurrency@@QAE?AVQuickBitSet@23@PBVlocation@3@@Z"},{"address":{"type":"absolute","value":4366353},"name":"?GetDefaultScheduler@SchedulerBase@details@Concurrency@@CAPAV123@XZ"},{"address":{"type":"absolute","value":4366510},"name":"?GetExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4366606},"name":"?GetInternalContext@SchedulerBase@details@Concurrency@@QAEPAVInternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4366849},"name":"__catch$?GetInternalContext@SchedulerBase@details@Concurrency@@QAEPAVInternalContextBase@23@_N@Z$0"},{"address":{"type":"absolute","value":4366897},"name":"?GetNewContextId@SchedulerBase@details@Concurrency@@QAEIXZ"},{"address":{"type":"absolute","value":4366910},"name":"?GetNewScheduleGroupId@SchedulerBase@details@Concurrency@@QAEIXZ"},{"address":{"type":"absolute","value":4366936},"name":"?GetNextPriorityObject@SchedulerBase@details@Concurrency@@QAEPAUBoostedObject@23@XZ"},{"address":{"type":"absolute","value":4366989},"name":"?GetNextScheduleGroupSegment@SchedulingRing@details@Concurrency@@AAEPAVScheduleGroupSegmentBase@23@PAHHPAV?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@23@@Z"},{"address":{"type":"absolute","value":4367049},"name":"?GetNextSchedulingRing@SchedulerBase@details@Concurrency@@QAEPAVSchedulingRing@23@PBV423@PAV423@@Z"},{"address":{"type":"absolute","value":4367092},"name":"?GetNextSchedulingRing@SchedulerBase@details@Concurrency@@QAEPAVSchedulingRing@23@XZ"},{"address":{"type":"absolute","value":4367125},"name":"?GetNextValidSchedulingRingIndex@SchedulerBase@details@Concurrency@@AAEHH@Z"},{"address":{"type":"absolute","value":4367159},"name":"?GetNextVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PAHH@Z"},{"address":{"type":"absolute","value":4367216},"name":"?GetPolicy@SchedulerBase@details@Concurrency@@UBE?AVSchedulerPolicy@3@XZ"},{"address":{"type":"absolute","value":4367238},"name":"?GetRealizedChore@SchedulerBase@details@Concurrency@@QAEPAVRealizedChore@23@P6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4367331},"name":"?GetReservedContext@SchedulerBase@details@Concurrency@@QAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4367354},"name":"?"},{"address":{"type":"absolute","value":4367373},"name":"?GetSubAllocator@SchedulerBase@details@Concurrency@@SAPAVSubAllocator@23@_N@Z"},{"address":{"type":"absolute","value":4367501},"name":"?GetValidSchedulingRingIndex@SchedulerBase@details@Concurrency@@AAEHH@Z"},{"address":{"type":"absolute","value":4367536},"name":"?Grow@QuickBitSet@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4367663},"name":"?Grow@ReferenceCountedQuickBitSet@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4367776},"name":"?HasCompletedShutdown@SchedulerBase@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4367795},"name":"?"},{"address":{"type":"absolute","value":4367843},"name":"?Id@SchedulerBase@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4367850},"name":"?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4369051},"name":"?"},{"address":{"type":"absolute","value":4369163},"name":"?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4369361},"name":"?InternalRelease@ScheduleGroupBase@details@Concurrency@@IAEJXZ"},{"address":{"type":"absolute","value":4369419},"name":"?Intersects@QuickBitSet@details@Concurrency@@QBE_NABV123@@Z"},{"address":{"type":"absolute","value":4369479},"name":"?InvokeAtNextSafePoint@SafePointInvocation@details@Concurrency@@QAEXP6AXPAX@Z0PAVSchedulerBase@23@@Z"},{"address":{"type":"absolute","value":4369539},"name":"?InvokeOnSafePoint@SchedulerBase@details@Concurrency@@AAEXPAVSafePointInvocation@23@@Z"},{"address":{"type":"absolute","value":4369607},"name":"?IsActive@ExternalStatistics@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4369635},"name":"?IsAvailableLocation@SchedulerBase@details@Concurrency@@UBE_NABVlocation@3@@Z"},{"address":{"type":"absolute","value":4369687},"name":"?"},{"address":{"type":"absolute","value":4369729},"name":"?MailChore@FairScheduleGroup@details@Concurrency@@UAE?AVSlot@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@23@PAV_UnrealizedChore@23@PAVlocation@3@PAPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4369746},"name":"?MarkSafePoint@SchedulerBase@details@Concurrency@@QAE_NPAVSafePointMarker@23@@Z"},{"address":{"type":"absolute","value":4369780},"name":"?NotifyThrottledContext@SchedulerBase@details@Concurrency@@AAE_NPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4369924},"name":"?OneShotStaticConstruction@SchedulerBase@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4369944},"name":"?OneShotStaticDestruction@SchedulerBase@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4369969},"name":"?PerformServiceScan@SchedulerBase@details@Concurrency@@AAEX_K@Z"},{"address":{"type":"absolute","value":4370421},"name":"?PhaseOneShutdown@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4370539},"name":"?PhaseTwoShutdown@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4370696},"name":"?PublishNewDataVersion@SchedulerBase@details@Concurrency@@AAEKXZ"},{"address":{"type":"absolute","value":4370720},"name":"?Push@?$LockFreePushStack@VContextNode@SchedulerBase@details@Concurrency@@@details@Concurrency@@QAEXPAVContextNode@SchedulerBase@23@@Z"},{"address":{"type":"absolute","value":4370750},"name":"?PushRunnableToInactive@SchedulerBase@details@Concurrency@@UAE_NPAVInternalContextBase@23@Vlocation@3@@Z"},{"address":{"type":"absolute","value":4370859},"name":"?Reallocate@QuickBitSet@details@Concurrency@@IAEXI@Z"},{"address":{"type":"absolute","value":4370914},"name":"?"},{"address":{"type":"absolute","value":4370930},"name":"?Reference@SchedulerBase@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4371042},"name":"?ReferenceForAttach@SchedulerBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4371073},"name":"?RegisterShutdownEvent@SchedulerBase@details@Concurrency@@UAEXPAX@Z"},{"address":{"type":"absolute","value":4371230},"name":"?Release@ScheduleGroupBase@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4371235},"name":"?Release@SchedulerBase@details@Concurrency@@UAEIXZ"},{"address":{"type":"absolute","value":4371259},"name":"?ReleaseExternalContext@SchedulerBase@details@Concurrency@@AAEXPAVExternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4371325},"name":"?ReleaseForDetach@SchedulerBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4371356},"name":"?ReleaseInternalContext@SchedulerBase@details@Concurrency@@QAEXPAVInternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4371430},"name":"?ReleaseRealizedChore@SchedulerBase@details@Concurrency@@QAEXPAVRealizedChore@23@@Z"},{"address":{"type":"absolute","value":4371510},"name":"?ReleaseReservedContexts@SchedulerBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4371616},"name":"?ReleaseSuspendedVirtualProcessors@SchedulerBase@details@Concurrency@@AAEXJ@Z"},{"address":{"type":"absolute","value":4371646},"name":"?Remove@?$List@UBoostedObject@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUBoostedObject@23@@Z"},{"address":{"type":"absolute","value":4371696},"name":"?Remove@?$ListArray@VExternalStatistics@details@Concurrency@@@details@Concurrency@@QAE_NPAVExternalStatistics@23@H_N@Z"},{"address":{"type":"absolute","value":4371945},"name":"?Remove@?$ListArray@VScheduleGroupBase@details@Concurrency@@@details@Concurrency@@QAE_NPAVScheduleGroupBase@23@H_N@Z"},{"address":{"type":"absolute","value":4372194},"name":"?RemoveHead@?$List@UBoostedObject@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEPAUBoostedObject@23@XZ"},{"address":{"type":"absolute","value":4372234},"name":"?RemoveHead@?$List@VWaitNode@SchedulerBase@details@Concurrency@@VNoCount@CollectionTypes@34@@details@Concurrency@@QAEPAVWaitNode@SchedulerBase@23@XZ"},{"address":{"type":"absolute","value":4372322},"name":"?RemovePrioritizedObject@SchedulerBase@details@Concurrency@@QAEXPAUBoostedObject@23@@Z"},{"address":{"type":"absolute","value":4372382},"name":"?RemoveScheduleGroup@SchedulerBase@details@Concurrency@@QAEXPAVScheduleGroupBase@23@@Z"},{"address":{"type":"absolute","value":4372406},"name":"?RemoveSegments@FairScheduleGroup@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4372672},"name":"?Resurrect@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4372743},"name":"?ReturnSubAllocator@SchedulerBase@details@Concurrency@@SAXPAVSubAllocator@23@@Z"},{"address":{"type":"absolute","value":4372808},"name":"?SafeFastCurrentContext@SchedulerBase@details@Concurrency@@SAPAVContextBase@23@XZ"},{"address":{"type":"absolute","value":4372836},"name":"?SafeReference@SchedulerBase@details@Concurrency@@AAE_NXZ"},{"address":{"type":"absolute","value":4372870},"name":"?ScheduleTask@SchedulerBase@details@Concurrency@@UAEXP6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4372951},"name":"?ScheduleTask@SchedulerBase@details@Concurrency@@UAEXP6AXPAX@Z0AAVlocation@3@@Z"},{"address":{"type":"absolute","value":4373012},"name":"?SetNextSchedulingRing@SchedulerBase@details@Concurrency@@QAEXPAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4373049},"name":"?SpinUntilBitsReset@details@Concurrency@@YAJPCJJ@Z"},{"address":{"type":"absolute","value":4373098},"name":"?SpinUntilBitsSet@details@Concurrency@@YAJPCJJ@Z"},{"address":{"type":"absolute","value":4373156},"name":"?StartupNewVirtualProcessor@SchedulerBase@details@Concurrency@@UAEXPAVScheduleGroupSegmentBase@23@Vlocation@3@@Z"},{"address":{"type":"absolute","value":4373194},"name":"?StartupVirtualProcessor@SchedulerBase@details@Concurrency@@QAE_NPAVScheduleGroupSegmentBase@23@Vlocation@3@K@Z"},{"address":{"type":"absolute","value":4373837},"name":"?ThrottlerDispatch@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4374113},"name":"?ThrottlerDispatchBridge@SchedulerBase@details@Concurrency@@CGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_TIMER@@@Z"},{"address":{"type":"absolute","value":4374128},"name":"?"},{"address":{"type":"absolute","value":4374143},"name":"?ThrottlerTrampoline@SchedulerBase@details@Concurrency@@CGXPAXE@Z"},{"address":{"type":"absolute","value":4374202},"name":"?ThrottlingTime@SchedulerBase@details@Concurrency@@QAEKK@Z"},{"address":{"type":"absolute","value":4374353},"name":"?ThrowSchedulerEvent@SchedulerBase@details@Concurrency@@CAXW4ConcRT_EventType@3@EI@Z"},{"address":{"type":"absolute","value":4374460},"name":"?TraceSchedulerEvent@SchedulerBase@details@Concurrency@@AAEXW4ConcRT_EventType@3@EI@Z"},{"address":{"type":"absolute","value":4374502},"name":"?TriggerCommitSafePoints@SchedulerBase@details@Concurrency@@QAEXPAVSafePointMarker@23@@Z"},{"address":{"type":"absolute","value":4374555},"name":"?TypeOfWorkPending@SchedulerBase@details@Concurrency@@MAE?AW4PendingWorkType@123@XZ"},{"address":{"type":"absolute","value":4374601},"name":"?UpdateCommitVersion@SchedulerBase@details@Concurrency@@AAEKK@Z"},{"address":{"type":"absolute","value":4374673},"name":"?UpdatePendingVersion@SchedulerBase@details@Concurrency@@AAEKXZ"},{"address":{"type":"absolute","value":4374723},"name":"?VirtualProcessorActive@SchedulerBase@details@Concurrency@@QAE_N_N@Z"},{"address":{"type":"absolute","value":4374903},"name":"?VirtualProcessorIdle@SchedulerBase@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4374996},"name":"?"},{"address":{"type":"absolute","value":4375073},"name":"?_Assign@location@Concurrency@@QAEXABV12@@Z"},{"address":{"type":"absolute","value":4375418},"name":"??0CancellationBeaconStack@ContextBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4375443},"name":"??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4375653},"name":"?"},{"address":{"type":"absolute","value":4375676},"name":"??1?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4375699},"name":"??1CancellationBeaconStack@ContextBase@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4375766},"name":"??1ContextBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4375812},"name":"?"},{"address":{"type":"absolute","value":4375892},"name":"??8location@Concurrency@@QBE_NABV01@@Z"},{"address":{"type":"absolute","value":4375927},"name":"??ACancellationBeaconStack@ContextBase@details@Concurrency@@QAEPAUCancellationBeacon@123@J@Z"},{"address":{"type":"absolute","value":4376014},"name":"??_GContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4376051},"name":"??_GWorkQueue@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4376095},"name":"?Add@?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@QAEHPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4376449},"name":"?AddStealer@ContextBase@details@Concurrency@@QAEXPAV123@_N@Z"},{"address":{"type":"absolute","value":4376491},"name":"?AddTail@?$List@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUListEntry@23@@Z"},{"address":{"type":"absolute","value":4376590},"name":"?CancelCollection@ContextBase@details@Concurrency@@QAEXH@Z"},{"address":{"type":"absolute","value":4376693},"name":"?CancelCollectionComplete@ContextBase@details@Concurrency@@QAE_NH@Z"},{"address":{"type":"absolute","value":4376741},"name":"?CancelStealers@ContextBase@details@Concurrency@@QAEXPAV_TaskCollectionBase@23@@Z"},{"address":{"type":"absolute","value":4377064},"name":"?Cleanup@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4377113},"name":"?ClearAliasTable@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4377176},"name":"?ClearContextTls@ContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4377192},"name":"?CreateWorkQueue@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4377320},"name":"?DeleteElements@?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4377703},"name":"?EnterCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377711},"name":"?EnterHyperCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377722},"name":"?ExitCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377730},"name":"?ExitHyperCriticalRegionHelper@ContextBase@details@Concurrency@@UAEHXZ"},{"address":{"type":"absolute","value":4377741},"name":"?FindAndDelete@?$Hash@PAV_TaskCollection@details@Concurrency@@PAV123@@details@Concurrency@@QAE_NABQAV_TaskCollection@23@PAPAV423@@Z"},{"address":{"type":"absolute","value":4377807},"name":"?FlagCancellationBeacons@ContextBase@details@Concurrency@@QAEXH@Z"},{"address":{"type":"absolute","value":4377879},"name":"?GetCriticalRegionType@ContextBase@details@Concurrency@@UBE?AW4CriticalRegionType@3@XZ"},{"address":{"type":"absolute","value":4377907},"name":"?GetScheduleGroup@ContextBase@details@Concurrency@@QBEPAVScheduleGroupBase@23@XZ"},{"address":{"type":"absolute","value":4377924},"name":"?GetScheduleGroupId@ContextBase@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4377964},"name":"?IsCanceledAtDepth@ContextBase@details@Concurrency@@AAE_NPAV_TaskCollectionBase@23@H@Z"},{"address":{"type":"absolute","value":4378188},"name":"?LockedSetOwningContext@WorkQueue@details@Concurrency@@QAEXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4378223},"name":"?NextList@?$Hash@PAV_TaskCollection@details@Concurrency@@PAV123@@details@Concurrency@@AAEPAUListNode@123@PAH@Z"},{"address":{"type":"absolute","value":4378272},"name":"?Pop@?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAEPAV_UnrealizedChore@23@XZ"},{"address":{"type":"absolute","value":4378353},"name":"?PopContextFromTls@ContextBase@details@Concurrency@@AAEPAV123@XZ"},{"address":{"type":"absolute","value":4378383},"name":"?PushContextToTls@ContextBase@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4378410},"name":"?RecomputeMaximumCancellationDepth@ContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4378541},"name":"?ReferenceForCancellation@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4378546},"name":"?ReleaseWorkQueue@ContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4378633},"name":"?Remove@?$Hash@PAV_TaskCollection@details@Concurrency@@PAV123@@details@Concurrency@@AAEPAUListNode@123@ABQAV_TaskCollection@23@H@Z"},{"address":{"type":"absolute","value":4378711},"name":"?Remove@?$List@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@@details@Concurrency@@QAEXPAUListEntry@23@@Z"},{"address":{"type":"absolute","value":4378757},"name":"?Remove@?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@QAE_NPAVWorkQueue@23@H_N@Z"},{"address":{"type":"absolute","value":4379050},"name":"?RemoveStealer@ContextBase@details@Concurrency@@QAEXPAV123@@Z"},{"address":{"type":"absolute","value":4379123},"name":"?SweepAliasTable@ContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4379253},"name":"?SweepUnstructured@ContextBase@details@Concurrency@@QAEXP6A_NPAV_UnrealizedChore@23@PAX@Z12@Z"},{"address":{"type":"absolute","value":4379418},"name":"?ThrowContextEvent@ContextBase@details@Concurrency@@KAXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4379531},"name":"?TraceContextEvent@ContextBase@details@Concurrency@@IAEXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4379675},"name":"?TryPopUnstructured@ContextBase@details@Concurrency@@QAEPAV_UnrealizedChore@23@H@Z"},{"address":{"type":"absolute","value":4379690},"name":"?_SafeGetParent@_TaskCollectionBase@details@Concurrency@@IAEPAV123@XZ"},{"address":{"type":"absolute","value":4379710},"name":"??$atomic_compare_exchange@J@details@Concurrency@@YAJAAU?$atomic@J@std@@JJ@Z"},{"address":{"type":"absolute","value":4379747},"name":"??0CancellationTokenRegistration_TaskProc@details@Concurrency@@QAE@P6AXPAX@Z0H@Z"},{"address":{"type":"absolute","value":4379790},"name":"??0_CancellationTokenRegistration@details@Concurrency@@QAE@J@Z"},{"address":{"type":"absolute","value":4379907},"name":"??0_TaskCollection@details@Concurrency@@AAE@PAV012@_N@Z"},{"address":{"type":"absolute","value":4380175},"name":"??1?$lock_guard@Vmutex@std@@@std@@QAE@XZ"},{"address":{"type":"absolute","value":4380230},"name":"??1?$unique_lock@Vmutex@std@@@std@@QAE@XZ"},{"address":{"type":"absolute","value":4380291},"name":"??1TaskStack@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4380307},"name":"??1_CancellationTokenRegistration@details@Concurrency@@MAE@XZ"},{"address":{"type":"absolute","value":4380344},"name":"??1_TaskCollection@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4380649},"name":"??_GCancellationTokenRegistration_TaskProc@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4380683},"name":"??_G_CancellationTokenRegistration@details@Concurrency@@MAEPAXI@Z"},{"address":{"type":"absolute","value":4380752},"name":"??_Gexception_ptr@std@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4380834},"name":"?AddArbitraryAlias@ContextBase@details@Concurrency@@QAEXPAV_TaskCollection@23@0@Z"},{"address":{"type":"absolute","value":4380869},"name":"?GetArbitraryAlias@ContextBase@details@Concurrency@@QAEPAV_TaskCollection@23@PAV423@@Z"},{"address":{"type":"absolute","value":4380967},"name":"?GetWorkQueueIdentity@ContextBase@details@Concurrency@@QAEIXZ"},{"address":{"type":"absolute","value":4380990},"name":"?_Abort@_TaskCollection@details@Concurrency@@AAEX_N@Z"},{"address":{"type":"absolute","value":4381293},"name":"?_AbortiveSweep@_TaskCollection@details@Concurrency@@AAEXPAX@Z"},{"address":{"type":"absolute","value":4381365},"name":"?_Alias@_TaskCollection@details@Concurrency@@AAEPAV123@XZ"},{"address":{"type":"absolute","value":4381494},"name":"?_Atomic_compare_exchange_strong_4@std@@YAHPCKPAKKW4memory_order@1@2@Z"},{"address":{"type":"absolute","value":4381606},"name":"?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4381691},"name":"?_Cancel@_TaskCollection@details@Concurrency@@AAEX_NPAV123@@Z"},{"address":{"type":"absolute","value":4381850},"name":"?_CancelDirectAliases@_TaskCollection@details@Concurrency@@AAEX_NPAV123@@Z"},{"address":{"type":"absolute","value":4381881},"name":"?_CancelFromArbitraryThread@_TaskCollection@details@Concurrency@@AAEX_N@Z"},{"address":{"type":"absolute","value":4382044},"name":"?_CancelStolenContexts@_TaskCollection@details@Concurrency@@AAEX_N0@Z"},{"address":{"type":"absolute","value":4382183},"name":"?_Cnd_broadcastX@std@@YAHPAU_Cnd_internal_imp_t@@@Z"},{"address":{"type":"absolute","value":4382214},"name":"?_CollectionMatchPredicate@_TaskCollection@details@Concurrency@@CA_NPAV_UnrealizedChore@23@PAX@Z"},{"address":{"type":"absolute","value":4382233},"name":"?"},{"address":{"type":"absolute","value":4382272},"name":"?_CountUp@_StructuredTaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4382318},"name":"?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4382533},"name":"?"},{"address":{"type":"absolute","value":4382562},"name":"?_Exec@CancellationTokenRegistration_TaskProc@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4382582},"name":"?_FullAliasWait@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4382807},"name":"?_Initialize@_StructuredTaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4382882},"name":"?_Initialize@_TaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4382904},"name":"?_Invoke@_CancellationTokenRegistration@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4383040},"name":"?_IsDirectAlias@_TaskCollection@details@Concurrency@@ABE_NXZ"},{"address":{"type":"absolute","value":4383058},"name":"?_IsIndirectAlias@_TaskCollection@details@Concurrency@@ABE_NXZ"},{"address":{"type":"absolute","value":4383076},"name":"?_IsMarkedForAbnormalExit@_TaskCollection@details@Concurrency@@QBE_NXZ"},{"address":{"type":"absolute","value":4383087},"name":"?_IsStaleAlias@_TaskCollection@details@Concurrency@@ABE_NXZ"},{"address":{"type":"absolute","value":4383095},"name":"?_NotifyCompletedChoreAndFree@_TaskCollection@details@Concurrency@@AAEXPAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4383178},"name":"?_RegisterCallback@_CancellationTokenState@details@Concurrency@@QAEPAV_CancellationTokenRegistration@23@P6AXPAX@Z0H@Z"},{"address":{"type":"absolute","value":4383239},"name":"?_RegisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4383353},"name":"?"},{"address":{"type":"absolute","value":4383392},"name":"?_ReleaseAlias@_TaskCollection@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4383450},"name":"?_Reset@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4383701},"name":"?_SetCancelState@_TaskCollection@details@Concurrency@@AAE_NJ@Z"},{"address":{"type":"absolute","value":4383759},"name":"?_SweepAbortedChore@_TaskCollection@details@Concurrency@@CA_NPAV_UnrealizedChore@23@PAX@Z"},{"address":{"type":"absolute","value":4383784},"name":"?_TaskCleanup@_TaskCollection@details@Concurrency@@AAE_N_N@Z"},{"address":{"type":"absolute","value":4383868},"name":"?push_back@TokenRegistrationContainer@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@34@@Z"},{"address":{"type":"absolute","value":4383928},"name":"?remove@TokenRegistrationContainer@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@34@@Z"},{"address":{"type":"absolute","value":4383997},"name":"??0SchedulerPolicy@Concurrency@@QAA@IZZ"},{"address":{"type":"absolute","value":4384027},"name":"??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z"},{"address":{"type":"absolute","value":4384146},"name":"??1SchedulerPolicy@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4384158},"name":"??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z"},{"address":{"type":"absolute","value":4384188},"name":"?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z"},{"address":{"type":"absolute","value":4384242},"name":"?_AreConcurrencyLimitsValid@SchedulerPolicy@Concurrency@@CA_NII@Z"},{"address":{"type":"absolute","value":4384272},"name":"?_Initialize@SchedulerPolicy@Concurrency@@AAEXIPAPAD@Z"},{"address":{"type":"absolute","value":4384459},"name":"__catch$?_Initialize@SchedulerPolicy@Concurrency@@AAEXIPAPAD@Z$0"},{"address":{"type":"absolute","value":4384508},"name":"?_ResolvePolicyValues@SchedulerPolicy@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4384604},"name":"?_ValidPolicyValue@SchedulerPolicy@Concurrency@@CA_NW4PolicyElementKey@2@I@Z"},{"address":{"type":"absolute","value":4384828},"name":"?_ValidateConcRTPolicy@SchedulerPolicy@Concurrency@@QBEXXZ"},{"address":{"type":"absolute","value":4384886},"name":"??0ExecutionResource@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAUSchedulerNode@12@I@Z"},{"address":{"type":"absolute","value":4384980},"name":"??0ExecutionResource@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAV012@@Z"},{"address":{"type":"absolute","value":4385058},"name":"?CurrentSubscriptionLevel@ExecutionResource@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4385076},"name":"?DecrementUseCounts@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385188},"name":"?IncrementUseCounts@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385388},"name":"?Remove@ExecutionResource@details@Concurrency@@UAEXPAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4385483},"name":"?ResetCurrent@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385511},"name":"?SetAsCurrent@ExecutionResource@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4385546},"name":"??$sign@I@details@Concurrency@@YAII@Z"},{"address":{"type":"absolute","value":4385570},"name":"??$sign@N@details@Concurrency@@YANN@Z"},{"address":{"type":"absolute","value":4385626},"name":"??0HillClimbing@details@Concurrency@@QAE@IIPAVSchedulerProxy@12@@Z"},{"address":{"type":"absolute","value":4385767},"name":"?Add@MeasuredHistory@HillClimbing@details@Concurrency@@QAEXNI@Z"},{"address":{"type":"absolute","value":4385802},"name":"?CalculateThroughput@HillClimbing@details@Concurrency@@AAENIIII@Z"},{"address":{"type":"absolute","value":4385861},"name":"?CalculateThroughputSlope@HillClimbing@details@Concurrency@@AAENHH@Z"},{"address":{"type":"absolute","value":4386048},"name":"?CoefficientOfVariationMean@MeasuredHistory@HillClimbing@details@Concurrency@@QAENXZ"},{"address":{"type":"absolute","value":4386103},"name":"?EstablishControlSetting@HillClimbing@details@Concurrency@@AAEXI@Z"},{"address":{"type":"absolute","value":4386172},"name":"?FlushHistories@HillClimbing@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4386242},"name":"?GetHistory@HillClimbing@details@Concurrency@@AAEPAVMeasuredHistory@123@I@Z"},{"address":{"type":"absolute","value":4386285},"name":"?GetRandomMove@HillClimbing@details@Concurrency@@AAEHXZ"},{"address":{"type":"absolute","value":4386310},"name":"?IsStableHistory@HillClimbing@details@Concurrency@@AAE_NPAVMeasuredHistory@123@@Z"},{"address":{"type":"absolute","value":4386358},"name":"?Mean@MeasuredHistory@HillClimbing@details@Concurrency@@QAENXZ"},{"address":{"type":"absolute","value":4386390},"name":"?RecommendControlSetting@HillClimbing@details@Concurrency@@AAEII@Z"},{"address":{"type":"absolute","value":4386598},"name":"?Update@HillClimbing@details@Concurrency@@QAEIIIII@Z"},{"address":{"type":"absolute","value":4387046},"name":"?Variance@MeasuredHistory@HillClimbing@details@Concurrency@@QAENXZ"},{"address":{"type":"absolute","value":4387122},"name":"??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4387726},"name":"??1SchedulerProxy@details@Concurrency@@IAE@XZ"},{"address":{"type":"absolute","value":4387819},"name":"?AddCore@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerNode@23@I_N@Z"},{"address":{"type":"absolute","value":4388022},"name":"?AddExecutionResource@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4388100},"name":"?AddTail@?$List@VExecutionResource@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4388157},"name":"?AddThreadSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4388172},"name":"?AddVirtualProcessorRoots@SchedulerProxy@details@Concurrency@@QAEXPAPAUIVirtualProcessorRoot@3@I@Z"},{"address":{"type":"absolute","value":4388346},"name":"?AdjustAllocationIncrease@SchedulerProxy@details@Concurrency@@QBEII@Z"},{"address":{"type":"absolute","value":4388458},"name":"?"},{"address":{"type":"absolute","value":4388550},"name":"?Cleanup@SchedulerProxy@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4388755},"name":"?CreateExternalThreadResource@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@PAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4388826},"name":"?CreateOversubscriber@SchedulerProxy@details@Concurrency@@UAEPAUIVirtualProcessorRoot@3@PAUIExecutionResource@3@@Z"},{"address":{"type":"absolute","value":4389014},"name":"?CreateVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@UAEPAVVirtualProcessorRoot@23@PAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4389070},"name":"?DecrementCoreSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4389144},"name":"?DecrementFixedCoreCount@SchedulerProxy@details@Concurrency@@QAEXII_N@Z"},{"address":{"type":"absolute","value":4389265},"name":"?DeleteThis@SchedulerProxy@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4389292},"name":"?DestroyExecutionResource@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4389425},"name":"?DestroyVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@QAEXPAVVirtualProcessorRoot@23@@Z"},{"address":{"type":"absolute","value":4389563},"name":"?FinalShutdown@SchedulerProxy@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4389592},"name":"?GetCurrentThreadExecutionResource@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@XZ"},{"address":{"type":"absolute","value":4389621},"name":"?GetNewThreadProxy@SchedulerProxy@details@Concurrency@@UAEPAUIThreadProxy@3@PAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4389701},"name":"?GetResourceForNewSubscription@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@PAV423@@Z"},{"address":{"type":"absolute","value":4389779},"name":"?GrantAllocation@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@I_N0@Z"},{"address":{"type":"absolute","value":4390508},"name":"?IncrementCoreSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4390586},"name":"?IncrementFixedCoreCount@SchedulerProxy@details@Concurrency@@QAEXII_N@Z"},{"address":{"type":"absolute","value":4390720},"name":"?ReferenceCurrentThreadExecutionResource@SchedulerProxy@details@Concurrency@@QAEPAVExecutionResource@23@XZ"},{"address":{"type":"absolute","value":4390889},"name":"?Remove@?$List@VExecutionResource@details@Concurrency@@VCount@CollectionTypes@23@@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4390943},"name":"?RemoveCore@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4391177},"name":"?RemoveThreadSubscription@SchedulerProxy@details@Concurrency@@QAEXPAVExecutionResource@23@@Z"},{"address":{"type":"absolute","value":4391221},"name":"?RequestInitialVirtualProcessors@SchedulerProxy@details@Concurrency@@UAEPAUIExecutionResource@3@_N@Z"},{"address":{"type":"absolute","value":4391240},"name":"?SendCoreNotification@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerCore@23@_N@Z"},{"address":{"type":"absolute","value":4391468},"name":"?Shutdown@SchedulerProxy@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4391478},"name":"?SubscribeCurrentThread@SchedulerProxy@details@Concurrency@@UAEPAUIExecutionResource@3@XZ"},{"address":{"type":"absolute","value":4391488},"name":"?ToggleBorrowedState@SchedulerProxy@details@Concurrency@@QAEXPAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4391548},"name":"?UnbindContext@SchedulerProxy@details@Concurrency@@UAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4391621},"name":"?Initialize@WinRT@details@Concurrency@@SAXXZ"},{"address":{"type":"absolute","value":4391912},"name":"??0FreeThreadProxy@details@Concurrency@@QAE@PAUIThreadProxyFactory@12@I@Z"},{"address":{"type":"absolute","value":4391965},"name":"??0FreeThreadProxyFactory@details@Concurrency@@IAE@PAVThreadProxyFactoryManager@12@@Z"},{"address":{"type":"absolute","value":4392007},"name":"??0ThreadProxyFactoryManager@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4392059},"name":"??1ThreadProxyFactoryManager@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4392178},"name":"?"},{"address":{"type":"absolute","value":4392213},"name":"??_GFreeThreadProxy@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4392253},"name":"??_GFreeThreadProxyFactory@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4392323},"name":"?Create@FreeThreadProxyFactory@details@Concurrency@@EAEPAVFreeThreadProxy@23@I@Z"},{"address":{"type":"absolute","value":4392376},"name":"?CreateFactory@FreeThreadProxyFactory@details@Concurrency@@SAPAV123@PAVThreadProxyFactoryManager@23@@Z"},{"address":{"type":"absolute","value":4392420},"name":"?GetFreeThreadProxyFactory@ThreadProxyFactoryManager@details@Concurrency@@QAEPAVFreeThreadProxyFactory@23@XZ"},{"address":{"type":"absolute","value":4392492},"name":"?Prepare@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@MAEXPAVFreeThreadProxy@23@H@Z"},{"address":{"type":"absolute","value":4392516},"name":"?ReclaimProxy@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@UAEXPAUIThreadProxy@3@@Z"},{"address":{"type":"absolute","value":4392615},"name":"?ReclaimProxy@FreeThreadProxyFactory@details@Concurrency@@UAEXPAUIThreadProxy@3@@Z"},{"address":{"type":"absolute","value":4392780},"name":"?Reference@FreeThreadProxyFactory@details@Concurrency@@UAEJXZ"},{"address":{"type":"absolute","value":4392790},"name":"?Release@FreeThreadProxyFactory@details@Concurrency@@UAEJXZ"},{"address":{"type":"absolute","value":4392835},"name":"?RequestProxy@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@UAEPAUIThreadProxy@3@IH@Z"},{"address":{"type":"absolute","value":4392965},"name":"?Retire@FreeThreadProxyFactory@details@Concurrency@@EAEXPAVFreeThreadProxy@23@@Z"},{"address":{"type":"absolute","value":4392980},"name":"?RetireThreadProxies@?$ThreadProxyFactory@VFreeThreadProxy@details@Concurrency@@@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4393088},"name":"?ShutdownFactory@FreeThreadProxyFactory@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4393149},"name":"??0Etw@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4393399},"name":"?ControlCallback@details@Concurrency@@YGKW4WMIDPREQUESTCODE@@PAXPAK1@Z"},{"address":{"type":"absolute","value":4393597},"name":"?GetEnableFlags@Etw@details@Concurrency@@QAEK_K@Z"},{"address":{"type":"absolute","value":4393658},"name":"?GetEnableLevel@Etw@details@Concurrency@@QAEE_K@Z"},{"address":{"type":"absolute","value":4393719},"name":"?GetLoggerHandle@Etw@details@Concurrency@@QAE_KPAX@Z"},{"address":{"type":"absolute","value":4393780},"name":"?RegisterGuids@Etw@details@Concurrency@@QAEKP6GKW4WMIDPREQUESTCODE@@PAXPAK1@ZPBU_GUID@@KPAU_TRACE_GUID_REGISTRATION@@PA_K@Z"},{"address":{"type":"absolute","value":4393848},"name":"?Trace@Etw@details@Concurrency@@QAEK_KPAU_EVENT_TRACE_HEADER@@@Z"},{"address":{"type":"absolute","value":4393905},"name":"?UnregisterGuids@Etw@details@Concurrency@@QAEK_K@Z"},{"address":{"type":"absolute","value":4393959},"name":"?_RegisterConcRTEventTracing@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4394070},"name":"?_UnregisterConcRTEventTracing@details@Concurrency@@YAXXZ"},{"address":{"type":"absolute","value":4394137},"name":"?"},{"address":{"type":"absolute","value":4394171},"name":"?"},{"address":{"type":"absolute","value":4394281},"name":"?"},{"address":{"type":"absolute","value":4394291},"name":"??0VirtualProcessor@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4394387},"name":"??1VirtualProcessor@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4394483},"name":"??_GVirtualProcessor@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4394520},"name":"?AcknowledgedAffinityMessage@SchedulerBase@details@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4394573},"name":"?Affinitize@VirtualProcessor@details@Concurrency@@MAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4394646},"name":"?CheckAffinityNotification@VirtualProcessor@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4394726},"name":"?ClaimExclusiveOwnership@VirtualProcessor@details@Concurrency@@QAE_NAAVClaimTicket@123@K_N@Z"},{"address":{"type":"absolute","value":4394875},"name":"?ClearQuickCacheSlot@SchedulerBase@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4394912},"name":"?Deactivate@VirtualProcessor@details@Concurrency@@QAE_NPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4394946},"name":"?DeleteElements@?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4394979},"name":"?EnsureAllTasksVisible@VirtualProcessor@details@Concurrency@@QAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4395013},"name":"?ExerciseClaim@VirtualProcessor@details@Concurrency@@AAE_NW4AvailabilityType@123@PAVScheduleGroupSegmentBase@23@PAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4395158},"name":"?ExerciseWith@ClaimTicket@VirtualProcessor@details@Concurrency@@QAE_NPAVInternalContextBase@34@@Z"},{"address":{"type":"absolute","value":4395201},"name":"?GetCurrentSubAllocator@VirtualProcessor@details@Concurrency@@QAEPAVSubAllocator@23@XZ"},{"address":{"type":"absolute","value":4395223},"name":"?GetResourceMaskId@SchedulerBase@details@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4395253},"name":"?Initialize@VirtualProcessor@details@Concurrency@@MAEXPAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4395635},"name":"?InterlockedClear@ReferenceCountedQuickBitSet@details@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4395699},"name":"?InterlockedSet@ReferenceCountedQuickBitSet@details@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4395767},"name":"?MakeAvailable@VirtualProcessor@details@Concurrency@@IAEXW4AvailabilityType@123@_N@Z"},{"address":{"type":"absolute","value":4395879},"name":"?MarkForRetirement@VirtualProcessor@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4395985},"name":"?Oversubscribe@VirtualProcessor@details@Concurrency@@EAEPAV123@XZ"},{"address":{"type":"absolute","value":4396114},"name":"?Remove@?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@QAE_NPAVVirtualProcessor@23@H_N@Z"},{"address":{"type":"absolute","value":4396358},"name":"?Retire@VirtualProcessor@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4396712},"name":"?SafePoint@VirtualProcessor@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4396730},"name":"?SaveRetiredVirtualProcessorStatistics@SchedulerBase@details@Concurrency@@QAEXPAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4396788},"name":"?SpinUntilClear@QuickBitSet@details@Concurrency@@QBEXI@Z"},{"address":{"type":"absolute","value":4396860},"name":"?SpinUntilSet@QuickBitSet@details@Concurrency@@QBEXI@Z"},{"address":{"type":"absolute","value":4396932},"name":"?StartupWorkerContext@VirtualProcessor@details@Concurrency@@EAE_NPAVScheduleGroupSegmentBase@23@PAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4397090},"name":"?ThrowVirtualProcessorEvent@VirtualProcessor@details@Concurrency@@CAXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4397203},"name":"?"},{"address":{"type":"absolute","value":4397213},"name":"?TraceVirtualProcessorEvent@VirtualProcessor@details@Concurrency@@AAEXW4ConcRT_EventType@3@EKK@Z"},{"address":{"type":"absolute","value":4397258},"name":"?UpdateWorkState@VirtualProcessor@details@Concurrency@@QAEX_N0@Z"},{"address":{"type":"absolute","value":4397352},"name":"?Wipe@QuickBitSet@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4397381},"name":"??0SchedulingNode@details@Concurrency@@QAE@ABVQuickBitSet@12@KPAVSchedulingRing@12@@Z"},{"address":{"type":"absolute","value":4397506},"name":"??1?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4397625},"name":"??1SchedulingNode@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4397666},"name":"?Add@?$ListArray@VVirtualProcessor@details@Concurrency@@@details@Concurrency@@QAEHPAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4398020},"name":"?AddVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PAUIVirtualProcessorRoot@3@_N@Z"},{"address":{"type":"absolute","value":4398284},"name":"?"},{"address":{"type":"absolute","value":4398368},"name":"?FindMatchingVirtualProcessor@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4398429},"name":"?FindVirtualProcessorByLocation@SchedulingNode@details@Concurrency@@QAEPAVVirtualProcessor@23@PBVlocation@3@@Z"},{"address":{"type":"absolute","value":4398519},"name":"?FoundAvailableVirtualProcessor@SchedulingNode@details@Concurrency@@AAE_NAAVClaimTicket@VirtualProcessor@23@Vlocation@3@K@Z"},{"address":{"type":"absolute","value":4398631},"name":"?GetLocation@SchedulingNode@details@Concurrency@@QAE?AVlocation@3@XZ"},{"address":{"type":"absolute","value":4398683},"name":"?Steal@?$StructuredWorkStealingQueue@VInternalContextBase@details@Concurrency@@V_HyperNonReentrantLock@23@@details@Concurrency@@QAEPAVInternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4398876},"name":"??0AllocatorBucket@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4398897},"name":"??1AllocatorBucket@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4398979},"name":"?Alloc@AllocatorBucket@details@Concurrency@@QAEPATAllocationEntry@23@XZ"},{"address":{"type":"absolute","value":4399004},"name":"?Alloc@SubAllocator@details@Concurrency@@QAEPAXI@Z"},{"address":{"type":"absolute","value":4399084},"name":"?Free@AllocatorBucket@details@Concurrency@@QAE_NPATAllocationEntry@23@@Z"},{"address":{"type":"absolute","value":4399126},"name":"?Free@SubAllocator@details@Concurrency@@QAEXPAX@Z"},{"address":{"type":"absolute","value":4399181},"name":"?GetBucketIndex@SubAllocator@details@Concurrency@@SAHI@Z"},{"address":{"type":"absolute","value":4399262},"name":"?StaticAlloc@SubAllocator@details@Concurrency@@SAPAXI@Z"},{"address":{"type":"absolute","value":4399319},"name":"??0InternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@@Z"},{"address":{"type":"absolute","value":4399546},"name":"??1InternalContextBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4399721},"name":"?AddToRunnables@InternalContextBase@details@Concurrency@@MAEXVlocation@3@@Z"},{"address":{"type":"absolute","value":4400103},"name":"?Alloc@InternalContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4400187},"name":"?Block@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4400503},"name":"?Cancel@InternalContextBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4400617},"name":"?Cleanup@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4400641},"name":"?CleanupDispatchedContextOnCancel@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4400668},"name":"?Dispatch@InternalContextBase@details@Concurrency@@UAEXPAUDispatchState@3@@Z"},{"address":{"type":"absolute","value":4401066},"name":"?ExecuteChoreInline@InternalContextBase@details@Concurrency@@IAEXPAVWorkItem@23@@Z"},{"address":{"type":"absolute","value":4401127},"name":"?ExecutedAssociatedChore@InternalContextBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4401237},"name":"?FindWorkForBlockingOrNesting@InternalContextBase@details@Concurrency@@AAEPAV123@AA_N0@Z"},{"address":{"type":"absolute","value":4401535},"name":"?Free@InternalContextBase@details@Concurrency@@UAEXPAX@Z"},{"address":{"type":"absolute","value":4401579},"name":"?GetAndResetOversubscribedVProc@InternalContextBase@details@Concurrency@@QAEPAVVirtualProcessor@23@PAV423@@Z"},{"address":{"type":"absolute","value":4401637},"name":"?"},{"address":{"type":"absolute","value":4401644},"name":"?GetScheduler@InternalContextBase@details@Concurrency@@UAEPAUIScheduler@3@XZ"},{"address":{"type":"absolute","value":4401669},"name":"?GetVirtualProcessorId@InternalContextBase@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4402092},"name":"?IsSynchronouslyBlocked@InternalContextBase@details@Concurrency@@UBE_NXZ"},{"address":{"type":"absolute","value":4402100},"name":"?IsVirtualProcessorRetired@InternalContextBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4402194},"name":"?LeaveScheduler@InternalContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4402455},"name":"?Oversubscribe@InternalContextBase@details@Concurrency@@UAEX_N@Z"},{"address":{"type":"absolute","value":4402589},"name":"?PrepareForUse@InternalContextBase@details@Concurrency@@QAEXPAVScheduleGroupSegmentBase@23@PAU_Chore@23@_N@Z"},{"address":{"type":"absolute","value":4402672},"name":"?PrepareToRun@InternalContextBase@details@Concurrency@@MAEXPAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4402760},"name":"?ReclaimVirtualProcessor@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4402865},"name":"?RejoinScheduler@InternalContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4402896},"name":"?RemoveFromUse@InternalContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4402931},"name":"?SearchForWork@VirtualProcessor@details@Concurrency@@QAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_N@Z"},{"address":{"type":"absolute","value":4402971},"name":"?SetProxy@InternalContextBase@details@Concurrency@@UAEXPAUIThreadProxy@3@@Z"},{"address":{"type":"absolute","value":4403022},"name":"?SpinUntilBlocked@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4403065},"name":"?SpinUntilValueEquals@details@Concurrency@@YAXPCJJ@Z"},{"address":{"type":"absolute","value":4403110},"name":"?SpinYield@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4403297},"name":"?SwapScheduleGroupSegment@InternalContextBase@details@Concurrency@@QAEXPAVScheduleGroupSegmentBase@23@_N@Z"},{"address":{"type":"absolute","value":4403372},"name":"?SwitchOut@InternalContextBase@details@Concurrency@@IAE_NW4ReasonForSwitch@123@@Z"},{"address":{"type":"absolute","value":4403659},"name":"?SwitchTo@InternalContextBase@details@Concurrency@@IAEXPAV123@W4ReasonForSwitch@123@@Z"},{"address":{"type":"absolute","value":4403984},"name":"?Unblock@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4404175},"name":"?WaitForWork@InternalContextBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4404431},"name":"?WorkWasFound@InternalContextBase@details@Concurrency@@IAE_NPAVWorkItem@23@@Z"},{"address":{"type":"absolute","value":4404523},"name":"?Yield@InternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4404911},"name":"??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z"},{"address":{"type":"absolute","value":4405048},"name":"??1?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4405167},"name":"??1SchedulingRing@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4405191},"name":"?Activate@SchedulingRing@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4405253},"name":"?DeleteElements@?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4405286},"name":"?Remove@?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@QAE_NPAVScheduleGroupSegmentBase@23@H_N@Z"},{"address":{"type":"absolute","value":4405530},"name":"?RemoveScheduleGroupSegment@SchedulingRing@details@Concurrency@@AAEXPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4405577},"name":"??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z"},{"address":{"type":"absolute","value":4405696},"name":"??0ScheduleGroupBase@details@Concurrency@@QAE@PAVSchedulerBase@12@PAVlocation@2@@Z"},{"address":{"type":"absolute","value":4405785},"name":"??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z"},{"address":{"type":"absolute","value":4405978},"name":"??0Segment@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@23@ABVQuickBitSet@23@II@Z"},{"address":{"type":"absolute","value":4406086},"name":"??1?$ListArray@U?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4406208},"name":"??1?$ListArray@VWorkQueue@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4406332},"name":"??1?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4406432},"name":"??1ScheduleGroupSegmentBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4406510},"name":"??4QuickBitSet@details@Concurrency@@QAEAAV012@$$QAV012@@Z"},{"address":{"type":"absolute","value":4406552},"name":"??_GScheduleGroupSegmentBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4406589},"name":"?"},{"address":{"type":"absolute","value":4406942},"name":"?Add@?$ListArray@VScheduleGroupSegmentBase@details@Concurrency@@@details@Concurrency@@QAEHPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4407299},"name":"?AddRunnableContext@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVInternalContextBase@23@Vlocation@3@@Z"},{"address":{"type":"absolute","value":4407575},"name":"?ClearQuickCacheSlotIf@SchedulerBase@details@Concurrency@@QAEXIPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4407612},"name":"?CreateSegment@ScheduleGroupBase@details@Concurrency@@IAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4407789},"name":"?DeleteElements@?$ListArray@U?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@details@Concurrency@@@details@Concurrency@@AAEXPAU_SINGLE_LIST_ENTRY@@@Z"},{"address":{"type":"absolute","value":4407822},"name":"?DemandInitialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4407940},"name":"?Dequeue@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE_NPAPAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4408186},"name":"?DetachActiveWorkQueue@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4408249},"name":"?Enqueue@?$SafeSQueue@VRealizedChore@details@Concurrency@@V_HyperNonReentrantLock@23@@details@Concurrency@@QAEXPAVRealizedChore@23@@Z"},{"address":{"type":"absolute","value":4408308},"name":"?FindSegment@ScheduleGroupBase@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4408392},"name":"?GetDetachedWorkQueue@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVWorkQueue@23@XZ"},{"address":{"type":"absolute","value":4408493},"name":"?GetInternalContext@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVInternalContextBase@23@PAU_Chore@23@_N@Z"},{"address":{"type":"absolute","value":4408544},"name":"?GetRealizedChore@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVRealizedChore@23@XZ"},{"address":{"type":"absolute","value":4408560},"name":"?Grow@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEPAUSegment@123@PAU4123@@Z"},{"address":{"type":"absolute","value":4408634},"name":"?"},{"address":{"type":"absolute","value":4408642},"name":"?HasUnrealizedChores@ScheduleGroupSegmentBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4408653},"name":"?Initialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAEXABVQuickBitSet@23@@Z"},{"address":{"type":"absolute","value":4408694},"name":"?Initialize@ScheduleGroupBase@details@Concurrency@@QAEXPAVlocation@3@@Z"},{"address":{"type":"absolute","value":4408713},"name":"?Initialize@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVScheduleGroupBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4408843},"name":"?IsEmpty@WorkQueue@details@Concurrency@@QBE_NXZ"},{"address":{"type":"absolute","value":4408864},"name":"?LocateMailboxSegment@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEPAUSegment@123@I_N@Z"},{"address":{"type":"absolute","value":4408936},"name":"?LocateSegment@ScheduleGroupBase@details@Concurrency@@UAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@_N@Z"},{"address":{"type":"absolute","value":4409156},"name":"?LocateUnrealizedChores@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAVWorkQueue@23@XZ"},{"address":{"type":"absolute","value":4409245},"name":"?MarkDetachment@?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4409296},"name":"?RedetachQueue@ScheduleGroupSegmentBase@details@Concurrency@@QAEXPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4409321},"name":"?ReleaseInternalContext@ScheduleGroupSegmentBase@details@Concurrency@@IAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4409359},"name":"?Remove@?$ListArray@U?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@details@Concurrency@@@details@Concurrency@@QAE_NPAU?$ListArrayInlineLink@VWorkQueue@details@Concurrency@@@23@H_N@Z"},{"address":{"type":"absolute","value":4409600},"name":"?Remove@ScheduleGroupSegmentBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4409635},"name":"?RemoveSegments@ScheduleGroupBase@details@Concurrency@@MAEXXZ"},{"address":{"type":"absolute","value":4409698},"name":"?RetireDetachedQueue@ScheduleGroupSegmentBase@details@Concurrency@@QAEXPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4409737},"name":"?SafelyDeleteDetachedWorkQueue@ScheduleGroupSegmentBase@details@Concurrency@@IAE_NPAVWorkQueue@23@@Z"},{"address":{"type":"absolute","value":4409851},"name":"?ScheduleTask@ScheduleGroupBase@details@Concurrency@@UAEXP6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4409891},"name":"?ScheduleTask@ScheduleGroupSegmentBase@details@Concurrency@@QAEXP6AXPAX@Z0@Z"},{"address":{"type":"absolute","value":4410199},"name":"?SetDeletionReferences@Segment@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAEXI@Z"},{"address":{"type":"absolute","value":4410237},"name":"?StealUnrealizedChore@ScheduleGroupSegmentBase@details@Concurrency@@IAEPAV_UnrealizedChore@23@_N@Z"},{"address":{"type":"absolute","value":4410664},"name":"??IQuickBitSet@details@Concurrency@@QBE?AV012@ABV012@@Z"},{"address":{"type":"absolute","value":4410740},"name":"?"},{"address":{"type":"absolute","value":4410755},"name":"?Enqueue@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE?AVSlot@123@PAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4410896},"name":"?InterlockedSet@QuickBitSet@details@Concurrency@@QAEXABV123@@Z"},{"address":{"type":"absolute","value":4410952},"name":"?MailChore@CacheLocalScheduleGroup@details@Concurrency@@UAE?AVSlot@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@23@PAV_UnrealizedChore@23@PAVlocation@3@PAPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4411008},"name":"?MailChore@CacheLocalScheduleGroupSegment@details@Concurrency@@QAE?AVSlot@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@23@PAV_UnrealizedChore@23@@Z"},{"address":{"type":"absolute","value":4411032},"name":"?NotifyAffinitizedWork@CacheLocalScheduleGroupSegment@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4411083},"name":"?PostAffinityMessage@SchedulerBase@details@Concurrency@@QAEXABVQuickBitSet@23@@Z"},{"address":{"type":"absolute","value":4411145},"name":"?SetQuickCacheSlot@SchedulerBase@details@Concurrency@@QAEXIPAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4411183},"name":"?FindSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4411230},"name":"?LocateSegment@FairScheduleGroup@details@Concurrency@@UAEPAVScheduleGroupSegmentBase@23@PAVlocation@3@_N@Z"},{"address":{"type":"absolute","value":4411335},"name":"??0ExternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4411488},"name":"??1ExternalContextBase@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4411557},"name":"??_GExternalContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4411594},"name":"?Alloc@ExternalContextBase@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4411627},"name":"?Block@ExternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4411701},"name":"?Cleanup@ExternalContextBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4411789},"name":"?Free@ExternalContextBase@details@Concurrency@@UAEXPAX@Z"},{"address":{"type":"absolute","value":4411826},"name":"?GetCurrentSubAllocator@ExternalContextBase@details@Concurrency@@QAEPAVSubAllocator@23@XZ"},{"address":{"type":"absolute","value":4411855},"name":"?ImplicitDetachHandler@ExternalContextBase@details@Concurrency@@CGXPAU_TP_CALLBACK_INSTANCE@@PAXPAU_TP_WAIT@@K@Z"},{"address":{"type":"absolute","value":4411889},"name":"?ImplicitDetachHandlerXP@ExternalContextBase@details@Concurrency@@CGXPAXE@Z"},{"address":{"type":"absolute","value":4411924},"name":"?IsSynchronouslyBlocked@ExternalContextBase@details@Concurrency@@UBE_NXZ"},{"address":{"type":"absolute","value":4411932},"name":"?"},{"address":{"type":"absolute","value":4411985},"name":"?PrepareForUse@ExternalContextBase@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4412180},"name":"?RemoveFromUse@ExternalContextBase@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4412214},"name":"?SpinYield@ExternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4412238},"name":"?Unblock@ExternalContextBase@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4412415},"name":"??0ThreadInternalContext@details@Concurrency@@QAE@PAVSchedulerBase@12@@Z"},{"address":{"type":"absolute","value":4412453},"name":"??0ThreadScheduler@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4412637},"name":"?Create@ThreadScheduler@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z"},{"address":{"type":"absolute","value":4412688},"name":"?CreateInternalContext@ThreadScheduler@details@Concurrency@@MAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4412750},"name":"?CreateVirtualProcessor@ThreadScheduler@details@Concurrency@@UAEPAVVirtualProcessor@23@PAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4412810},"name":"?"},{"address":{"type":"absolute","value":4412835},"name":"?"},{"address":{"type":"absolute","value":4412974},"name":"??0exception_ptr@std@@QAE@ABV01@@Z"},{"address":{"type":"absolute","value":4413040},"name":"?_Current_exception@exception_ptr@std@@SA?AV12@XZ"},{"address":{"type":"absolute","value":4413116},"name":"?_FinishCancelState@_TaskCollectionBase@details@Concurrency@@IAEXI@Z"},{"address":{"type":"absolute","value":4413154},"name":"?_GetTokenState@_TaskCollectionBase@details@Concurrency@@QAEPAV_CancellationTokenState@23@PAPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4413194},"name":"?_MarkCancellation@_TaskCollectionBase@details@Concurrency@@IAE_NXZ"},{"address":{"type":"absolute","value":4413234},"name":"?_RaisedException@_TaskCollectionBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4413328},"name":"?_RethrowException@_TaskCollectionBase@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4413440},"name":"?_RethrowException@exception_ptr@std@@QBEXXZ"},{"address":{"type":"absolute","value":4413447},"name":"?rethrow_exception@std@@YAXVexception_ptr@1@@Z"},{"address":{"type":"absolute","value":4413472},"name":"??0?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAE@PAV_CriticalNonReentrantLock@12@@Z"},{"address":{"type":"absolute","value":4413575},"name":"??0WorkQueue@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4413685},"name":"?Reinitialize@WorkQueue@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4413779},"name":"?StaticRedetachFromScheduleGroup@WorkQueue@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4413796},"name":"?StaticRetire@WorkQueue@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4413813},"name":"?Steal@WorkQueue@details@Concurrency@@QAEPAV_UnrealizedChore@23@_N@Z"},{"address":{"type":"absolute","value":4414072},"name":"?TryToSteal@WorkQueue@details@Concurrency@@QAEPAV_UnrealizedChore@23@_NAA_N@Z"},{"address":{"type":"absolute","value":4414184},"name":"?UnlockedSteal@?$WorkStealingQueue@V_UnrealizedChore@details@Concurrency@@V_CriticalNonReentrantLock@23@@details@Concurrency@@QAEPAV_UnrealizedChore@23@_N0@Z"},{"address":{"type":"absolute","value":4414326},"name":"?UnlockedSteal@WorkQueue@details@Concurrency@@AAEPAV_UnrealizedChore@23@_N@Z"},{"address":{"type":"absolute","value":4414514},"name":"?_CancelViaToken@_UnrealizedChore@details@Concurrency@@CAXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4414553},"name":"?_InternalFree@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4414583},"name":"?_PrepareSteal@_UnrealizedChore@details@Concurrency@@QAEXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4414607},"name":"?_PrepareStealStructured@_UnrealizedChore@details@Concurrency@@AAEXPAVContextBase@23@@Z"},{"address":{"type":"absolute","value":4414765},"name":"?_SetDetached@_UnrealizedChore@details@Concurrency@@QAEX_N@Z"},{"address":{"type":"absolute","value":4414778},"name":"?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z"},{"address":{"type":"absolute","value":4414957},"name":"__catch$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z$0"},{"address":{"type":"absolute","value":4415093},"name":"__catch$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z$1"},{"address":{"type":"absolute","value":4415138},"name":"??0VirtualProcessorRoot@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAUSchedulerNode@12@I@Z"},{"address":{"type":"absolute","value":4415212},"name":"??_GVirtualProcessorRoot@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4415254},"name":"?CurrentSubscriptionLevel@VirtualProcessorRoot@details@Concurrency@@UBEIXZ"},{"address":{"type":"absolute","value":4415270},"name":"?Remove@VirtualProcessorRoot@details@Concurrency@@UAEXPAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4415358},"name":"?ResetSubscriptionLevel@VirtualProcessorRoot@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4415380},"name":"?Subscribe@VirtualProcessorRoot@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4415393},"name":"?Unsubscribe@VirtualProcessorRoot@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4415406},"name":"??0FreeVirtualProcessorRoot@details@Concurrency@@QAE@PAVSchedulerProxy@12@PAUSchedulerNode@12@I@Z"},{"address":{"type":"absolute","value":4415457},"name":"??8HardwareAffinity@details@Concurrency@@QAE_NABU012@@Z"},{"address":{"type":"absolute","value":4415489},"name":"??_GFreeVirtualProcessorRoot@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4415531},"name":"?AcquireActivatedContext@VirtualProcessorRoot@details@Concurrency@@QAEPAUIExecutionContext@3@XZ"},{"address":{"type":"absolute","value":4415578},"name":"?Activate@FreeVirtualProcessorRoot@details@Concurrency@@UAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4415772},"name":"?Affinitize@FreeVirtualProcessorRoot@details@Concurrency@@QAEXPAVFreeThreadProxy@23@@Z"},{"address":{"type":"absolute","value":4415875},"name":"?Deactivate@FreeVirtualProcessorRoot@details@Concurrency@@UAE_NPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4416038},"name":"?DeleteThis@FreeVirtualProcessorRoot@details@Concurrency@@UAEXXZ"},{"address":{"type":"absolute","value":4416116},"name":"?EnsureAllTasksVisible@FreeVirtualProcessorRoot@details@Concurrency@@UAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4416244},"name":"?ResetOnIdle@FreeVirtualProcessorRoot@details@Concurrency@@QAEXW4SwitchingProxyState@3@@Z"},{"address":{"type":"absolute","value":4416353},"name":"?SetAffinity@FreeThreadProxy@details@Concurrency@@QAEXUHardwareAffinity@23@@Z"},{"address":{"type":"absolute","value":4416407},"name":"?SpinUntilIdle@FreeVirtualProcessorRoot@details@Concurrency@@IAEXXZ"},{"address":{"type":"absolute","value":4416453},"name":"?AssociateExecutionContext@FreeThreadProxy@details@Concurrency@@QAEXPAUIExecutionContext@3@@Z"},{"address":{"type":"absolute","value":4416488},"name":"?Dispatch@FreeThreadProxy@details@Concurrency@@EAEXXZ"},{"address":{"type":"absolute","value":4416654},"name":"?ReturnIdleProxy@FreeThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4416684},"name":"?SwitchOut@FreeThreadProxy@details@Concurrency@@UAEXW4SwitchingProxyState@3@@Z"},{"address":{"type":"absolute","value":4416765},"name":"?SwitchTo@FreeThreadProxy@details@Concurrency@@UAEXPAUIExecutionContext@3@W4SwitchingProxyState@3@@Z"},{"address":{"type":"absolute","value":4416961},"name":"??0ThreadProxy@details@Concurrency@@QAE@PAUIThreadProxyFactory@12@I@Z"},{"address":{"type":"absolute","value":4417199},"name":"??1ThreadProxy@details@Concurrency@@UAE@XZ"},{"address":{"type":"absolute","value":4417296},"name":"??_GThreadProxy@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4417330},"name":"?Cancel@ThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4417361},"name":"?SetPriority@ThreadProxy@details@Concurrency@@QAEXH@Z"},{"address":{"type":"absolute","value":4417385},"name":"?SpinUntilBlocked@ThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4417428},"name":"?SuspendExecution@ThreadProxy@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4417456},"name":"?ThreadProxyMain@ThreadProxy@details@Concurrency@@CGKPAX@Z"},{"address":{"type":"absolute","value":4417536},"name":"??0location@Concurrency@@QAE@W4_Type@01@IIPAX@Z"},{"address":{"type":"absolute","value":4417573},"name":"?ContainsResourceId@SchedulingNode@details@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4417615},"name":"?_FastNodeIntersects@location@Concurrency@@QBE_NABV12@@Z"},{"address":{"type":"absolute","value":4417690},"name":"?_FastVPIntersects@location@Concurrency@@QBE_NABV12@@Z"},{"address":{"type":"absolute","value":4417766},"name":"??0WorkItem@details@Concurrency@@QAE@PAVInternalContextBase@12@@Z"},{"address":{"type":"absolute","value":4417804},"name":"?AcquireQuickCacheSlot@SchedulerBase@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@I@Z"},{"address":{"type":"absolute","value":4417885},"name":"?Bind@WorkItem@details@Concurrency@@QAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4417962},"name":"?BindTo@WorkItem@details@Concurrency@@QAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4418020},"name":"?CheckPriorityList@WorkSearchContext@details@Concurrency@@AAE_N_K@Z"},{"address":{"type":"absolute","value":4418074},"name":"?GetLocalRunnable@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVVirtualProcessor@23@_N@Z"},{"address":{"type":"absolute","value":4418225},"name":"?GetNextSchedulingNode@SchedulerBase@details@Concurrency@@QAEPAVSchedulingNode@23@PAHH@Z"},{"address":{"type":"absolute","value":4418302},"name":"?GetPseudoRRAffineScheduleGroupSegment@SchedulingRing@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@PAH@Z"},{"address":{"type":"absolute","value":4418361},"name":"?GetPseudoRRNonAffineScheduleGroupSegment@SchedulingRing@details@Concurrency@@QAEPAVScheduleGroupSegmentBase@23@PAH@Z"},{"address":{"type":"absolute","value":4418423},"name":"?GetRealizedChore@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_N@Z"},{"address":{"type":"absolute","value":4418503},"name":"?GetRealizedChoreWithinGroup@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@2@Z"},{"address":{"type":"absolute","value":4418632},"name":"?GetRunnableContext@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@@Z"},{"address":{"type":"absolute","value":4418693},"name":"?GetRunnableContextWithinGroup@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@W4SearchAffinity@123@_N@Z"},{"address":{"type":"absolute","value":4418816},"name":"?GetUnrealizedChore@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_N2@Z"},{"address":{"type":"absolute","value":4418899},"name":"?GetUnrealizedChoreWithinGroup@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@2@Z"},{"address":{"type":"absolute","value":4419041},"name":"?Invoke@WorkItem@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4419108},"name":"?PeriodicScan@SchedulerBase@details@Concurrency@@QAEX_K@Z"},{"address":{"type":"absolute","value":4419165},"name":"?PreSearch@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@@Z"},{"address":{"type":"absolute","value":4419225},"name":"?QuickSearch@WorkSearchContext@details@Concurrency@@AAE_NPAVScheduleGroupSegmentBase@23@PAVWorkItem@23@_NK@Z"},{"address":{"type":"absolute","value":4419334},"name":"?QuickSearchYield@WorkSearchContext@details@Concurrency@@AAE_NPAVScheduleGroupSegmentBase@23@PAVWorkItem@23@_NK@Z"},{"address":{"type":"absolute","value":4419444},"name":"?Reset@WorkSearchContext@details@Concurrency@@QAEXPAVVirtualProcessor@23@W4Algorithm@123@@Z"},{"address":{"type":"absolute","value":4419534},"name":"?ResolveToken@WorkItem@details@Concurrency@@QAE_NXZ"},{"address":{"type":"absolute","value":4419661},"name":"?SearchCacheLocal@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4420372},"name":"?SearchCacheLocalYield@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4421020},"name":"?SearchCacheLocal_Realized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@K3@Z"},{"address":{"type":"absolute","value":4421272},"name":"?SearchCacheLocal_Runnables@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@K3@Z"},{"address":{"type":"absolute","value":4421542},"name":"?SearchCacheLocal_Unrealized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@PAVScheduleGroupSegmentBase@23@_NW4SearchAffinity@123@K3@Z"},{"address":{"type":"absolute","value":4421797},"name":"?SearchFair@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4422072},"name":"?SearchFairYield@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVScheduleGroupSegmentBase@23@_NK@Z"},{"address":{"type":"absolute","value":4422342},"name":"?SearchFair_Realized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@_N@Z"},{"address":{"type":"absolute","value":4422490},"name":"?SearchFair_Runnables@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@@Z"},{"address":{"type":"absolute","value":4422619},"name":"?SearchFair_Unrealized@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingRing@23@_N@Z"},{"address":{"type":"absolute","value":4422771},"name":"?ServiceMark@ScheduleGroupSegmentBase@details@Concurrency@@QAEX_K@Z"},{"address":{"type":"absolute","value":4422809},"name":"?ServiceMark@VirtualProcessor@details@Concurrency@@QAEX_K@Z"},{"address":{"type":"absolute","value":4422847},"name":"?SkipSegmentSearch@WorkSearchContext@details@Concurrency@@AAE_NPAVScheduleGroupSegmentBase@23@0W4SearchAffinity@123@_N@Z"},{"address":{"type":"absolute","value":4422987},"name":"?StealForeignLocalRunnable@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingNode@23@@Z"},{"address":{"type":"absolute","value":4423053},"name":"?StealLocalRunnable@WorkSearchContext@details@Concurrency@@AAE_NPAVWorkItem@23@PAVSchedulingNode@23@PAVVirtualProcessor@23@@Z"},{"address":{"type":"absolute","value":4423164},"name":"?StealLocalRunnableContext@VirtualProcessor@details@Concurrency@@AAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4423187},"name":"?TransferReferences@WorkItem@details@Concurrency@@QAEXPAVInternalContextBase@23@@Z"},{"address":{"type":"absolute","value":4423262},"name":"?Invoke@RealizedChore@details@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4423282},"name":"??0ThreadVirtualProcessor@details@Concurrency@@QAE@PAVSchedulingNode@12@PAUIVirtualProcessorRoot@2@@Z"},{"address":{"type":"absolute","value":4423337},"name":"??_GThreadVirtualProcessor@details@Concurrency@@UAEPAXI@Z"},{"address":{"type":"absolute","value":4423386},"name":"__EH_epilog3"},{"address":{"type":"absolute","value":4423407},"name":"__EH_epilog3_GS"},{"address":{"type":"absolute","value":4423424},"name":"__EH_prolog3"},{"address":{"type":"absolute","value":4423476},"name":"__EH_prolog3_GS"},{"address":{"type":"absolute","value":4423531},"name":"__EH_prolog3_catch"},{"address":{"type":"absolute","value":4423600},"name":"__aulldvrm"},{"address":{"type":"absolute","value":4423760},"name":"__allmul"},{"address":{"type":"absolute","value":4423936},"name":"__alloca_probe_16"},{"address":{"type":"absolute","value":4423984},"name":"__FindPESection"},{"address":{"type":"absolute","value":4424064},"name":"__IsNonwritableInCurrentImage"},{"address":{"type":"absolute","value":4424256},"name":"__ValidateImageBase"},{"address":{"type":"absolute","value":4424320},"name":"?"},{"address":{"type":"absolute","value":4424368},"name":"__SEH_prolog4_GS"},{"address":{"type":"absolute","value":4424441},"name":"__SEH_epilog4_GS"},{"address":{"type":"absolute","value":4424464},"name":"__alldiv"},{"address":{"type":"absolute","value":4424704},"name":"__alldvrm"},{"address":{"type":"absolute","value":4424928},"name":"__allrem"},{"address":{"type":"absolute","value":4425429},"name":"??_L@YGXPAXIIP6EX0@Z1@Z"},{"address":{"type":"absolute","value":4425551},"name":"??$?0AAPAUEHExceptionRecord@@_N@?$_Ref_count_obj@V__ExceptionPtr@@@std@@QAE@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425599},"name":"??$?0AAPAUEHExceptionRecord@@_N@?$_Ref_count_obj_alloc@V__ExceptionPtr@@U?$_StaticAllocator@H@@@std@@QAE@ABU?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425667},"name":"?"},{"address":{"type":"absolute","value":4425698},"name":"??$allocate_shared@V__ExceptionPtr@@U?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@_N@std@@YA?AV?$shared_ptr@V__ExceptionPtr@@@0@ABU?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425757},"name":"__catch$??$allocate_shared@V__ExceptionPtr@@U?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@_N@std@@YA?AV?$shared_ptr@V__ExceptionPtr@@@0@ABU?$_StaticAllocator@H@@AAPAUEHExceptionRecord@@$$QA_N@Z$0"},{"address":{"type":"absolute","value":4425767},"name":"??$make_shared@V__ExceptionPtr@@AAPAUEHExceptionRecord@@_N@std@@YA?AV?$shared_ptr@V__ExceptionPtr@@@0@AAPAUEHExceptionRecord@@$$QA_N@Z"},{"address":{"type":"absolute","value":4425831},"name":"??0__ExceptionPtr@@QAE@PBUEHExceptionRecord@@_N@Z"},{"address":{"type":"absolute","value":4426115},"name":"??1__ExceptionPtr@@QAE@XZ"},{"address":{"type":"absolute","value":4426306},"name":"?"},{"address":{"type":"absolute","value":4426335},"name":"?"},{"address":{"type":"absolute","value":4426415},"name":"?_CallCopyCtor@__ExceptionPtr@@ABEXPAX0IQBU_s_CatchableType@@@Z"},{"address":{"type":"absolute","value":4426558},"name":"__catch$?_CallCopyCtor@__ExceptionPtr@@ABEXPAX0IQBU_s_CatchableType@@@Z$0"},{"address":{"type":"absolute","value":4426564},"name":"?_CurrentException@__ExceptionPtr@@SA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ"},{"address":{"type":"absolute","value":4426659},"name":"__catch$?_CurrentException@__ExceptionPtr@@SA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ$0"},{"address":{"type":"absolute","value":4426700},"name":"__catch$?_CurrentException@__ExceptionPtr@@SA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ$1"},{"address":{"type":"absolute","value":4426706},"name":"?_Delete_this@?$_Ref_count_obj@V__ExceptionPtr@@@std@@EAEXXZ"},{"address":{"type":"absolute","value":4426736},"name":"?_Delete_this@?$_Ref_count_obj_alloc@V__ExceptionPtr@@U?$_StaticAllocator@H@@@std@@EAEXXZ"},{"address":{"type":"absolute","value":4426770},"name":"?_InitBadAllocException@__ExceptionPtr@@CA?AV?$shared_ptr@V__ExceptionPtr@@@std@@XZ"},{"address":{"type":"absolute","value":4426876},"name":"?_PlacementInitBadAllocException@__ExceptionPtr@@CGHPAX0PAPAX@Z"},{"address":{"type":"absolute","value":4426937},"name":"?_PopulateExceptionRecord@__ExceptionPtr@@SAPAUEHExceptionRecord@@AAU2@PBXPBU_s_ThrowInfo@@@Z"},{"address":{"type":"absolute","value":4427027},"name":"?_RethrowException@__ExceptionPtr@@QBEXXZ"},{"address":{"type":"absolute","value":4427262},"name":"?_StaticAlloc@@YAPAXI@Z"},{"address":{"type":"absolute","value":4427323},"name":"?__ExceptionPtrCopy@@YAXPAXPBX@Z"},{"address":{"type":"absolute","value":4427346},"name":"?__ExceptionPtrCreate@@YAXPAX@Z"},{"address":{"type":"absolute","value":4427361},"name":"?__ExceptionPtrCurrentException@@YAXPAX@Z"},{"address":{"type":"absolute","value":4427404},"name":"?__ExceptionPtrDestroy@@YAXPAX@Z"},{"address":{"type":"absolute","value":4427419},"name":"?__ExceptionPtrRethrow@@YAXPBX@Z"},{"address":{"type":"absolute","value":4427437},"name":"?align@std@@YAPAXIIAAPAXAAI@Z"},{"address":{"type":"absolute","value":4427504},"name":"_strrchr"},{"address":{"type":"absolute","value":4427824},"name":"_strchr"},{"address":{"type":"absolute","value":4428123},"name":"_wcschr"},{"address":{"type":"absolute","value":4428376},"name":"?FindMITargetTypeInstance@@YAPBU_s_RTTIBaseClassDescriptor@@PAXPBU_s_RTTICompleteObjectLocator@@PAUTypeDescriptor@@H2@Z"},{"address":{"type":"absolute","value":4428613},"name":"?FindSITargetTypeInstance@@YAPBU_s_RTTIBaseClassDescriptor@@PBU_s_RTTICompleteObjectLocator@@PAUTypeDescriptor@@1@Z"},{"address":{"type":"absolute","value":4428846},"name":"?FindVITargetTypeInstance@@YAPBU_s_RTTIBaseClassDescriptor@@PAXPBU_s_RTTICompleteObjectLocator@@PAUTypeDescriptor@@H2@Z"},{"address":{"type":"absolute","value":4429202},"name":"?PMDtoOffset@@YAHPAXABUPMD@@@Z"},{"address":{"type":"absolute","value":4429238},"name":"?TypeidsEqual@@YA_NQBUTypeDescriptor@@0@Z"},{"address":{"type":"absolute","value":4429364},"name":"___RTDynamicCast"},{"address":{"type":"absolute","value":4429676},"name":"__CIexp"},{"address":{"type":"absolute","value":4429760},"name":"__CIsqrt"},{"address":{"type":"absolute","value":4429789},"name":"start"},{"address":{"type":"absolute","value":4430656},"name":"__cintrindisp2"},{"address":{"type":"absolute","value":4430856},"name":"ctranexit"},{"address":{"type":"absolute","value":4430863},"name":"cintrinexit"},{"address":{"type":"absolute","value":4431295},"name":"fpload"},{"address":{"type":"absolute","value":4431312},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$0"},{"address":{"type":"absolute","value":4431320},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$1"},{"address":{"type":"absolute","value":4431331},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$2"},{"address":{"type":"absolute","value":4431342},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$3"},{"address":{"type":"absolute","value":4431353},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$4"},{"address":{"type":"absolute","value":4431364},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$5"},{"address":{"type":"absolute","value":4431375},"name":"__unwindfunclet$??0_Locinfo@std@@QAE@PBD@Z$6"},{"address":{"type":"absolute","value":4431386},"name":"__ehhandler$??0_Locinfo@std@@QAE@PBD@Z"},{"address":{"type":"absolute","value":4431496},"name":"__unwindfunclet$?DrawItem@CMFCButton@@UAEXPAUtagDRAWITEMSTRUCT@@@Z$0"},{"address":{"type":"absolute","value":4431504},"name":"__ehhandler$?DrawItem@CMFCButton@@UAEXPAUtagDRAWITEMSTRUCT@@@Z"},{"address":{"type":"absolute","value":4431936},"name":"__unwindfunclet$?propagate_message@?$_Greedy_node@W4agent_status@Concurrency@@@Concurrency@@MAE?AW4message_status@2@PAV?$message@W4agent_status@Concurrency@@@2@PAV?$ISource@W4agent_status@Concurrency@@@2@@Z$0"},{"address":{"type":"absolute","value":4431944},"name":"__ehhandler$?propagate_message@?$_Greedy_node@W4agent_status@Concurrency@@@Concurrency@@MAE?AW4message_status@2@PAV?$message@W4agent_status@Concurrency@@@2@PAV?$ISource@W4agent_status@Concurrency@@@2@@Z"},{"address":{"type":"absolute","value":4432040},"name":"__ehhandler$___std_fs_change_permissions@12"},{"address":{"type":"absolute","value":4432112},"name":"__unwindfunclet$??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z$0"},{"address":{"type":"absolute","value":4432140},"name":"__unwindfunclet$??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z$1"},{"address":{"type":"absolute","value":4432151},"name":"__ehhandler$??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z"},{"address":{"type":"absolute","value":4432320},"name":"__unwindfunclet$?__ExceptionPtrCopyException@@YAXPAXPBX1@Z$0"},{"address":{"type":"absolute","value":4432328},"name":"__ehhandler$?__ExceptionPtrCopyException@@YAXPAXPBX1@Z"},{"address":{"type":"absolute","value":4432416},"name":"__unwindfunclet$??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z$0"},{"address":{"type":"absolute","value":4432444},"name":"__ehhandler$??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z"},{"address":{"type":"absolute","value":4432488},"name":"__ehhandler$??1CMSPCallBase@@UAE@XZ"},{"address":{"type":"absolute","value":4432736},"name":"__ehhandler$?clear@?$vector@_NV?$allocator@_N@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4432864},"name":"__ehhandler$??$_Insert_range@PBE@?$vector@EV?$AllocatorWithCleanup@E$0A@@CryptoPP@@@std@@AAEXV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@E@std@@@std@@@1@PBE1Uforward_iterator_tag@1@@Z"},{"address":{"type":"absolute","value":4432945},"name":"__unwindfunclet$?OnDrawValue@CMFCPropertyGridColorProperty@@UAEXPAVCDC@@VCRect@@@Z$0"},{"address":{"type":"absolute","value":4432953},"name":"__ehhandler$?OnDrawValue@CMFCPropertyGridColorProperty@@UAEXPAVCDC@@VCRect@@@Z"},{"address":{"type":"absolute","value":4432990},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4432998},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433122},"name":"__unwindfunclet$?set@event@Concurrency@@QAEXXZ$0"},{"address":{"type":"absolute","value":4433130},"name":"__unwindfunclet$?set@event@Concurrency@@QAEXXZ$1"},{"address":{"type":"absolute","value":4433138},"name":"__ehhandler$?set@event@Concurrency@@QAEXXZ"},{"address":{"type":"absolute","value":4433210},"name":"__unwindfunclet$?wait@event@Concurrency@@QAEII@Z$0"},{"address":{"type":"absolute","value":4433218},"name":"__ehhandler$?wait@event@Concurrency@@QAEII@Z"},{"address":{"type":"absolute","value":4433245},"name":"__unwindfunclet$?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z$0"},{"address":{"type":"absolute","value":4433258},"name":"__unwindfunclet$?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z$1"},{"address":{"type":"absolute","value":4433266},"name":"__ehhandler$?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z"},{"address":{"type":"absolute","value":4433293},"name":"__unwindfunclet$?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z$0"},{"address":{"type":"absolute","value":4433301},"name":"__unwindfunclet$?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z$1"},{"address":{"type":"absolute","value":4433312},"name":"__ehhandler$?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z"},{"address":{"type":"absolute","value":4433342},"name":"__unwindfunclet$?try_lock_for@critical_section@Concurrency@@QAE_NI@Z$0"},{"address":{"type":"absolute","value":4433355},"name":"__ehhandler$?try_lock_for@critical_section@Concurrency@@QAE_NI@Z"},{"address":{"type":"absolute","value":4433382},"name":"__unwindfunclet$??0ResourceManager@details@Concurrency@@AAE@XZ$0"},{"address":{"type":"absolute","value":4433393},"name":"__unwindfunclet$??0ResourceManager@details@Concurrency@@AAE@XZ$1"},{"address":{"type":"absolute","value":4433404},"name":"__ehhandler$??0ResourceManager@details@Concurrency@@AAE@XZ"},{"address":{"type":"absolute","value":4433431},"name":"__unwindfunclet$?CaptureProcessAffinity@ResourceManager@details@Concurrency@@CAXXZ$2"},{"address":{"type":"absolute","value":4433444},"name":"__ehhandler$?CaptureProcessAffinity@ResourceManager@details@Concurrency@@CAXXZ"},{"address":{"type":"absolute","value":4433481},"name":"__unwindfunclet$?CreateAllocatedNodeData@ResourceManager@details@Concurrency@@QAEPAUSchedulerNode@23@XZ$0"},{"address":{"type":"absolute","value":4433510},"name":"__ehhandler$?CreateAllocatedNodeData@ResourceManager@details@Concurrency@@QAEPAUSchedulerNode@23@XZ"},{"address":{"type":"absolute","value":4433537},"name":"__unwindfunclet$?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z$0"},{"address":{"type":"absolute","value":4433545},"name":"__unwindfunclet$?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z$1"},{"address":{"type":"absolute","value":4433561},"name":"__ehhandler$?CreateSchedulerProxy@ResourceManager@details@Concurrency@@AAEPAVSchedulerProxy@23@PAUIScheduler@3@@Z"},{"address":{"type":"absolute","value":4433588},"name":"__unwindfunclet$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ$0"},{"address":{"type":"absolute","value":4433596},"name":"__unwindfunclet$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ$1"},{"address":{"type":"absolute","value":4433612},"name":"__unwindfunclet$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ$2"},{"address":{"type":"absolute","value":4433628},"name":"__ehhandler$?CreateSingleton@ResourceManager@details@Concurrency@@SAPAV123@XZ"},{"address":{"type":"absolute","value":4433717},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4433725},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433752},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4433760},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433884},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4433892},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4433919},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$0"},{"address":{"type":"absolute","value":4433927},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$1"},{"address":{"type":"absolute","value":4433938},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$2"},{"address":{"type":"absolute","value":4433949},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$3"},{"address":{"type":"absolute","value":4433960},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$4"},{"address":{"type":"absolute","value":4433971},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$5"},{"address":{"type":"absolute","value":4433982},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$6"},{"address":{"type":"absolute","value":4433993},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$7"},{"address":{"type":"absolute","value":4434007},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$8"},{"address":{"type":"absolute","value":4434021},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$9"},{"address":{"type":"absolute","value":4434035},"name":"__unwindfunclet$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z$10"},{"address":{"type":"absolute","value":4434049},"name":"__ehhandler$??0SchedulerBase@details@Concurrency@@QAE@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4434130},"name":"__unwindfunclet$?AllocateSegment@CacheLocalScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434146},"name":"__ehhandler$?AllocateSegment@CacheLocalScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4434173},"name":"__unwindfunclet$?AllocateSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434189},"name":"__ehhandler$?AllocateSegment@FairScheduleGroup@details@Concurrency@@MAEPAVScheduleGroupSegmentBase@23@PAVSchedulingRing@23@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4434216},"name":"__unwindfunclet$?GetBitSet@SchedulerBase@details@Concurrency@@QAE?AVQuickBitSet@23@PBVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434241},"name":"__ehhandler$?GetBitSet@SchedulerBase@details@Concurrency@@QAE?AVQuickBitSet@23@PBVlocation@3@@Z"},{"address":{"type":"absolute","value":4434311},"name":"__unwindfunclet$?GetExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z$0"},{"address":{"type":"absolute","value":4434327},"name":"__ehhandler$?GetExternalContext@SchedulerBase@details@Concurrency@@AAEPAVExternalContextBase@23@_N@Z"},{"address":{"type":"absolute","value":4434381},"name":"__unwindfunclet$?GetSubAllocator@SchedulerBase@details@Concurrency@@SAPAVSubAllocator@23@_N@Z$0"},{"address":{"type":"absolute","value":4434397},"name":"__ehhandler$?GetSubAllocator@SchedulerBase@details@Concurrency@@SAPAVSubAllocator@23@_N@Z"},{"address":{"type":"absolute","value":4434424},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$0"},{"address":{"type":"absolute","value":4434465},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$1"},{"address":{"type":"absolute","value":4434473},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$2"},{"address":{"type":"absolute","value":4434489},"name":"__unwindfunclet$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ$3"},{"address":{"type":"absolute","value":4434505},"name":"__ehhandler$?Initialize@SchedulerBase@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4434532},"name":"__unwindfunclet$?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z$0"},{"address":{"type":"absolute","value":4434545},"name":"__unwindfunclet$?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z$1"},{"address":{"type":"absolute","value":4434558},"name":"__ehhandler$?InternalCreateScheduleGroup@SchedulerBase@details@Concurrency@@AAEPAVScheduleGroup@3@PAVlocation@3@@Z"},{"address":{"type":"absolute","value":4434585},"name":"__unwindfunclet$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$0"},{"address":{"type":"absolute","value":4434593},"name":"__unwindfunclet$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$1"},{"address":{"type":"absolute","value":4434607},"name":"__unwindfunclet$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$2"},{"address":{"type":"absolute","value":4434621},"name":"__ehhandler$??0ContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4434758},"name":"__unwindfunclet$??0CFullScreenImpl@@QAE@PAVCFrameImpl@@@Z$0"},{"address":{"type":"absolute","value":4434769},"name":"__ehhandler$??0CFullScreenImpl@@QAE@PAVCFrameImpl@@@Z"},{"address":{"type":"absolute","value":4434823},"name":"__unwindfunclet$?_Alias@_TaskCollection@details@Concurrency@@AAEPAV123@XZ$0"},{"address":{"type":"absolute","value":4434839},"name":"__ehhandler$?_Alias@_TaskCollection@details@Concurrency@@AAEPAV123@XZ"},{"address":{"type":"absolute","value":4434901},"name":"__unwindfunclet$?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z$0"},{"address":{"type":"absolute","value":4434909},"name":"__unwindfunclet$?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z$1"},{"address":{"type":"absolute","value":4434917},"name":"__ehhandler$?_DeregisterCallback@_CancellationTokenState@details@Concurrency@@QAEXPAV_CancellationTokenRegistration@23@@Z"},{"address":{"type":"absolute","value":4434944},"name":"__unwindfunclet$?_FullAliasWait@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z$0"},{"address":{"type":"absolute","value":4434952},"name":"__ehhandler$?_FullAliasWait@_TaskCollection@details@Concurrency@@AAEXPAV123@@Z"},{"address":{"type":"absolute","value":4435016},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4435024},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4435051},"name":"__ehhandler$?clear@?$vector@_NV?$allocator@_N@std@@@std@@QAEXXZ"},{"address":{"type":"absolute","value":4435078},"name":"__unwindfunclet$??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z$0"},{"address":{"type":"absolute","value":4435089},"name":"__unwindfunclet$??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z$1"},{"address":{"type":"absolute","value":4435105},"name":"__ehhandler$??0SchedulerProxy@details@Concurrency@@QAE@PAUIScheduler@2@PAVResourceManager@12@ABVSchedulerPolicy@2@@Z"},{"address":{"type":"absolute","value":4435242},"name":"__unwindfunclet$?CreateVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@UAEPAVVirtualProcessorRoot@23@PAUSchedulerNode@23@I@Z$0"},{"address":{"type":"absolute","value":4435255},"name":"__ehhandler$?CreateVirtualProcessorRoot@SchedulerProxy@details@Concurrency@@UAEPAVVirtualProcessorRoot@23@PAUSchedulerNode@23@I@Z"},{"address":{"type":"absolute","value":4435400},"name":"__unwindfunclet$?Create@FreeThreadProxyFactory@details@Concurrency@@EAEPAVFreeThreadProxy@23@I@Z$0"},{"address":{"type":"absolute","value":4435413},"name":"__ehhandler$?Create@FreeThreadProxyFactory@details@Concurrency@@EAEPAVFreeThreadProxy@23@I@Z"},{"address":{"type":"absolute","value":4435489},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4435497},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4435524},"name":"__unwindfunclet$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z$0"},{"address":{"type":"absolute","value":4435532},"name":"__ehhandler$?VerifyMessage@PK_Verifier@CryptoPP@@UBE_NPBEI0I@Z"},{"address":{"type":"absolute","value":4435559},"name":"__unwindfunclet$?Dispatch@InternalContextBase@details@Concurrency@@UAEXPAUDispatchState@3@@Z$0"},{"address":{"type":"absolute","value":4435584},"name":"__ehhandler$?Dispatch@InternalContextBase@details@Concurrency@@UAEXPAUDispatchState@3@@Z"},{"address":{"type":"absolute","value":4435667},"name":"__unwindfunclet$??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z$0"},{"address":{"type":"absolute","value":4435678},"name":"__unwindfunclet$??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z$1"},{"address":{"type":"absolute","value":4435689},"name":"__ehhandler$??0SchedulingRing@details@Concurrency@@QAE@PAVSchedulerBase@12@H@Z"},{"address":{"type":"absolute","value":4435716},"name":"__unwindfunclet$??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z$0"},{"address":{"type":"absolute","value":4435727},"name":"__unwindfunclet$??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z$1"},{"address":{"type":"absolute","value":4435740},"name":"__ehhandler$??0?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@QAE@PAVSchedulerBase@12@ABVQuickBitSet@12@_NI@Z"},{"address":{"type":"absolute","value":4435802},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$0"},{"address":{"type":"absolute","value":4435813},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$1"},{"address":{"type":"absolute","value":4435821},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$2"},{"address":{"type":"absolute","value":4435832},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$3"},{"address":{"type":"absolute","value":4435843},"name":"__unwindfunclet$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z$4"},{"address":{"type":"absolute","value":4435857},"name":"__ehhandler$??0ScheduleGroupSegmentBase@details@Concurrency@@IAE@PAVScheduleGroupBase@12@PAVSchedulingRing@12@PAVlocation@2@@Z"},{"address":{"type":"absolute","value":4435922},"name":"__unwindfunclet$?DemandInitialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEXXZ$0"},{"address":{"type":"absolute","value":4435935},"name":"__ehhandler$?DemandInitialize@?$Mailbox@V_UnrealizedChore@details@Concurrency@@@details@Concurrency@@AAEXXZ"},{"address":{"type":"absolute","value":4436002},"name":"__unwindfunclet$??0ExternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z$0"},{"address":{"type":"absolute","value":4436010},"name":"__ehhandler$??0ExternalContextBase@details@Concurrency@@QAE@PAVSchedulerBase@12@_N@Z"},{"address":{"type":"absolute","value":4436037},"name":"__unwindfunclet$?Create@ThreadScheduler@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z$0"},{"address":{"type":"absolute","value":4436053},"name":"__ehhandler$?Create@ThreadScheduler@details@Concurrency@@SAPAV123@ABVSchedulerPolicy@3@@Z"},{"address":{"type":"absolute","value":4436080},"name":"__unwindfunclet$?CreateInternalContext@ThreadScheduler@details@Concurrency@@MAEPAVInternalContextBase@23@XZ$0"},{"address":{"type":"absolute","value":4436096},"name":"__ehhandler$?CreateInternalContext@ThreadScheduler@details@Concurrency@@MAEPAVInternalContextBase@23@XZ"},{"address":{"type":"absolute","value":4436123},"name":"__unwindfunclet$?CreateVirtualProcessor@ThreadScheduler@details@Concurrency@@UAEPAVVirtualProcessor@23@PAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z$0"},{"address":{"type":"absolute","value":4436139},"name":"__ehhandler$?CreateVirtualProcessor@ThreadScheduler@details@Concurrency@@UAEPAVVirtualProcessor@23@PAVSchedulingNode@23@PAUIVirtualProcessorRoot@3@@Z"},{"address":{"type":"absolute","value":4436263},"name":"__unwindfunclet$??0WorkQueue@details@Concurrency@@QAE@XZ$0"},{"address":{"type":"absolute","value":4436271},"name":"__unwindfunclet$??0WorkQueue@details@Concurrency@@QAE@XZ$1"},{"address":{"type":"absolute","value":4436282},"name":"__ehhandler$??0WorkQueue@details@Concurrency@@QAE@XZ"},{"address":{"type":"absolute","value":4436535},"name":"__ehhandler$?clear@?$vector@_NV?$allocator@_N@std@@@std@@QAEXXZ"}],"apicall_count":1307,"import_count":399}},"rules":{"hide graphical window":{"meta":{"name":"hide graphical window","namespace":"host-interaction/gui/window/hide","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Hide Artifacts","Hidden Window"],"tactic":"Defense Evasion","technique":"Hide Artifacts","subtechnique":"Hidden Window","id":"T1564.003"}],"mbc":[],"references":[],"examples":["39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: hide graphical window\n    namespace: host-interaction/gui/window/hide\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    att&ck:\n      - Defense Evasion::Hide Artifacts::Hidden Window [T1564.003]\n    examples:\n      - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250\n  features:\n    - and:\n      - number: 0x0 = SW_HIDE\n      - api: user32.ShowWindow\n","matches":[[{"type":"absolute","value":4204228},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"SW_HIDE"}},"children":[],"locations":[{"type":"absolute","value":4204228}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ShowWindow"}},"children":[],"locations":[{"type":"absolute","value":4204236}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4204349},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"SW_HIDE"}},"children":[],"locations":[{"type":"absolute","value":4204349}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ShowWindow"}},"children":[],"locations":[{"type":"absolute","value":4204357}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4207549},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"SW_HIDE"}},"children":[],"locations":[{"type":"absolute","value":4207557},{"type":"absolute","value":4207559},{"type":"absolute","value":4207751},{"type":"absolute","value":4207723},{"type":"absolute","value":4207596},{"type":"absolute","value":4207771},{"type":"absolute","value":4207670},{"type":"absolute","value":4207738},{"type":"absolute","value":4207611},{"type":"absolute","value":4207549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ShowWindow"}},"children":[],"locations":[{"type":"absolute","value":4207705}],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delay execution\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@ramen0x3f\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\n    examples:\n      - al-khaser_x86.exe_:0x449770\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.Sleep\n          - api: kernel32.SleepEx\n          - api: kernel32.WaitForSingleObject\n          - api: kernel32.SignalObjectAndWait\n          - api: kernel32.WaitForSingleObjectEx\n          - api: kernel32.WaitForMultipleObjects\n          - api: kernel32.WaitForMultipleObjectsEx\n          - api: kernel32.RegisterWaitForSingleObject\n          - api: WaitOnAddress\n          - api: user32.MsgWaitForMultipleObjects\n          - api: user32.MsgWaitForMultipleObjectsEx\n          - api: NtDelayExecution\n          - api: KeWaitForSingleObject\n          - api: KeDelayExecutionThread\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - or:\n          - api: sleep\n          - api: usleep\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4205930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4342566},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[{"type":"absolute","value":4342581}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4342589},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4342595}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4342778},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[{"type":"absolute","value":4342789}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: open process\n    authors:\n      - 0x534a@mailbox.org\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Open Process [C0065]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - or:\n      - api: kernel32.OpenProcess\n      - api: NtOpenProcess\n      - api: ZwOpenProcess\n","matches":[[{"type":"absolute","value":4207549},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4207745}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inspect load icon resource":{"meta":{"name":"inspect load icon resource","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\nrule:\n  meta:\n    name: inspect load icon resource\n    namespace: anti-analysis\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires mnemonic features\n  features:\n    # check if call to LoadIcon fails when first argument is NULL\n    # and second argument is not a valid predefined icon - LoadIcon\n    # should return NULL here, but some sandboxes/emulation may instead\n    # return a valid handle\n    - and:\n      - api: user32.LoadIcon\n      - number: 0x0\n      - mnemonic: test\n      - not:\n        - or:\n          - description: predefined icon identifiers\n          - number: 0x7F05 = IDI_WINLOGO\n          - number: 0x7F06 = IDI_SHIELD\n          - number: 0x7F02 = IDI_QUESTION\n          - number: 0x7F00 = IDI_APPLICATION\n          - number: 0x7F04 = (IDI_ASTERISK | IDI_INFORMATION)\n          - number: 0x7F01 = (IDI_ERROR | IDI_HAND)\n          - number: 0x7F03 = (IDI_EXCLAMATION | IDI_WARNING)\n","matches":[[{"type":"absolute","value":4207549},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadIcon"}},"children":[],"locations":[{"type":"absolute","value":4207685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4207557},{"type":"absolute","value":4207559},{"type":"absolute","value":4207751},{"type":"absolute","value":4207723},{"type":"absolute","value":4207596},{"type":"absolute","value":4207771},{"type":"absolute","value":4207670},{"type":"absolute","value":4207738},{"type":"absolute","value":4207611},{"type":"absolute","value":4207549}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"test"}},"children":[],"locations":[{"type":"absolute","value":4207795}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"not"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"predefined icon identifiers"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32517,"description":"IDI_WINLOGO"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32518,"description":"IDI_SHIELD"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32514,"description":"IDI_QUESTION"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32512,"description":"IDI_APPLICATION"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32516,"description":"(IDI_ASTERISK | IDI_INFORMATION)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32513,"description":"(IDI_ERROR | IDI_HAND)"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":32515,"description":"(IDI_EXCLAMATION | IDI_WARNING)"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check mutex":{"meta":{"name":"check mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Check Mutex"],"objective":"Process","behavior":"Check Mutex","method":"","id":"C0043"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check mutex\n    namespace: host-interaction/mutex\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Check Mutex [C0043]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - and:\n      - or:\n        - api: kernel32.OpenMutex\n        - match: create mutex\n        - api: System.Threading.Mutex::OpenExisting\n        - api: System.Threading.Mutex::TryOpenExisting\n      - optional:\n        - or:\n          - api: kernel32.GetLastError\n          - number: 2 = ERROR_FILE_NOT_FOUND\n          - number: 0xB7 = ERROR_ALREADY_EXISTS\n","matches":[[{"type":"absolute","value":4207814},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenMutex"}},"children":[],"locations":[{"type":"absolute","value":4207826}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create mutex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::OpenExisting"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::TryOpenExisting"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"ERROR_FILE_NOT_FOUND"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":183,"description":"ERROR_ALREADY_EXISTS"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"PEB access":{"meta":{"name":"PEB access","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block","id":"B0001.019"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp"],"examples":["al-khaser_x86.exe_:0x420D20"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: PEB access\n    authors:\n      - michael.hunhoff@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp\n    examples:\n      - al-khaser_x86.exe_:0x420D20\n  features:\n    - or:\n      - characteristic: peb access\n      - and:\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41\n        - arch: i386\n        - characteristic: fs access\n        - or:\n          # in 0f5d5d07c6533bc6d991836ce79daaa1\n          # then we have:\n          #\n          #     xor edx, edx\n          #     mov edx, fs:[edx+30h]\n          - offset: 0x30\n          - instruction:\n            # in the case of CallObfuscator, gs:[rax]\n            - mnemonic: add\n            - number: 0x30\n      - and:\n        - arch: amd64\n        - characteristic: gs access\n        - or:\n          - offset: 0x60\n          - instruction:\n            - mnemonic: add\n            - number: 0x60\n      - and:\n        # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45\n        - characteristic: fs access\n        - instruction:\n          - mnemonic: sub\n          - number: 0x2000\n","matches":[[{"type":"absolute","value":4217776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4217968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217978},{"type":"absolute","value":4218002}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217978},{"type":"absolute","value":4218002}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4218131},{"type":"absolute","value":4218014}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4361594},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4361624},{"type":"absolute","value":4361604},{"type":"absolute","value":4361767}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4361624},{"type":"absolute","value":4361604},{"type":"absolute","value":4361767}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4361742}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[{"type":"absolute","value":4361709}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"access PEB ldr_data":{"meta":{"name":"access PEB ldr_data","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm","https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8"],"examples":["3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: access PEB ldr_data\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    references:\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm\n      - https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8\n    examples:\n      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7\n  features:\n    - or:\n      - and:\n        - arch: i386\n        - description: x32\n\n        - match: PEB access\n\n        # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0\n        # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives\n\n        - offset: 0x0C = PEB.LDR_DATA\n\n        - or:\n          - description: resolve a module list\n          - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList\n          - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList\n          - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList\n\n      - and:\n        - arch: amd64\n        - description: x64\n\n        - match: PEB access\n\n        - offset: 0x18 = PEB.LDR_DATA\n\n        - or:\n          - description: resolve a module list\n          - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList\n          - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList\n          - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList\n","matches":[[{"type":"absolute","value":4217776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4217776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4217862},{"type":"absolute","value":4217919}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217862},{"type":"absolute","value":4217919}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217868}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217928},{"type":"absolute","value":4217874}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4217786},{"type":"absolute","value":4217806},{"type":"absolute","value":4217951}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4217776}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4217877}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217871}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217880},{"type":"absolute","value":4217901}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4217892},{"type":"absolute","value":4217910}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open file\n    authors:\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Create File [C0016]\n    examples:\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\n  features:\n    - or:\n      - api: CreateFile\n      - api: CreateFileEx\n      - api: IoCreateFile\n      - api: IoCreateFileEx\n      - api: ZwOpenFile\n      - api: ZwCreateFile\n      - api: NtOpenFile\n      - api: NtCreateFile\n      - api: LZCreateFile\n      - api: LZOpenFile\n      - api: fopen\n      - api: fopen64\n      - api: fdopen\n      - api: freopen\n      - api: open\n      - api: openat\n","matches":[[{"type":"absolute","value":4333998},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4334017}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create thread\n    namespace: host-interaction/thread/create\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Create Thread [C0038]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.CreateThread\n          - api: _beginthread\n          - api: _beginthreadex\n          - api: PsCreateSystemThread\n          - api: SHCreateThread\n          - api: SHCreateThreadWithHandle\n          - api: kernel32.CreateRemoteThread\n          - api: kernel32.CreateRemoteThreadEx\n          - api: RtlCreateUserThread\n          - api: ntdll.NtCreateThread\n          - api: ntdll.NtCreateThreadEx\n          - api: ntdll.ZwCreateThread\n          - api: ntdll.ZwCreateThreadEx\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - api: pthread_create\n      - and:\n        - api: System.Threading.Thread::Start\n        - optional:\n          - api: System.Threading.Thread::ctor\n","matches":[[{"type":"absolute","value":4341699},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[{"type":"absolute","value":4341720}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain loop\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    examples:\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - characteristic: loop\n      - characteristic: tight loop\n      - characteristic: recursive call\n","matches":[[{"type":"absolute","value":4200352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4200352}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4200896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4201744},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4201779}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4201856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4201891}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4202976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4203024}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4203104},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4203200}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4203280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4203365}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4204720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4204800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4204896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4205043}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4205440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4205568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4207024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4207104}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4207280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4207280}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4208288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4208496},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4208544}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4210000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4210000}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4213760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4213760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4213984},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4213984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4218688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4218688}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4218756}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4220384},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4220384}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4220976},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4220976}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4226132},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4226132}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4226834},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4226834}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4226853},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4226853}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4227444},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227484}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4229112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4229112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4247142},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4247142}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4247740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4247740}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4252787},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4252787}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266237},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4266237}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266313},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4266313}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266515},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4266724}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4266654},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4266724}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4278899},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4278899}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4297712},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4297374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300768},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300768}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302275},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302275}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4301404},{"type":"absolute","value":4301310}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305373},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305373}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4304987}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305824},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305824}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4330510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4330510}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4343531},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4343576}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4391855},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4391888}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4398750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4401716},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4401885}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4412625},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4412625}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4412864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4412864}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4372535}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4412876},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4412876}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436890},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227345}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227345}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436930},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4436930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436950},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4436950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4436960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4227345}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get common file path\n    namespace: host-interaction/file-system\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\n      - 972B219F18379907A045431303F4DA7D:0x404887\n  features:\n    - or:\n      - api: kernel32.GetTempPath\n      - api: kernel32.GetTempFileName\n      - api: kernel32.GetSystemDirectory\n      - api: kernel32.GetWindowsDirectory\n      - api: kernel32.GetSystemWow64Directory\n      - api: GetAllUsersProfileDirectory\n      - api: GetAppContainerFolderPath\n      - api: GetCurrentDirectory\n      - api: GetDefaultUserProfileDirectory\n      - api: GetProfilesDirectory\n      - api: GetUserProfileDirectory\n      - api: SHGetFolderPathAndSubDir\n      - api: shell32.SHGetFolderPath\n      - api: shell32.SHGetFolderLocation\n      - api: shell32.SHGetKnownFolderPath\n      - api: shell32.SHGetSpecialFolderPath\n      - api: shell32.SHGetSpecialFolderLocation\n      - api: System.IO.Directory::GetCurrentDirectory\n      - api: System.Environment::GetFolderPath\n      - property/read: System.Environment::SystemDirectory\n      - property/read: System.Environment::CurrentDirectory\n","matches":[[{"type":"absolute","value":4204896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4205001}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open clipboard":{"meta":{"name":"open clipboard","namespace":"host-interaction/clipboard","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Clipboard Data"],"tactic":"Collection","technique":"Clipboard Data","subtechnique":"","id":"T1115"}],"mbc":[],"references":[],"examples":["6f99a2c8944cb02ff28c6f9ced59b161:0x403180"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: open clipboard\n    namespace: host-interaction/clipboard\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Clipboard Data [T1115]\n    examples:\n      - 6f99a2c8944cb02ff28c6f9ced59b161:0x403180\n  features:\n    - and:\n      - api: user32.OpenClipboard\n      - optional:\n        - api: user32.CloseClipboard\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read clipboard data":{"meta":{"name":"read clipboard data","namespace":"host-interaction/clipboard","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Clipboard Data"],"tactic":"Collection","technique":"Clipboard Data","subtechnique":"","id":"T1115"}],"mbc":[],"references":["https://learn.microsoft.com/en-us/windows/win32/dataxchg/using-the-clipboard"],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x40156F","93dfc146f60bd796eb28d4e4f348f2e4:0x401050"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read clipboard data\n    namespace: host-interaction/clipboard\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Clipboard Data [T1115]\n    references:\n      - https://learn.microsoft.com/en-us/windows/win32/dataxchg/using-the-clipboard\n    examples:\n      - C91887D861D9BD4A5872249B641BC9F9:0x40156F\n      - 93dfc146f60bd796eb28d4e4f348f2e4:0x401050\n  features:\n    - and:\n      - optional:\n        - match: open clipboard\n        - match: contain loop\n        - api: kernel32.GlobalAlloc\n        - api: kernel32.GlobalLock\n        - api: kernel32.GlobalUnlock\n      - or:\n        - basic block:\n          - and:\n            - api: user32.GetClipboardData\n            - optional:\n              - number: 0x1 = CF_TEXT\n              - number: 0x7 = CF_OEMTEXT\n              - number: 0xD = CF_UNICODETEXT\n        - call:\n          - and:\n            - api: user32.GetClipboardData\n            - optional:\n              - number: 0x1 = CF_TEXT\n              - number: 0x7 = CF_OEMTEXT\n              - number: 0xD = CF_UNICODETEXT\n        - api: System.Windows.Forms.Clipboard::GetAudioStream\n        - api: System.Windows.Forms.Clipboard::GetData\n        - api: System.Windows.Forms.Clipboard::GetDataObject\n        - api: System.Windows.Forms.Clipboard::GetFileDropList\n        - api: System.Windows.Forms.Clipboard::GetImage\n        - api: System.Windows.Forms.Clipboard::GetText\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open clipboard"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalLock"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalUnlock"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetClipboardData"}},"children":[],"locations":[{"type":"absolute","value":4205946}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"CF_TEXT"}},"children":[],"locations":[{"type":"absolute","value":4206010},{"type":"absolute","value":4206114},{"type":"absolute","value":4205894}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":7,"description":"CF_OEMTEXT"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"CF_UNICODETEXT"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read clipboard data/3a5190ce854e47dfb75d31aa7e4fb774"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetAudioStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetData"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetDataObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetFileDropList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetText"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"capture screenshot via keybd event":{"meta":{"name":"capture screenshot via keybd event","namespace":"collection/screenshot","authors":["@_re_fox"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Screen Capture"],"tactic":"Collection","technique":"Screen Capture","subtechnique":"","id":"T1113"}],"mbc":[{"parts":["Collection","Screen Capture"],"objective":"Collection","behavior":"Screen Capture","method":"","id":"E1113"}],"references":[],"examples":["3f3bbcf8fd90bdcdcdc5494314ed4225:0x402D10"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: capture screenshot via keybd event\n    namespace: collection/screenshot\n    authors:\n      - \"@_re_fox\"\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Screen Capture [T1113]\n    mbc:\n      - Collection::Screen Capture [E1113]\n    examples:\n      - 3f3bbcf8fd90bdcdcdc5494314ed4225:0x402D10\n  features:\n    - and:\n      - or:\n        # static\n        - basic block:\n          - and:\n            - number: 0x2C = VK_SNAPSHOT\n            - count(api(user32.keybd_event)): 2\n            - or:\n              - number: 0x3 = KEYEVENTF_KEYUP|KEYEVENTF_EXTENDEDKEY\n              - number: 0x2 = KEYEVENTF_KEYUP\n        # dynamic\n        - call:\n          - and:\n            - number: 0x2C = VK_SNAPSHOT\n            - count(api(user32.keybd_event)): 2\n            - or:\n              - number: 0x3 = KEYEVENTF_KEYUP|KEYEVENTF_EXTENDEDKEY\n              - number: 0x2 = KEYEVENTF_KEYUP\n      - match: read clipboard data\n      - match: open clipboard\n","matches":[[{"type":"absolute","value":4205840},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"read clipboard data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open clipboard"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalLock"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalUnlock"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetClipboardData"}},"children":[],"locations":[{"type":"absolute","value":4205946}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"CF_TEXT"}},"children":[],"locations":[{"type":"absolute","value":4206010},{"type":"absolute","value":4206114},{"type":"absolute","value":4205894}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":7,"description":"CF_OEMTEXT"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"CF_UNICODETEXT"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read clipboard data/3a5190ce854e47dfb75d31aa7e4fb774"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetAudioStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetData"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetDataObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetFileDropList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Clipboard::GetText"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open clipboard"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205938}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseClipboard"}},"children":[],"locations":[{"type":"absolute","value":4205954}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":44,"description":"VK_SNAPSHOT"}},"children":[],"locations":[{"type":"absolute","value":4205914},{"type":"absolute","value":4205924}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":2,"child":{"type":"api","api":"keybd_event"}}},"children":[],"locations":[{"type":"absolute","value":4205916},{"type":"absolute","value":4205926}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"KEYEVENTF_KEYUP|KEYEVENTF_EXTENDEDKEY"}},"children":[],"locations":[{"type":"absolute","value":4205920}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"KEYEVENTF_KEYUP"}},"children":[],"locations":[{"type":"absolute","value":4205944}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4205840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"capture screenshot via keybd event/7a7999fc23144932a34ba7277a66fc43"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write file on Windows":{"meta":{"name":"write file on Windows","namespace":"host-interaction/file-system/write","authors":["william.ballenthin@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Writes File"],"objective":"File System","behavior":"Writes File","method":"","id":"C0052"}],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x4011FC","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: write file on Windows\n    namespace: host-interaction/file-system/write\n    authors:\n      - william.ballenthin@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Writes File [C0052]\n    examples:\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      # ntdll\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - basic block:\n            - or:\n              - number: 0x40000000 = GENERIC_WRITE\n              - number: 0x2 = FILE_WRITE_DATA\n              - match: create or open file\n          - call:\n            - or:\n              - number: 0x40000000 = GENERIC_WRITE\n              - number: 0x2 = FILE_WRITE_DATA\n              - match: create or open file\n        - or:\n          - api: kernel32.WriteFile\n          - api: kernel32.WriteFileEx\n          - api: NtWriteFile\n          - api: ZwWriteFile\n          - api: _fwrite\n          - api: fwrite\n      - api: System.IO.File::WriteAllBytes\n      - api: System.IO.File::WriteAllBytesAsync\n      - api: System.IO.File::WriteAllLines\n      - api: System.IO.File::WriteAllLinesAsync\n      - api: System.IO.File::WriteAllText\n      - api: System.IO.File::WriteAllTextAsync\n      - api: System.IO.File::AppendAllLines\n      - api: System.IO.File::AppendAllLinesAsync\n      - api: System.IO.File::AppendAllText\n      - api: System.IO.File::AppendAllTextAsync\n      - api: System.IO.File::AppendText\n      - api: System.IO.FileInfo::AppendText\n","matches":[[{"type":"absolute","value":4209488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/dd68c950ebff4e93af47de1cf45a4f58"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[{"type":"absolute","value":4209686}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":4209686}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4210832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/dd68c950ebff4e93af47de1cf45a4f58"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[{"type":"absolute","value":4211141}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":4211141}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4215952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"absolute","value":4216034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4216034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/ff421db42345474b9aeb82b5b507da4b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[{"type":"absolute","value":4216078}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[{"type":"absolute","value":4216078}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read file on Windows\n    namespace: host-interaction/file-system/read\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Read File [C0051]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - and:\n            - number: 0x80000000 = GENERIC_READ\n            - match: create or open file\n        - or:\n          - api: kernel32.ReadFile\n          - api: ReadFileEx\n          - api: NtReadFile\n          - api: ZwReadFile\n          - api: LZRead\n          - api: _read\n          - api: fread\n      - api: System.IO.File::ReadAllBytes\n      - api: System.IO.File::ReadAllBytesAsync\n      - api: System.IO.File::ReadAllLines\n      - api: System.IO.File::ReadAllLinesAsync\n      - api: System.IO.File::ReadAllText\n      - api: System.IO.File::ReadAllTextAsync\n      - api: System.IO.File::ReadLines\n","matches":[[{"type":"absolute","value":4209728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[{"type":"absolute","value":4209953}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4296367},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[{"type":"absolute","value":4296136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: link function at runtime on Windows\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\n  features:\n    - and:\n      - os: windows\n      - or:\n        - api: kernel32.GetProcAddress\n        - api: ntdll.LdrGetProcedureAddress\n      - optional:\n        - characteristic: indirect call\n        - api: kernel32.LoadLibrary\n        - api: kernel32.GetModuleHandle\n        - api: kernel32.GetModuleHandleEx\n        - api: ntdll.LdrLoadDll\n","matches":[[{"type":"absolute","value":4284455},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4284471}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4284494},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4284471}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set environment variable":{"meta":{"name":"set environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Environment Variable","Set Variable"],"objective":"Operating System","behavior":"Environment Variable","method":"Set Variable","id":"C0034.001"}],"references":[],"examples":["0731679c5f99e8ee65d8b29a3cabfc6b:0x43EA81"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set environment variable\n    namespace: host-interaction/environment-variable\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Operating System::Environment Variable::Set Variable [C0034.001]\n    examples:\n      - 0731679c5f99e8ee65d8b29a3cabfc6b:0x43EA81\n  features:\n    - or:\n      - api: kernel32.SetEnvironmentStrings\n      - api: kernel32.SetEnvironmentVariable\n      - api: System.Environment::SetEnvironmentVariable\n","matches":[[{"type":"absolute","value":4305373},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":4305065}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::SetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get thread local storage value":{"meta":{"name":"get thread local storage value","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get thread local storage value\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n  features:\n    - and:\n      - api: kernel32.TlsGetValue\n","matches":[[{"type":"absolute","value":4342684},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TlsGetValue"}},"children":[],"locations":[{"type":"absolute","value":4342690}],"captures":{}}],"locations":[],"captures":{}}]]},"set thread local storage value":{"meta":{"name":"set thread local storage value","namespace":"host-interaction/thread/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Set Thread Local Storage Value"],"objective":"Process","behavior":"Set Thread Local Storage Value","method":"","id":"C0041"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x18000AE21"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set thread local storage value\n    namespace: host-interaction/thread/tls\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Process::Set Thread Local Storage Value [C0041]\n    examples:\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x18000AE21\n  features:\n    - and:\n      - api: kernel32.TlsSetValue\n      - optional:\n        - match: allocate thread local storage\n","matches":[[{"type":"absolute","value":4342698},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TlsSetValue"}},"children":[],"locations":[{"type":"absolute","value":4342710}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate thread local storage"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference analysis tools strings\n    namespace: anti-analysis\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    mbc:\n      - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /ollydbg(\\.exe)?/i\n      - string: /ProcessHacker(\\.exe)?/i\n      - string: /tcpview(\\.exe)?/i\n      - string: /autoruns(\\.exe)?/i\n      - string: /autorunsc(\\.exe)?/i\n      - string: /filemon(\\.exe)?/i\n      - string: /procmon(\\.exe)?/i\n      - string: /regmon(\\.exe)?/i\n      - string: /procexp(\\.exe)?/i\n      - string: /(?<!\\w)ida[gqtuw]?(\\.exe)?$/i\n      - string: /ida[gqtuw]?64(\\.exe)?$/i\n      - string: /ImmunityDebugger(\\.exe)?/i\n      - string: /Wireshark(\\.exe)?/i\n      - string: /dumpcap(\\.exe)?/i\n      - string: /HookExplorer(\\.exe)?/i\n      - string: /ImportREC(\\.exe)?/i\n      - string: /PETools(\\.exe)?/i\n      - string: /LordPE(\\.exe)?/i\n      - string: /SysInspector(\\.exe)?/i\n      - string: /proc_analyzer(\\.exe)?/i\n      - string: /sysAnalyzer(\\.exe)?/i\n      - string: /sniff_hit(\\.exe)?/i\n      - string: /windbg(\\.exe)?/i\n      - string: /joeboxcontrol(\\.exe)?/i\n      - string: /joeboxserver(\\.exe)?/i\n      - string: /ResourceHacker(\\.exe)?/i\n      - string: /x32dbg(\\.exe)?/i\n      - string: /x64dbg(\\.exe)?/i\n      - string: /Fiddler(\\.exe)?/i\n      - string: /httpdebugger(\\.exe)?/i\n      - string: /fakenet(\\.exe)?/i\n      - string: /netmon(\\.exe)?/i\n      - string: /WPE PRO(\\.exe)?/i\n      - string: /decompile(\\.exe)?/i\n      - string: /scylla/i\n      - string: /megadumper/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/(?<!\\w)ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":366769}],"captures":{"IDAT":[{"type":"file","value":366769}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?64(\\.exe)?$/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"linked against CPP standard library":{"meta":{"name":"linked against CPP standard library","namespace":"linking/static","authors":["@mr-tz"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":["https://en.wikipedia.org/wiki/P._J._Plauger","https://www.dinkumware.com/"],"examples":["03b236b23b1ec37c663527c1f53af3fe"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: linked against CPP standard library\n    namespace: linking/static\n    authors:\n      - \"@mr-tz\"\n    scopes:\n      static: file\n      dynamic: file\n    references:\n      - https://en.wikipedia.org/wiki/P._J._Plauger\n      - https://www.dinkumware.com/\n    examples:\n      - 03b236b23b1ec37c663527c1f53af3fe\n  features:\n    - or:\n      - string: \"Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\"\n      - string: \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\"\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."}},"children":[],"locations":[{"type":"file","value":324128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
diff --git a/rd/Practical Malware Analysis Lab 01-01.dll_.json b/rd/Practical Malware Analysis Lab 01-01.dll_.json
index e44e9ed..1fd8f1f 100644
--- a/rd/Practical Malware Analysis Lab 01-01.dll_.json	
+++ b/rd/Practical Malware Analysis Lab 01-01.dll_.json	
@@ -1 +1 @@
-{"meta":{"timestamp":"2024-03-02T04:12:18.077282","version":"7.0.1","argv":["./tests/data/Practical Malware Analysis Lab 01-01.dll_","-j"],"sample":{"md5":"290934c61de9176ad682ffdd65f0a669","sha1":"a4b35de71ca20fe776dc72d12fb2886736f43c22","sha256":"f50e42c8dfaab649bde0398867e930b86c2a599e8db83b8260393082268f2dba","path":"C:/Users/HP/Documents/GitHub/capa/tests/data/Practical Malware Analysis Lab 01-01.dll_"},"flavor":"static","analysis":{"format":"pe","arch":"i386","os":"windows","extractor":"VivisectFeatureExtractor","rules":["C:/Users/HP/Documents/GitHub/capa/rules"],"base_address":{"type":"absolute","value":268435456},"layout":{"functions":[{"address":{"type":"absolute","value":268439568},"matched_basic_blocks":[{"address":{"type":"absolute","value":268439598}},{"address":{"type":"absolute","value":268439692}},{"address":{"type":"absolute","value":268439715}},{"address":{"type":"absolute","value":268439868}},{"address":{"type":"absolute","value":268439892}},{"address":{"type":"absolute","value":268439905}},{"address":{"type":"absolute","value":268439929}},{"address":{"type":"absolute","value":268440000}},{"address":{"type":"absolute","value":268440040}}]}]},"feature_counts":{"file":128,"functions":[{"address":{"type":"absolute","value":268439568},"count":142},{"address":{"type":"absolute","value":268440472},"count":7}]},"library_functions":[{"address":{"type":"absolute","value":268440096},"name":"__alloca_probe"},{"address":{"type":"absolute","value":268440143},"name":"__CRT_INIT@12"},{"address":{"type":"absolute","value":268440314},"name":"__DllMainCRTStartup@12"}]}},"rules":{"check mutex":{"meta":{"name":"check mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Check Mutex"],"objective":"Process","behavior":"Check Mutex","method":"","id":"C0043"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check mutex\r\n    namespace: host-interaction/mutex\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Check Mutex [C0043]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: kernel32.OpenMutex\r\n        - match: create mutex\r\n        - api: System.Threading.Mutex::OpenExisting\r\n        - api: System.Threading.Mutex::TryOpenExisting\r\n      - optional:\r\n        - or:\r\n          - api: kernel32.GetLastError\r\n          - number: 2 = ERROR_FILE_NOT_FOUND\r\n          - number: 0xB7 = ERROR_ALREADY_EXISTS\r\n","matches":[[{"type":"absolute","value":268439598},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenMutex"}},"children":[],"locations":[{"type":"absolute","value":268439641}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create mutex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::OpenExisting"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::TryOpenExisting"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"ERROR_FILE_NOT_FOUND"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":183,"description":"ERROR_ALREADY_EXISTS"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create TCP socket":{"meta":{"name":"create TCP socket","namespace":"communication/socket/tcp","authors":["william.ballenthin@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Create TCP Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Create TCP Socket","id":"C0001.011"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create TCP socket\r\n    namespace: communication/socket/tcp\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - joakim@intezer.com\r\n      - anushka.virgaonkar@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Communication::Socket Communication::Create TCP Socket [C0001.011]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - and:\r\n        - number: 6 = IPPROTO_TCP\r\n        - number: 1 = SOCK_STREAM\r\n        - number: 2 = AF_INET\r\n        - or:\r\n          - api: ws2_32.socket\r\n          - api: ws2_32.WSASocket\r\n          - api: socket\r\n          - api: System.Net.Sockets.Socket::ctor\r\n      - property/read: System.Net.Sockets.TcpClient::Client\r\n","matches":[[{"type":"absolute","value":268439692},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delay execution\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@ramen0x3f\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449770\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.Sleep\r\n          - api: kernel32.SleepEx\r\n          - api: kernel32.WaitForSingleObject\r\n          - api: kernel32.SignalObjectAndWait\r\n          - api: kernel32.WaitForSingleObjectEx\r\n          - api: kernel32.WaitForMultipleObjects\r\n          - api: kernel32.WaitForMultipleObjectsEx\r\n          - api: kernel32.RegisterWaitForSingleObject\r\n          - api: WaitOnAddress\r\n          - api: user32.MsgWaitForMultipleObjects\r\n          - api: user32.MsgWaitForMultipleObjectsEx\r\n          - api: NtDelayExecution\r\n          - api: KeWaitForSingleObject\r\n          - api: KeDelayExecutionThread\r\n      - and:\r\n        - os: linux\r\n        - or:\r\n          - api: sleep\r\n          - api: usleep\r\n","matches":[[{"type":"absolute","value":268439892},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":268439897}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":268440000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":268440005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create process on Windows":{"meta":{"name":"create process on Windows","namespace":"host-interaction/process/create","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x406DB0","Practical Malware Analysis Lab 01-04.exe_:0x4011FC","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create process on Windows\r\n    namespace: host-interaction/process/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Process [C0017]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: kernel32.WinExec\r\n      - api: kernel32.CreateProcess\r\n      - api: shell32.ShellExecute\r\n      - api: shell32.ShellExecuteEx\r\n      - api: advapi32.CreateProcessAsUser\r\n      - api: advapi32.CreateProcessWithLogon\r\n      - api: advapi32.CreateProcessWithToken\r\n      - api: kernel32.CreateProcessInternal\r\n      - api: ntdll.NtCreateUserProcess\r\n      - api: ntdll.NtCreateProcess\r\n      - api: ntdll.NtCreateProcessEx\r\n      - api: ntdll.ZwCreateProcess\r\n      - api: ZwCreateProcessEx\r\n      - api: ntdll.ZwCreateUserProcess\r\n      - api: ntdll.RtlCreateUserProcess\r\n      - api: System.Diagnostics.Process::Start\r\n","matches":[[{"type":"absolute","value":268439929},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":268439983}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send data on socket":{"meta":{"name":"send data on socket","namespace":"communication/socket/send","authors":["moritz.raabe@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Send Data"],"objective":"Communication","behavior":"Socket Communication","method":"Send Data","id":"C0001.007"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send data on socket\r\n    namespace: communication/socket/send\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - joakim@intezer.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Communication::Socket Communication::Send Data [C0001.007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - api: ws2_32.send\r\n      - api: ws2_32.sendto\r\n      - api: ws2_32.WSASend\r\n      - api: ws2_32.WSASendMsg\r\n      - api: ws2_32.WSASendTo\r\n      - api: send\r\n      - api: System.Net.Sockets.Socket::Send\r\n      - api: System.Net.Sockets.Socket::SendAsync\r\n      - api: System.Net.Sockets.Socket::SendTo\r\n      - api: System.Net.Sockets.Socket::SendToAsync\r\n      - api: System.Net.Sockets.UdpClient::Send\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendToAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::Send"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"initialize Winsock library":{"meta":{"name":"initialize Winsock library","namespace":"communication/socket","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Initialize Winsock Library"],"objective":"Communication","behavior":"Socket Communication","method":"Initialize Winsock Library","id":"C0001.009"}],"references":[],"examples":["6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001D30"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: initialize Winsock library\r\n    namespace: communication/socket\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Communication::Socket Communication::Initialize Winsock Library [C0001.009]\r\n    examples:\r\n      - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001D30\r\n  features:\r\n    - and:\r\n      - api: ws2_32.WSAStartup\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WSAStartup"}},"children":[],"locations":[{"type":"absolute","value":268439678}],"captures":{}}],"locations":[],"captures":{}}]]},"create mutex":{"meta":{"name":"create mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Mutex"],"objective":"Process","behavior":"Create Mutex","method":"","id":"C0042"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create mutex\r\n    namespace: host-interaction/mutex\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Mutex [C0042]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - api: kernel32.CreateMutex\r\n      - api: kernel32.CreateMutexEx\r\n      - api: System.Threading.Mutex::ctor\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutex"}},"children":[],"locations":[{"type":"absolute","value":268439662}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutexEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain loop\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    examples:\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - characteristic: loop\r\n      - characteristic: tight loop\r\n      - characteristic: recursive call\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"receive data on socket":{"meta":{"name":"receive data on socket","namespace":"communication/socket/receive","authors":["moritz.raabe@mandiant.com","joakim@intezer.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Receive Data"],"objective":"Communication","behavior":"Socket Communication","method":"Receive Data","id":"C0001.006"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: receive data on socket\r\n    namespace: communication/socket/receive\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - joakim@intezer.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Communication::Socket Communication::Receive Data [C0001.006]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - api: ws2_32.recv\r\n      - api: ws2_32.recvfrom\r\n      - api: ws2_32.WSARecv\r\n      - api: ws2_32.WSARecvDisconnect\r\n      - api: ws2_32.WSARecvEx\r\n      - api: ws2_32.WSARecvFrom\r\n      - api: ws2_32.WSARecvMsg\r\n      - api: recv\r\n      - api: System.Net.Sockets.Socket::Receive\r\n      - api: System.Net.Sockets.Socket::ReceiveAsync\r\n      - api: System.Net.Sockets.Socket::ReceiveFrom\r\n      - api: System.Net.Sockets.Socket::ReceiveFromAsync\r\n      - api: System.Net.Sockets.Socket::ReceiveMessageFrom\r\n      - api: System.Net.Sockets.Socket::ReceiveMessageFromAsync\r\n      - api: System.Net.Sockets.Socket::BeginReceive\r\n      - api: System.Net.Sockets.Socket::BeginReceiveFrom\r\n      - api: System.Net.Sockets.Socket::BeginReceiveMessageFrom\r\n      - api: System.Net.Sockets.Socket::EndReceive\r\n      - api: System.Net.Sockets.Socket::EndReceiveFrom\r\n      - api: System.Net.Sockets.Socket::EndReceiveMessageFrom\r\n      - api: recvmsg\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvfrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvDisconnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvMsg"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Receive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvmsg"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send data":{"meta":{"name":"send data","namespace":"communication","authors":["william.ballenthin@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Command and Control","C2 Communication","Send Data"],"objective":"Command and Control","behavior":"C2 Communication","method":"Send Data","id":"B0030.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60"],"description":"all known techniques for sending data to a potential C2 server","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send data\r\n    namespace: communication\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - joakim@intezer.com\r\n    description: all known techniques for sending data to a potential C2 server\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Command and Control::C2 Communication::Send Data [B0030.001]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - match: send HTTP request\r\n          - match: send data on socket\r\n          - match: send file via HTTP\r\n          - match: send data to Internet\r\n      - and:\r\n        - os: linux\r\n        - or: # Require network bound socket.\r\n          - match: create TCP socket\r\n          - match: create UDP socket\r\n        - or:\r\n          - match: send HTTP request\r\n          - match: send data on socket\r\n          - match: send file via HTTP\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendToAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::Send"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data to Internet"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create UDP socket"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendToAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::Send"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"receive data":{"meta":{"name":"receive data","namespace":"communication","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Command and Control","C2 Communication","Receive Data"],"objective":"Command and Control","behavior":"C2 Communication","method":"Receive Data","id":"B0030.002"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60"],"description":"all known techniques for receiving data from a potential C2 server","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: receive data\r\n    namespace: communication\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    description: all known techniques for receiving data from a potential C2 server\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Command and Control::C2 Communication::Receive Data [B0030.002]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\r\n  features:\r\n    - or:\r\n      - match: receive data on socket\r\n      - match: read data from Internet\r\n      - match: download URL\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"receive data on socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvfrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvDisconnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvMsg"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Receive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvmsg"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read data from Internet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"download URL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"connect TCP socket":{"meta":{"name":"connect TCP socket","namespace":"communication/socket/tcp","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Connect Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Connect Socket","id":"C0001.004"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: connect TCP socket\r\n    namespace: communication/socket/tcp\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - joakim@intezer.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::Socket Communication::Connect Socket [C0001.004]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - and:\r\n      - match: create TCP socket\r\n      - or:\r\n        - api: connect\r\n        - api: ws2_32.connect\r\n        - api: ws2_32.WSAConnect\r\n        - api: ConnectEx\r\n        - or:\r\n          - and:\r\n            # static\r\n            - basic block:\r\n              # candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e\r\n              - and:\r\n                - number: 0x25A207B9\r\n                - number: 0x4660DDF3\r\n                - number: 0xE576E98E\r\n                - number: 0x3E06748C\r\n            - basic block:\r\n              - and:\r\n                - api: WSAIoctl\r\n                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER\r\n            - basic block:\r\n              - and:\r\n                - api: setsockopt\r\n                - number: 0xFFFF = SOL_SOCKET\r\n                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT\r\n            # socket must be bound to ConnectEx\r\n            # https://gist.github.com/joeyadams/4158972\r\n            - api: bind\r\n          - and:\r\n            # dynamic\r\n            - call:\r\n              - and:\r\n                - api: WSAIoctl\r\n                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER\r\n            - call:\r\n              - and:\r\n                - api: setsockopt\r\n                - number: 0xFFFF = SOL_SOCKET\r\n                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT\r\n            # socket must be bound to ConnectEx\r\n            # https://gist.github.com/joeyadams/4158972\r\n            - api: bind\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSAConnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ConnectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/0b7de8a6318443cc9720290a2b44f4d0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/59eebe50ff3e416399c0eabfdf8502a7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/9dfde07ac96a4a0383528e1ec48754a4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/b524bc633fc4426f868510c95b3dc96e"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/32abf8e3d08b418d85363ab7f567f6fe"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"act as TCP client":{"meta":{"name":"act as TCP client","namespace":"communication/tcp/client","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","TCP Client"],"objective":"Communication","behavior":"Socket Communication","method":"TCP Client","id":"C0001.008"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: act as TCP client\r\n    namespace: communication/tcp/client\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::Socket Communication::TCP Client [C0001.008]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - match: connect TCP socket\r\n      - api: System.Net.Sockets.TcpClient::ctor\r\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSAConnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ConnectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/0b7de8a6318443cc9720290a2b44f4d0"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/59eebe50ff3e416399c0eabfdf8502a7"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/9dfde07ac96a4a0383528e1ec48754a4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/b524bc633fc4426f868510c95b3dc96e"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/32abf8e3d08b418d85363ab7f567f6fe"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.TcpClient::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
+{"meta":{"timestamp":"2024-06-10T17:53:45.994042","version":"7.0.1","argv":["./tests/data/Practical Malware Analysis Lab 01-01.dll_","--json"],"sample":{"md5":"290934c61de9176ad682ffdd65f0a669","sha1":"a4b35de71ca20fe776dc72d12fb2886736f43c22","sha256":"f50e42c8dfaab649bde0398867e930b86c2a599e8db83b8260393082268f2dba","path":"/Users/fariss/Desktop/capa/tests/data/Practical Malware Analysis Lab 01-01.dll_"},"flavor":"static","analysis":{"format":"pe","arch":"i386","os":"windows","extractor":"VivisectFeatureExtractor","rules":["/Users/fariss/Desktop/capa/rules"],"base_address":{"type":"absolute","value":268435456},"layout":{"functions":[{"address":{"type":"absolute","value":268439568},"matched_basic_blocks":[{"address":{"type":"absolute","value":268439598}},{"address":{"type":"absolute","value":268439692}},{"address":{"type":"absolute","value":268439715}},{"address":{"type":"absolute","value":268439868}},{"address":{"type":"absolute","value":268439892}},{"address":{"type":"absolute","value":268439905}},{"address":{"type":"absolute","value":268439929}},{"address":{"type":"absolute","value":268440000}},{"address":{"type":"absolute","value":268440040}}]}]},"feature_counts":{"file":128,"functions":[{"address":{"type":"absolute","value":268439568},"count":142},{"address":{"type":"absolute","value":268440472},"count":7}]},"library_functions":[{"address":{"type":"absolute","value":268440096},"name":"__alloca_probe"},{"address":{"type":"absolute","value":268440143},"name":"__CRT_INIT@12"},{"address":{"type":"absolute","value":268440314},"name":"__DllMainCRTStartup@12"}],"apicall_count":23,"import_count":46}},"rules":{"check mutex":{"meta":{"name":"check mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Check Mutex"],"objective":"Process","behavior":"Check Mutex","method":"","id":"C0043"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check mutex\n    namespace: host-interaction/mutex\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Check Mutex [C0043]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - and:\n      - or:\n        - api: kernel32.OpenMutex\n        - match: create mutex\n        - api: System.Threading.Mutex::OpenExisting\n        - api: System.Threading.Mutex::TryOpenExisting\n      - optional:\n        - or:\n          - api: kernel32.GetLastError\n          - number: 2 = ERROR_FILE_NOT_FOUND\n          - number: 0xB7 = ERROR_ALREADY_EXISTS\n","matches":[[{"type":"absolute","value":268439598},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenMutex"}},"children":[],"locations":[{"type":"absolute","value":268439641}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create mutex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::OpenExisting"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::TryOpenExisting"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"ERROR_FILE_NOT_FOUND"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":183,"description":"ERROR_ALREADY_EXISTS"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create TCP socket":{"meta":{"name":"create TCP socket","namespace":"communication/socket/tcp","authors":["william.ballenthin@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Create TCP Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Create TCP Socket","id":"C0001.011"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create TCP socket\n    namespace: communication/socket/tcp\n    authors:\n      - william.ballenthin@mandiant.com\n      - joakim@intezer.com\n      - anushka.virgaonkar@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Communication::Socket Communication::Create TCP Socket [C0001.011]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - and:\n        - number: 6 = IPPROTO_TCP\n        - number: 1 = SOCK_STREAM\n        - number: 2 = AF_INET\n        - or:\n          - api: socket\n          - api: ws2_32.socket\n          - api: ws2_32.#23 = socket\n          - api: ws2_32.WSASocket\n          - api: ws2_32.#82 = WSASocketA\n          - api: ws2_32.#83 = WSASocketW\n          - api: System.Net.Sockets.Socket::ctor\n      - property/read: System.Net.Sockets.TcpClient::Client\n","matches":[[{"type":"absolute","value":268439692},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#23","description":"socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#82","description":"WSASocketA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#83","description":"WSASocketW"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delay execution\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@ramen0x3f\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\n    examples:\n      - al-khaser_x86.exe_:0x449770\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.Sleep\n          - api: kernel32.SleepEx\n          - api: kernel32.WaitForSingleObject\n          - api: kernel32.SignalObjectAndWait\n          - api: kernel32.WaitForSingleObjectEx\n          - api: kernel32.WaitForMultipleObjects\n          - api: kernel32.WaitForMultipleObjectsEx\n          - api: kernel32.RegisterWaitForSingleObject\n          - api: WaitOnAddress\n          - api: user32.MsgWaitForMultipleObjects\n          - api: user32.MsgWaitForMultipleObjectsEx\n          - api: NtDelayExecution\n          - api: KeWaitForSingleObject\n          - api: KeDelayExecutionThread\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - or:\n          - api: sleep\n          - api: usleep\n","matches":[[{"type":"absolute","value":268439892},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":268439897}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":268440000},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":268440005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create process on Windows":{"meta":{"name":"create process on Windows","namespace":"host-interaction/process/create","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x406DB0","Practical Malware Analysis Lab 01-04.exe_:0x4011FC","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create process on Windows\n    namespace: host-interaction/process/create\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Create Process [C0017]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: kernel32.WinExec\n      - api: kernel32.CreateProcess\n      - api: shell32.ShellExecute\n      - api: shell32.ShellExecuteEx\n      - api: advapi32.CreateProcessAsUser\n      - api: advapi32.CreateProcessWithLogon\n      - api: advapi32.CreateProcessWithToken\n      - api: kernel32.CreateProcessInternal\n      - api: ntdll.NtCreateUserProcess\n      - api: ntdll.NtCreateProcess\n      - api: ntdll.NtCreateProcessEx\n      - api: ntdll.ZwCreateProcess\n      - api: ZwCreateProcessEx\n      - api: ntdll.ZwCreateUserProcess\n      - api: ntdll.RtlCreateUserProcess\n      - api: System.Diagnostics.Process::Start\n","matches":[[{"type":"absolute","value":268439929},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":268439983}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain loop\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    examples:\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - characteristic: loop\n      - characteristic: tight loop\n      - characteristic: recursive call\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"receive data on socket":{"meta":{"name":"receive data on socket","namespace":"communication/socket/receive","authors":["moritz.raabe@mandiant.com","joakim@intezer.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Receive Data"],"objective":"Communication","behavior":"Socket Communication","method":"Receive Data","id":"C0001.006"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: receive data on socket\n    namespace: communication/socket/receive\n    authors:\n      - moritz.raabe@mandiant.com\n      - joakim@intezer.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Communication::Socket Communication::Receive Data [C0001.006]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - api: recv\n      - api: ws2_32.recv\n      - api: ws2_32.#16 = recv\n      - api: ws2_32.recvfrom\n      - api: ws2_32.#17 = recvfrom\n      - api: ws2_32.WSARecv\n      - api: ws2_32.#71 = WSARecv\n      - api: ws2_32.WSARecvDisconnect\n      - api: ws2_32.#72 = WSARecvDisconnect\n      - api: ws2_32.WSARecvEx\n      - api: ws2_32.WSARecvFrom\n      - api: ws2_32.#73 = WSARecvFrom\n      - api: ws2_32.WSARecvMsg\n      - api: recvmsg\n      - api: System.Net.Sockets.Socket::Receive\n      - api: System.Net.Sockets.Socket::ReceiveAsync\n      - api: System.Net.Sockets.Socket::ReceiveFrom\n      - api: System.Net.Sockets.Socket::ReceiveFromAsync\n      - api: System.Net.Sockets.Socket::ReceiveMessageFrom\n      - api: System.Net.Sockets.Socket::ReceiveMessageFromAsync\n      - api: System.Net.Sockets.Socket::BeginReceive\n      - api: System.Net.Sockets.Socket::BeginReceiveFrom\n      - api: System.Net.Sockets.Socket::BeginReceiveMessageFrom\n      - api: System.Net.Sockets.Socket::EndReceive\n      - api: System.Net.Sockets.Socket::EndReceiveFrom\n      - api: System.Net.Sockets.Socket::EndReceiveMessageFrom\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#16","description":"recv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvfrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#17","description":"recvfrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#71","description":"WSARecv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvDisconnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#72","description":"WSARecvDisconnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#73","description":"WSARecvFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvmsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Receive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"receive data":{"meta":{"name":"receive data","namespace":"communication","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Command and Control","C2 Communication","Receive Data"],"objective":"Command and Control","behavior":"C2 Communication","method":"Receive Data","id":"B0030.002"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60"],"description":"all known techniques for receiving data from a potential C2 server","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: receive data\n    namespace: communication\n    authors:\n      - william.ballenthin@mandiant.com\n    description: all known techniques for receiving data from a potential C2 server\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Command and Control::C2 Communication::Receive Data [B0030.002]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\n  features:\n    - or:\n      - match: receive data on socket\n      - match: read data from Internet\n      - match: download URL\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"receive data on socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"recv"}},"children":[],"locations":[{"type":"absolute","value":268439858}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#16","description":"recv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvfrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#17","description":"recvfrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#71","description":"WSARecv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvDisconnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#72","description":"WSARecvDisconnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#73","description":"WSARecvFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSARecvMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"recvmsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Receive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ReceiveMessageFromAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::BeginReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceive"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveFrom"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::EndReceiveMessageFrom"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"read data from Internet"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"download URL"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create mutex":{"meta":{"name":"create mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Mutex"],"objective":"Process","behavior":"Create Mutex","method":"","id":"C0042"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create mutex\n    namespace: host-interaction/mutex\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Process::Create Mutex [C0042]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - api: kernel32.CreateMutex\n      - api: kernel32.CreateMutexEx\n      - api: System.Threading.Mutex::ctor\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutex"}},"children":[],"locations":[{"type":"absolute","value":268439662}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutexEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send data on socket":{"meta":{"name":"send data on socket","namespace":"communication/socket/send","authors":["moritz.raabe@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Send Data"],"objective":"Communication","behavior":"Socket Communication","method":"Send Data","id":"C0001.007"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send data on socket\n    namespace: communication/socket/send\n    authors:\n      - moritz.raabe@mandiant.com\n      - joakim@intezer.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Communication::Socket Communication::Send Data [C0001.007]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - api: send\n      - api: ws2_32.send\n      - api: ws2_32.#19 = send\n      - api: ws2_32.sendto\n      - api: ws2_32.#20 = sendto\n      - api: ws2_32.WSASend\n      - api: ws2_32.#76 = WSASend\n      - api: ws2_32.WSASendMsg\n      - api: ws2_32.WSASendTo\n      - api: ws2_32.#78 = WSASendTo\n      - api: System.Net.Sockets.Socket::Send\n      - api: System.Net.Sockets.Socket::SendAsync\n      - api: System.Net.Sockets.Socket::SendTo\n      - api: System.Net.Sockets.Socket::SendToAsync\n      - api: System.Net.Sockets.UdpClient::Send\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#19","description":"send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#20","description":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#76","description":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#78","description":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendToAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::Send"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"initialize Winsock library":{"meta":{"name":"initialize Winsock library","namespace":"communication/socket","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Initialize Winsock Library"],"objective":"Communication","behavior":"Socket Communication","method":"Initialize Winsock Library","id":"C0001.009"}],"references":[],"examples":["6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001D30"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: initialize Winsock library\n    namespace: communication/socket\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Communication::Socket Communication::Initialize Winsock Library [C0001.009]\n    examples:\n      - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x10001D30\n  features:\n    - or:\n      - api: ws2_32.WSAStartup\n      - api: ws2_32.#115 = WSAStartup\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WSAStartup"}},"children":[],"locations":[{"type":"absolute","value":268439678}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#115","description":"WSAStartup"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send data":{"meta":{"name":"send data","namespace":"communication","authors":["william.ballenthin@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Command and Control","C2 Communication","Send Data"],"objective":"Command and Control","behavior":"C2 Communication","method":"Send Data","id":"B0030.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60"],"description":"all known techniques for sending data to a potential C2 server","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send data\n    namespace: communication\n    authors:\n      - william.ballenthin@mandiant.com\n      - joakim@intezer.com\n    description: all known techniques for sending data to a potential C2 server\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Command and Control::C2 Communication::Send Data [B0030.001]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - match: send HTTP request\n          - match: send data on socket\n          - match: send file via HTTP\n          - match: send data to Internet\n      - and:\n        - os: linux\n        - or: # Require network bound socket.\n          - match: create TCP socket\n          - match: create UDP socket\n        - or:\n          - match: send HTTP request\n          - match: send data on socket\n          - match: send file via HTTP\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#19","description":"send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#20","description":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#76","description":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#78","description":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendToAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::Send"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send data to Internet"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#23","description":"socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#82","description":"WSASocketA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#83","description":"WSASocketW"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create UDP socket"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send HTTP request"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"send data on socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"send"}},"children":[],"locations":[{"type":"absolute","value":268439809}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#19","description":"send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#20","description":"sendto"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#76","description":"WSASend"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendMsg"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#78","description":"WSASendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::Send"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendTo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::SendToAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::Send"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"send file via HTTP"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"connect TCP socket":{"meta":{"name":"connect TCP socket","namespace":"communication/socket/tcp","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Connect Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Connect Socket","id":"C0001.004"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: connect TCP socket\n    namespace: communication/socket/tcp\n    authors:\n      - moritz.raabe@mandiant.com\n      - joakim@intezer.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::Socket Communication::Connect Socket [C0001.004]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - and:\n      - match: create TCP socket\n      - or:\n        - api: connect\n        - api: ws2_32.connect\n        - api: ws2_32.#4 = connect\n        - api: ws2_32.WSAConnect\n        - api: ws2_32.#33 = WSAConnect\n        - api: ConnectEx\n        - or:\n          - and:\n            # static\n            - basic block:\n              # candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e\n              - and:\n                - number: 0x25A207B9\n                - number: 0x4660DDF3\n                - number: 0xE576E98E\n                - number: 0x3E06748C\n            - basic block:\n              - and:\n                - or:\n                  - api: ws2_32.WSAIoctl\n                  - api: ws2_32.#60 = WSAIoctl\n                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER\n            - basic block:\n              - and:\n                - or:\n                  - api: setsockopt\n                  - api: ws2_32.#21 = setsockopt\n                - number: 0xFFFF = SOL_SOCKET\n                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT\n            # socket must be bound to ConnectEx\n            # https://gist.github.com/joeyadams/4158972\n            - or:\n              - api: bind\n              - api: ws2_32.#2 = bind\n          - and:\n            # dynamic\n            - call:\n              - and:\n                - or:\n                  - api: ws2_32.WSAIoctl\n                  - api: ws2_32.#60 = WSAIoctl\n                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER\n            - call:\n              - and:\n                - or:\n                  - api: setsockopt\n                  - api: ws2_32.#21 = setsockopt\n                - number: 0xFFFF = SOL_SOCKET\n                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT\n            # socket must be bound to ConnectEx\n            # https://gist.github.com/joeyadams/4158972\n            - or:\n              - api: bind\n              - api: ws2_32.#2 = bind\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#23","description":"socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#82","description":"WSASocketA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#83","description":"WSASocketW"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#4","description":"connect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSAConnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#33","description":"WSAConnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ConnectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/df71f399e99d4d0d8f76ce86e9bdaa6d"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/4f4a08ca6d1b4a0fbca565ea62d4bcdd"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/74f4438d1b8c4c6d8249abec4330002c"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#2","description":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/dafcae7008824784ba3a5a0dfdcf53b6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/0d378507aacb4f24a4d36a276c105e37"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#2","description":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"act as TCP client":{"meta":{"name":"act as TCP client","namespace":"communication/tcp/client","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","TCP Client"],"objective":"Communication","behavior":"Socket Communication","method":"TCP Client","id":"C0001.008"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: act as TCP client\n    namespace: communication/tcp/client\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::Socket Communication::TCP Client [C0001.008]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - match: connect TCP socket\n      - api: System.Net.Sockets.TcpClient::ctor\n","matches":[[{"type":"absolute","value":268439568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create TCP socket"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"absolute","value":268439694}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"absolute","value":268439696}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"absolute","value":268439698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#23","description":"socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#82","description":"WSASocketA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#83","description":"WSASocketW"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439692}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"connect"}},"children":[],"locations":[{"type":"absolute","value":268439758}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#4","description":"connect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WSAConnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#33","description":"WSAConnect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ConnectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/df71f399e99d4d0d8f76ce86e9bdaa6d"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/4f4a08ca6d1b4a0fbca565ea62d4bcdd"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/74f4438d1b8c4c6d8249abec4330002c"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#2","description":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/dafcae7008824784ba3a5a0dfdcf53b6"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"connect TCP socket/0d378507aacb4f24a4d36a276c105e37"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"bind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.#2","description":"bind"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":268439568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.TcpClient::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
diff --git a/rd/al-khaser_x64.exe_.json b/rd/al-khaser_x64.exe_.json
index c535be2..56a7c54 100644
--- a/rd/al-khaser_x64.exe_.json
+++ b/rd/al-khaser_x64.exe_.json
@@ -1 +1 @@
-{"meta":{"timestamp":"2024-03-02T04:10:24.252437","version":"7.0.1","argv":["./tests/data/al-khaser_x64.exe_","-j"],"sample":{"md5":"3cb21ae76ff3da4b7e02d77ff76e82be","sha1":"7156270661549f75c253f169fe8988690f6fc700","sha256":"c2c49f2592f78b7a70fd984dbbb25f7251dd1c851caa884f39ff1c8075f0b228","path":"C:/Users/HP/Documents/GitHub/capa/tests/data/al-khaser_x64.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"amd64","os":"windows","extractor":"VivisectFeatureExtractor","rules":["C:/Users/HP/Documents/GitHub/capa/rules"],"base_address":{"type":"absolute","value":5368709120},"layout":{"functions":[{"address":{"type":"absolute","value":5368811525},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840006}}]},{"address":{"type":"absolute","value":5368811530},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013168}}]},{"address":{"type":"absolute","value":5368811540},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005200}},{"address":{"type":"absolute","value":5369005266}}]},{"address":{"type":"absolute","value":5368811565},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368959552}},{"address":{"type":"absolute","value":5368959622}},{"address":{"type":"absolute","value":5368959757}},{"address":{"type":"absolute","value":5368960000}}]},{"address":{"type":"absolute","value":5368811570},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368846160}}]},{"address":{"type":"absolute","value":5368811655},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368924448}}]},{"address":{"type":"absolute","value":5368811660},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368890800}}]},{"address":{"type":"absolute","value":5368811670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368942720}}]},{"address":{"type":"absolute","value":5368811675},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368931152}},{"address":{"type":"absolute","value":5368931316}}]},{"address":{"type":"absolute","value":5368811680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368872240}}]},{"address":{"type":"absolute","value":5368811690},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010288}}]},{"address":{"type":"absolute","value":5368811695},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368940992}}]},{"address":{"type":"absolute","value":5368811715},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368951744}},{"address":{"type":"absolute","value":5368951918}},{"address":{"type":"absolute","value":5368952263}},{"address":{"type":"absolute","value":5368952779}}]},{"address":{"type":"absolute","value":5368811720},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368861728}}]},{"address":{"type":"absolute","value":5368811740},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368935773}}]},{"address":{"type":"absolute","value":5368811755},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915808}}]},{"address":{"type":"absolute","value":5368811765},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368854880}},{"address":{"type":"absolute","value":5368854976}}]},{"address":{"type":"absolute","value":5368811785},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013600}}]},{"address":{"type":"absolute","value":5368811805},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368851327}},{"address":{"type":"absolute","value":5368851370}},{"address":{"type":"absolute","value":5368851795}}]},{"address":{"type":"absolute","value":5368811810},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368939152}}]},{"address":{"type":"absolute","value":5368811820},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368917392}}]},{"address":{"type":"absolute","value":5368811825},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013504}}]},{"address":{"type":"absolute","value":5368811865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997328}},{"address":{"type":"absolute","value":5368997449}}]},{"address":{"type":"absolute","value":5368811870},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858960}}]},{"address":{"type":"absolute","value":5368811875},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368922416}}]},{"address":{"type":"absolute","value":5368811905},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869472}}]},{"address":{"type":"absolute","value":5368811925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368984512}}]},{"address":{"type":"absolute","value":5368811990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368844166}}]},{"address":{"type":"absolute","value":5368812010},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368893712}},{"address":{"type":"absolute","value":5368893848}}]},{"address":{"type":"absolute","value":5368812015},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368839769}}]},{"address":{"type":"absolute","value":5368812020},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369019328}},{"address":{"type":"absolute","value":5369019343}},{"address":{"type":"absolute","value":5369019390}},{"address":{"type":"absolute","value":5369019817}},{"address":{"type":"absolute","value":5369019949}},{"address":{"type":"absolute","value":5369020147}}]},{"address":{"type":"absolute","value":5368812035},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368852559}},{"address":{"type":"absolute","value":5368852602}},{"address":{"type":"absolute","value":5368852710}}]},{"address":{"type":"absolute","value":5368812055},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368962880}}]},{"address":{"type":"absolute","value":5368812100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368855200}},{"address":{"type":"absolute","value":5368855365}}]},{"address":{"type":"absolute","value":5368812110},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925360}}]},{"address":{"type":"absolute","value":5368812115},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368938720}}]},{"address":{"type":"absolute","value":5368812120},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368935952}}]},{"address":{"type":"absolute","value":5368812150},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368863408}},{"address":{"type":"absolute","value":5368863518}},{"address":{"type":"absolute","value":5368863684}},{"address":{"type":"absolute","value":5368863767}},{"address":{"type":"absolute","value":5368863913}}]},{"address":{"type":"absolute","value":5368812180},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368859792}},{"address":{"type":"absolute","value":5368860125}}]},{"address":{"type":"absolute","value":5368812185},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368920720}}]},{"address":{"type":"absolute","value":5368812195},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013857}}]},{"address":{"type":"absolute","value":5368812220},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005424}}]},{"address":{"type":"absolute","value":5368812230},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368999623}},{"address":{"type":"absolute","value":5368999700}}]},{"address":{"type":"absolute","value":5368812255},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368862720}}]},{"address":{"type":"absolute","value":5368812270},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368977872}}]},{"address":{"type":"absolute","value":5368812285},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368905856}},{"address":{"type":"absolute","value":5368905952}}]},{"address":{"type":"absolute","value":5368812290},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369004455}}]},{"address":{"type":"absolute","value":5368812310},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368866464}}]},{"address":{"type":"absolute","value":5368812315},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368957520}}]},{"address":{"type":"absolute","value":5368812320},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017312}},{"address":{"type":"absolute","value":5369017341}}]},{"address":{"type":"absolute","value":5368812325},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368831168}}]},{"address":{"type":"absolute","value":5368812330},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915696}}]},{"address":{"type":"absolute","value":5368812340},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368993792}},{"address":{"type":"absolute","value":5368994097}}]},{"address":{"type":"absolute","value":5368812350},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007888}}]},{"address":{"type":"absolute","value":5368812360},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368953552}},{"address":{"type":"absolute","value":5368953892}},{"address":{"type":"absolute","value":5368953985}},{"address":{"type":"absolute","value":5368954205}},{"address":{"type":"absolute","value":5368954290}}]},{"address":{"type":"absolute","value":5368812385},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368857936}}]},{"address":{"type":"absolute","value":5368812395},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368911264}},{"address":{"type":"absolute","value":5368911394}},{"address":{"type":"absolute","value":5368911647}}]},{"address":{"type":"absolute","value":5368812430},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368844868}}]},{"address":{"type":"absolute","value":5368812455},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368992784}}]},{"address":{"type":"absolute","value":5368812465},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013777}}]},{"address":{"type":"absolute","value":5368812475},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368957232}}]},{"address":{"type":"absolute","value":5368812485},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925584}}]},{"address":{"type":"absolute","value":5368812530},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369000672}}]},{"address":{"type":"absolute","value":5368812550},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368986160}}]},{"address":{"type":"absolute","value":5368812575},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368989264}}]},{"address":{"type":"absolute","value":5368812590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368945360}},{"address":{"type":"absolute","value":5368945480}}]},{"address":{"type":"absolute","value":5368812600},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368967072}}]},{"address":{"type":"absolute","value":5368812615},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368928480}}]},{"address":{"type":"absolute","value":5368812640},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368855536}}]},{"address":{"type":"absolute","value":5368812670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925952}}]},{"address":{"type":"absolute","value":5368812675},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914304}}]},{"address":{"type":"absolute","value":5368812680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997776}}]},{"address":{"type":"absolute","value":5368812685},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007991}},{"address":{"type":"absolute","value":5369007998}}]},{"address":{"type":"absolute","value":5368812700},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368865536}}]},{"address":{"type":"absolute","value":5368812710},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368883600}}]},{"address":{"type":"absolute","value":5368812715},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368968522}},{"address":{"type":"absolute","value":5368968591}}]},{"address":{"type":"absolute","value":5368812735},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368963792}}]},{"address":{"type":"absolute","value":5368812780},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368859424}}]},{"address":{"type":"absolute","value":5368812785},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915584}}]},{"address":{"type":"absolute","value":5368812845},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002128}}]},{"address":{"type":"absolute","value":5368812865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013632}}]},{"address":{"type":"absolute","value":5368812875},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368852912}},{"address":{"type":"absolute","value":5368853061}},{"address":{"type":"absolute","value":5368853126}},{"address":{"type":"absolute","value":5368853235}},{"address":{"type":"absolute","value":5368853300}}]},{"address":{"type":"absolute","value":5368812895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368988624}},{"address":{"type":"absolute","value":5368988760}}]},{"address":{"type":"absolute","value":5368812910},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368983248}},{"address":{"type":"absolute","value":5368983445}}]},{"address":{"type":"absolute","value":5368812925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907312}}]},{"address":{"type":"absolute","value":5368812935},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017488}},{"address":{"type":"absolute","value":5369017534}},{"address":{"type":"absolute","value":5369017543}}]},{"address":{"type":"absolute","value":5368812970},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368972656}}]},{"address":{"type":"absolute","value":5368812990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369001472}}]},{"address":{"type":"absolute","value":5368812995},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013328}}]},{"address":{"type":"absolute","value":5368813035},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368978288}},{"address":{"type":"absolute","value":5368978428}}]},{"address":{"type":"absolute","value":5368813040},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914624}}]},{"address":{"type":"absolute","value":5368813065},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368867136}}]},{"address":{"type":"absolute","value":5368813080},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368908976}}]},{"address":{"type":"absolute","value":5368813105},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368845952}}]},{"address":{"type":"absolute","value":5368813120},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869616}}]},{"address":{"type":"absolute","value":5368813170},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369011040}},{"address":{"type":"absolute","value":5369011098}},{"address":{"type":"absolute","value":5369011194}}]},{"address":{"type":"absolute","value":5368813175},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368959159}}]},{"address":{"type":"absolute","value":5368813180},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368949696}}]},{"address":{"type":"absolute","value":5368813190},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368876128}}]},{"address":{"type":"absolute","value":5368813195},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368940096}}]},{"address":{"type":"absolute","value":5368813200},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368946880}}]},{"address":{"type":"absolute","value":5368813215},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369004272}},{"address":{"type":"absolute","value":5369004285}},{"address":{"type":"absolute","value":5369004330}}]},{"address":{"type":"absolute","value":5368813260},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010208}}]},{"address":{"type":"absolute","value":5368813275},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368995360}},{"address":{"type":"absolute","value":5368995656}}]},{"address":{"type":"absolute","value":5368813280},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858112}}]},{"address":{"type":"absolute","value":5368813285},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005387}}]},{"address":{"type":"absolute","value":5368813315},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368996618}},{"address":{"type":"absolute","value":5368996644}}]},{"address":{"type":"absolute","value":5368813335},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368943320}}]},{"address":{"type":"absolute","value":5368813350},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368894864}}]},{"address":{"type":"absolute","value":5368813355},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368982784}}]},{"address":{"type":"absolute","value":5368813380},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013664}}]},{"address":{"type":"absolute","value":5368813395},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368941664}}]},{"address":{"type":"absolute","value":5368813405},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369006893}}]},{"address":{"type":"absolute","value":5368813420},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368965144}}]},{"address":{"type":"absolute","value":5368813435},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368893968}},{"address":{"type":"absolute","value":5368894104}}]},{"address":{"type":"absolute","value":5368813440},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840864}}]},{"address":{"type":"absolute","value":5368813445},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923680}}]},{"address":{"type":"absolute","value":5368813465},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368929536}}]},{"address":{"type":"absolute","value":5368813475},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368877280}}]},{"address":{"type":"absolute","value":5368813500},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368967728}}]},{"address":{"type":"absolute","value":5368813505},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915472}}]},{"address":{"type":"absolute","value":5368813515},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368844272}}]},{"address":{"type":"absolute","value":5368813525},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368837088}}]},{"address":{"type":"absolute","value":5368813540},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368898912}}]},{"address":{"type":"absolute","value":5368813555},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013937}}]},{"address":{"type":"absolute","value":5368813560},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858352}}]},{"address":{"type":"absolute","value":5368813565},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914432}}]},{"address":{"type":"absolute","value":5368813585},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368895248}},{"address":{"type":"absolute","value":5368895480}}]},{"address":{"type":"absolute","value":5368813590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368928880}}]},{"address":{"type":"absolute","value":5368813595},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368921760}}]},{"address":{"type":"absolute","value":5368813610},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007594}}]},{"address":{"type":"absolute","value":5368813630},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369015968}}]},{"address":{"type":"absolute","value":5368813635},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368839184}},{"address":{"type":"absolute","value":5368839341}}]},{"address":{"type":"absolute","value":5368813665},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368944560}}]},{"address":{"type":"absolute","value":5368813670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368905440}},{"address":{"type":"absolute","value":5368905536}}]},{"address":{"type":"absolute","value":5368813680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368898240}},{"address":{"type":"absolute","value":5368898405}}]},{"address":{"type":"absolute","value":5368813685},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368848000}}]},{"address":{"type":"absolute","value":5368813695},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923568}}]},{"address":{"type":"absolute","value":5368813700},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002064}}]},{"address":{"type":"absolute","value":5368813705},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368926928}}]},{"address":{"type":"absolute","value":5368813745},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368986448}}]},{"address":{"type":"absolute","value":5368813750},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368950592}},{"address":{"type":"absolute","value":5368950804}},{"address":{"type":"absolute","value":5368950968}},{"address":{"type":"absolute","value":5368951220}},{"address":{"type":"absolute","value":5368951296}}]},{"address":{"type":"absolute","value":5368813760},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368910688}},{"address":{"type":"absolute","value":5368910818}},{"address":{"type":"absolute","value":5368910906}}]},{"address":{"type":"absolute","value":5368813770},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368898576}},{"address":{"type":"absolute","value":5368898741}}]},{"address":{"type":"absolute","value":5368813815},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923216}}]},{"address":{"type":"absolute","value":5368813820},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925472}}]},{"address":{"type":"absolute","value":5368813825},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016224}}]},{"address":{"type":"absolute","value":5368813830},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368865680}}]},{"address":{"type":"absolute","value":5368813840},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368958453}}]},{"address":{"type":"absolute","value":5368813895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368938016}}]},{"address":{"type":"absolute","value":5368813910},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368866222}},{"address":{"type":"absolute","value":5368866309}}]},{"address":{"type":"absolute","value":5368813925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368848272}}]},{"address":{"type":"absolute","value":5368813930},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368899264}}]},{"address":{"type":"absolute","value":5368813935},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368926592}}]},{"address":{"type":"absolute","value":5368813960},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368871664}}]},{"address":{"type":"absolute","value":5368813975},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014016}}]},{"address":{"type":"absolute","value":5368813980},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369008240}}]},{"address":{"type":"absolute","value":5368813990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368890032}},{"address":{"type":"absolute","value":5368890242}}]},{"address":{"type":"absolute","value":5368814025},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368947424}}]},{"address":{"type":"absolute","value":5368814035},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907625}}]},{"address":{"type":"absolute","value":5368814040},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368864464}},{"address":{"type":"absolute","value":5368864594}},{"address":{"type":"absolute","value":5368864642}}]},{"address":{"type":"absolute","value":5368814065},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017216}}]},{"address":{"type":"absolute","value":5368814090},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368847824}}]},{"address":{"type":"absolute","value":5368814100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368862560}}]},{"address":{"type":"absolute","value":5368814130},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368838128}}]},{"address":{"type":"absolute","value":5368814135},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368935273}}]},{"address":{"type":"absolute","value":5368814145},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368976496}}]},{"address":{"type":"absolute","value":5368814200},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002562}}]},{"address":{"type":"absolute","value":5368814205},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368999904}},{"address":{"type":"absolute","value":5369000118}}]},{"address":{"type":"absolute","value":5368814210},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369001216}}]},{"address":{"type":"absolute","value":5368814230},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368884334}}]},{"address":{"type":"absolute","value":5368814240},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368918544}}]},{"address":{"type":"absolute","value":5368814290},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907088}},{"address":{"type":"absolute","value":5368907176}},{"address":{"type":"absolute","value":5368907213}}]},{"address":{"type":"absolute","value":5368814300},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369006077}}]},{"address":{"type":"absolute","value":5368814305},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368853616}},{"address":{"type":"absolute","value":5368853752}}]},{"address":{"type":"absolute","value":5368814335},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368996768}}]},{"address":{"type":"absolute","value":5368814345},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368891040}},{"address":{"type":"absolute","value":5368891218}}]},{"address":{"type":"absolute","value":5368814390},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368870592}}]},{"address":{"type":"absolute","value":5368814415},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007856}}]},{"address":{"type":"absolute","value":5368814425},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369000320}},{"address":{"type":"absolute","value":5369000497}}]},{"address":{"type":"absolute","value":5368814435},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923456}}]},{"address":{"type":"absolute","value":5368814450},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368842521}}]},{"address":{"type":"absolute","value":5368814455},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916256}}]},{"address":{"type":"absolute","value":5368814490},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925696}},{"address":{"type":"absolute","value":5368925779}}]},{"address":{"type":"absolute","value":5368814500},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368909568}},{"address":{"type":"absolute","value":5368909711}},{"address":{"type":"absolute","value":5368910144}}]},{"address":{"type":"absolute","value":5368814540},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368842752}}]},{"address":{"type":"absolute","value":5368814555},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368893136}}]},{"address":{"type":"absolute","value":5368814590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368931728}}]},{"address":{"type":"absolute","value":5368814600},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997120}}]},{"address":{"type":"absolute","value":5368814605},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368986672}}]},{"address":{"type":"absolute","value":5368814620},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016272}},{"address":{"type":"absolute","value":5369016379}}]},{"address":{"type":"absolute","value":5368814630},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368853872}}]},{"address":{"type":"absolute","value":5368814640},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368908237}}]},{"address":{"type":"absolute","value":5368814690},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369015535}},{"address":{"type":"absolute","value":5369015736}}]},{"address":{"type":"absolute","value":5368814700},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368846752}}]},{"address":{"type":"absolute","value":5368814705},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007028}},{"address":{"type":"absolute","value":5369007110}}]},{"address":{"type":"absolute","value":5368814710},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368867760}}]},{"address":{"type":"absolute","value":5368814735},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869042}},{"address":{"type":"absolute","value":5368869087}}]},{"address":{"type":"absolute","value":5368814750},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005760}}]},{"address":{"type":"absolute","value":5368814775},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858838}},{"address":{"type":"absolute","value":5368858872}}]},{"address":{"type":"absolute","value":5368814800},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368929888}}]},{"address":{"type":"absolute","value":5368814810},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368874096}},{"address":{"type":"absolute","value":5368874319}},{"address":{"type":"absolute","value":5368874689}}]},{"address":{"type":"absolute","value":5368814830},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369015264}},{"address":{"type":"absolute","value":5369015293}}]},{"address":{"type":"absolute","value":5368814850},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368871952}}]},{"address":{"type":"absolute","value":5368814865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368919549}},{"address":{"type":"absolute","value":5368919737}},{"address":{"type":"absolute","value":5368919951}},{"address":{"type":"absolute","value":5368920014}},{"address":{"type":"absolute","value":5368920079}},{"address":{"type":"absolute","value":5368920205}},{"address":{"type":"absolute","value":5368920268}}]},{"address":{"type":"absolute","value":5368814870},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368841264}}]},{"address":{"type":"absolute","value":5368814875},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368877056}}]},{"address":{"type":"absolute","value":5368814880},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368993008}}]},{"address":{"type":"absolute","value":5368814895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368990848}},{"address":{"type":"absolute","value":5368991013}}]},{"address":{"type":"absolute","value":5368814900},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014144}}]},{"address":{"type":"absolute","value":5368814905},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368932480}},{"address":{"type":"absolute","value":5368932788}}]},{"address":{"type":"absolute","value":5368814935},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368908512}},{"address":{"type":"absolute","value":5368908692}}]},{"address":{"type":"absolute","value":5368814945},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368874928}}]},{"address":{"type":"absolute","value":5368814970},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915920}}]},{"address":{"type":"absolute","value":5368814980},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858534}},{"address":{"type":"absolute","value":5368858568}}]},{"address":{"type":"absolute","value":5368814990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907712}},{"address":{"type":"absolute","value":5368907842}}]},{"address":{"type":"absolute","value":5368815005},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368892464}}]},{"address":{"type":"absolute","value":5368815040},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368927760}},{"address":{"type":"absolute","value":5368928040}}]},{"address":{"type":"absolute","value":5368815050},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368881759}},{"address":{"type":"absolute","value":5368882019}},{"address":{"type":"absolute","value":5368882175}}]},{"address":{"type":"absolute","value":5368815060},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368872528}}]},{"address":{"type":"absolute","value":5368815070},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368859600}}]},{"address":{"type":"absolute","value":5368815090},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368934160}}]},{"address":{"type":"absolute","value":5368815100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368973264}}]},{"address":{"type":"absolute","value":5368815115},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840336}}]},{"address":{"type":"absolute","value":5368815130},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368815130}},{"address":{"type":"absolute","value":5369002823}}]},{"address":{"type":"absolute","value":5368815140},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010256}}]},{"address":{"type":"absolute","value":5368815150},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368899968}}]},{"address":{"type":"absolute","value":5368815160},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368966608}}]},{"address":{"type":"absolute","value":5368815165},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368984784}}]},{"address":{"type":"absolute","value":5368815170},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368860320}},{"address":{"type":"absolute","value":5368860417}},{"address":{"type":"absolute","value":5368860540}},{"address":{"type":"absolute","value":5368860552}}]},{"address":{"type":"absolute","value":5368815175},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914080}}]},{"address":{"type":"absolute","value":5368815190},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368948908}}]},{"address":{"type":"absolute","value":5368815200},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368985322}}]},{"address":{"type":"absolute","value":5368815210},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368845568}},{"address":{"type":"absolute","value":5368845680}},{"address":{"type":"absolute","value":5368845793}}]},{"address":{"type":"absolute","value":5368815215},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368962560}}]},{"address":{"type":"absolute","value":5368815230},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368921024}}]},{"address":{"type":"absolute","value":5368815245},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368944304}}]},{"address":{"type":"absolute","value":5368815265},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368899616}}]},{"address":{"type":"absolute","value":5368815300},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368969872}}]},{"address":{"type":"absolute","value":5368815315},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368884640}},{"address":{"type":"absolute","value":5368884960}},{"address":{"type":"absolute","value":5368884998}},{"address":{"type":"absolute","value":5368885084}},{"address":{"type":"absolute","value":5368885421}},{"address":{"type":"absolute","value":5368885459}},{"address":{"type":"absolute","value":5368885632}},{"address":{"type":"absolute","value":5368885693}}]},{"address":{"type":"absolute","value":5368815325},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368837568}}]},{"address":{"type":"absolute","value":5368815340},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368924704}},{"address":{"type":"absolute","value":5368925052}}]},{"address":{"type":"absolute","value":5368815350},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916800}}]},{"address":{"type":"absolute","value":5368815370},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368906656}}]},{"address":{"type":"absolute","value":5368815385},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369020497}}]},{"address":{"type":"absolute","value":5368815390},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368865840}}]},{"address":{"type":"absolute","value":5368815480},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368897904}},{"address":{"type":"absolute","value":5368898069}}]},{"address":{"type":"absolute","value":5368815500},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368906928}},{"address":{"type":"absolute","value":5368906998}}]},{"address":{"type":"absolute","value":5368815515},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017088}}]},{"address":{"type":"absolute","value":5368815525},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368918304}}]},{"address":{"type":"absolute","value":5368815530},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368957808}}]},{"address":{"type":"absolute","value":5368815555},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368871008}}]},{"address":{"type":"absolute","value":5368815575},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016016}},{"address":{"type":"absolute","value":5369016067}},{"address":{"type":"absolute","value":5369016177}}]},{"address":{"type":"absolute","value":5368815585},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369001792}},{"address":{"type":"absolute","value":5369001893}}]},{"address":{"type":"absolute","value":5368815590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368971024}},{"address":{"type":"absolute","value":5368971322}}]},{"address":{"type":"absolute","value":5368815610},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368964656}}]},{"address":{"type":"absolute","value":5368815625},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368998896}}]},{"address":{"type":"absolute","value":5368815660},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007252}},{"address":{"type":"absolute","value":5369007274}}]},{"address":{"type":"absolute","value":5368815670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007296}},{"address":{"type":"absolute","value":5369007416}}]},{"address":{"type":"absolute","value":5368815675},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368965504}},{"address":{"type":"absolute","value":5368965587}},{"address":{"type":"absolute","value":5368965631}},{"address":{"type":"absolute","value":5368965660}}]},{"address":{"type":"absolute","value":5368815680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368849296}}]},{"address":{"type":"absolute","value":5368815685},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002571}}]},{"address":{"type":"absolute","value":5368815690},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368970112}},{"address":{"type":"absolute","value":5368970395}},{"address":{"type":"absolute","value":5368970461}},{"address":{"type":"absolute","value":5368970515}},{"address":{"type":"absolute","value":5368970547}},{"address":{"type":"absolute","value":5368970619}},{"address":{"type":"absolute","value":5368970649}}]},{"address":{"type":"absolute","value":5368815715},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368841536}},{"address":{"type":"absolute","value":5368841775}},{"address":{"type":"absolute","value":5368841964}},{"address":{"type":"absolute","value":5368842047}}]},{"address":{"type":"absolute","value":5368815725},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368894224}},{"address":{"type":"absolute","value":5368894360}}]},{"address":{"type":"absolute","value":5368815745},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013008}}]},{"address":{"type":"absolute","value":5368815755},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368974336}}]},{"address":{"type":"absolute","value":5368815765},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368930496}}]},{"address":{"type":"absolute","value":5368815770},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368894480}}]},{"address":{"type":"absolute","value":5368815780},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368847040}}]},{"address":{"type":"absolute","value":5368815785},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007824}}]},{"address":{"type":"absolute","value":5368815805},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014192}},{"address":{"type":"absolute","value":5369014382}},{"address":{"type":"absolute","value":5369014472}},{"address":{"type":"absolute","value":5369014657}},{"address":{"type":"absolute","value":5369014716}},{"address":{"type":"absolute","value":5369014793}},{"address":{"type":"absolute","value":5369014834}},{"address":{"type":"absolute","value":5369014938}},{"address":{"type":"absolute","value":5369015008}}]},{"address":{"type":"absolute","value":5368815865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368890480}}]},{"address":{"type":"absolute","value":5368815870},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916144}}]},{"address":{"type":"absolute","value":5368815890},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368999336}}]},{"address":{"type":"absolute","value":5368815895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369006544}},{"address":{"type":"absolute","value":5369006612}}]},{"address":{"type":"absolute","value":5368815905},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368877504}}]},{"address":{"type":"absolute","value":5368815910},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840608}}]},{"address":{"type":"absolute","value":5368815925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368842992}}]},{"address":{"type":"absolute","value":5368815930},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368913856}}]},{"address":{"type":"absolute","value":5368815955},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368920912}}]},{"address":{"type":"absolute","value":5368815960},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368953248}}]},{"address":{"type":"absolute","value":5368815965},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013968}}]},{"address":{"type":"absolute","value":5368815970},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368886745}},{"address":{"type":"absolute","value":5368886781}}]},{"address":{"type":"absolute","value":5368815980},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369008302}}]},{"address":{"type":"absolute","value":5368816000},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858656}}]},{"address":{"type":"absolute","value":5368816010},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368887327}},{"address":{"type":"absolute","value":5368887482}},{"address":{"type":"absolute","value":5368887733}},{"address":{"type":"absolute","value":5368887794}},{"address":{"type":"absolute","value":5368887937}}]},{"address":{"type":"absolute","value":5368816025},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997936}}]},{"address":{"type":"absolute","value":5368816045},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368996944}}]},{"address":{"type":"absolute","value":5368816060},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368994400}},{"address":{"type":"absolute","value":5368994791}}]},{"address":{"type":"absolute","value":5368816065},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368873312}}]},{"address":{"type":"absolute","value":5368816080},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368882496}}]},{"address":{"type":"absolute","value":5368816085},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016848}},{"address":{"type":"absolute","value":5369016959}}]},{"address":{"type":"absolute","value":5368816100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869250}},{"address":{"type":"absolute","value":5368869313}},{"address":{"type":"absolute","value":5368869337}}]},{"address":{"type":"absolute","value":5368816105},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369003728}},{"address":{"type":"absolute","value":5369003794}},{"address":{"type":"absolute","value":5369003826}},{"address":{"type":"absolute","value":5369003841}}]},{"address":{"type":"absolute","value":5368816135},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369004352}}]},{"address":{"type":"absolute","value":5368816155},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368912320}},{"address":{"type":"absolute","value":5368912450}},{"address":{"type":"absolute","value":5368912538}}]},{"address":{"type":"absolute","value":5368816160},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368978884}},{"address":{"type":"absolute","value":5368979231}},{"address":{"type":"absolute","value":5368979385}},{"address":{"type":"absolute","value":5368979938}},{"address":{"type":"absolute","value":5368980220}},{"address":{"type":"absolute","value":5368980317}},{"address":{"type":"absolute","value":5368980473}},{"address":{"type":"absolute","value":5368980815}}]},{"address":{"type":"absolute","value":5368816165},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368888611}},{"address":{"type":"absolute","value":5368888766}},{"address":{"type":"absolute","value":5368889163}},{"address":{"type":"absolute","value":5368889407}},{"address":{"type":"absolute","value":5368889461}}]},{"address":{"type":"absolute","value":5368816185},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005472}}]},{"address":{"type":"absolute","value":5368816205},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368965328}}]},{"address":{"type":"absolute","value":5368816215},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368933200}}]},{"address":{"type":"absolute","value":5368816225},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368928768}}]},{"address":{"type":"absolute","value":5368816245},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368954848}},{"address":{"type":"absolute","value":5368955014}},{"address":{"type":"absolute","value":5368955356}},{"address":{"type":"absolute","value":5368955764}}]},{"address":{"type":"absolute","value":5368816265},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014064}},{"address":{"type":"absolute","value":5369014111}}]},{"address":{"type":"absolute","value":5368816310},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368945965}}]},{"address":{"type":"absolute","value":5368816320},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368966232}},{"address":{"type":"absolute","value":5368966375}}]},{"address":{"type":"absolute","value":5368816360},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368870800}}]},{"address":{"type":"absolute","value":5368816365},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010176}}]},{"address":{"type":"absolute","value":5368816400},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368845408}}]},{"address":{"type":"absolute","value":5368816445},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017392}},{"address":{"type":"absolute","value":5369017438}},{"address":{"type":"absolute","value":5369017447}}]},{"address":{"type":"absolute","value":5368816450},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007194}}]},{"address":{"type":"absolute","value":5368816460},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368956192}},{"address":{"type":"absolute","value":5368956528}}]},{"address":{"type":"absolute","value":5368816465},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002562}},{"address":{"type":"absolute","value":5369002568}}]},{"address":{"type":"absolute","value":5368816515},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916032}}]},{"address":{"type":"absolute","value":5368821728},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368821728}}]},{"address":{"type":"absolute","value":5368822176},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368822176}}]},{"address":{"type":"absolute","value":5368824096},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368824096}}]},{"address":{"type":"absolute","value":5368838672},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368838672}}]},{"address":{"type":"absolute","value":5368882832},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368882832}},{"address":{"type":"absolute","value":5368882955}},{"address":{"type":"absolute","value":5368883110}},{"address":{"type":"absolute","value":5368883232}}]},{"address":{"type":"absolute","value":5368891376},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368891498}},{"address":{"type":"absolute","value":5368891614}}]},{"address":{"type":"absolute","value":5368891792},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368891898}}]},{"address":{"type":"absolute","value":5368892096},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368892096}}]},{"address":{"type":"absolute","value":5368892304},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368892304}}]},{"address":{"type":"absolute","value":5368909136},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368909136}}]},{"address":{"type":"absolute","value":5368960864},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368961024}},{"address":{"type":"absolute","value":5368961046}}]},{"address":{"type":"absolute","value":5368964112},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368964112}}]},{"address":{"type":"absolute","value":5368964496},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368964496}}]},{"address":{"type":"absolute","value":5368986896},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368987018}},{"address":{"type":"absolute","value":5368987134}}]},{"address":{"type":"absolute","value":5368987312},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368987418}}]},{"address":{"type":"absolute","value":5368988000},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368988000}}]},{"address":{"type":"absolute","value":5368988208},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368988208}}]}]},"feature_counts":{"file":2217,"functions":[{"address":{"type":"absolute","value":5368811525},"count":58},{"address":{"type":"absolute","value":5368811530},"count":28},{"address":{"type":"absolute","value":5368811535},"count":10},{"address":{"type":"absolute","value":5368811540},"count":40},{"address":{"type":"absolute","value":5368811550},"count":9},{"address":{"type":"absolute","value":5368811555},"count":33},{"address":{"type":"absolute","value":5368811560},"count":8},{"address":{"type":"absolute","value":5368811565},"count":78},{"address":{"type":"absolute","value":5368811570},"count":38},{"address":{"type":"absolute","value":5368811585},"count":10},{"address":{"type":"absolute","value":5368811590},"count":49},{"address":{"type":"absolute","value":5368811605},"count":31},{"address":{"type":"absolute","value":5368811620},"count":30},{"address":{"type":"absolute","value":5368811625},"count":32},{"address":{"type":"absolute","value":5368811630},"count":30},{"address":{"type":"absolute","value":5368811655},"count":40},{"address":{"type":"absolute","value":5368811660},"count":56},{"address":{"type":"absolute","value":5368811670},"count":54},{"address":{"type":"absolute","value":5368811675},"count":72},{"address":{"type":"absolute","value":5368811680},"count":43},{"address":{"type":"absolute","value":5368811685},"count":9},{"address":{"type":"absolute","value":5368811690},"count":14},{"address":{"type":"absolute","value":5368811695},"count":62},{"address":{"type":"absolute","value":5368811705},"count":28},{"address":{"type":"absolute","value":5368811715},"count":130},{"address":{"type":"absolute","value":5368811720},"count":38},{"address":{"type":"absolute","value":5368811740},"count":54},{"address":{"type":"absolute","value":5368811745},"count":31},{"address":{"type":"absolute","value":5368811750},"count":34},{"address":{"type":"absolute","value":5368811755},"count":36},{"address":{"type":"absolute","value":5368811760},"count":31},{"address":{"type":"absolute","value":5368811765},"count":58},{"address":{"type":"absolute","value":5368811770},"count":50},{"address":{"type":"absolute","value":5368811775},"count":9},{"address":{"type":"absolute","value":5368811780},"count":36},{"address":{"type":"absolute","value":5368811785},"count":19},{"address":{"type":"absolute","value":5368811790},"count":9},{"address":{"type":"absolute","value":5368811795},"count":30},{"address":{"type":"absolute","value":5368811800},"count":30},{"address":{"type":"absolute","value":5368811805},"count":95},{"address":{"type":"absolute","value":5368811810},"count":63},{"address":{"type":"absolute","value":5368811820},"count":64},{"address":{"type":"absolute","value":5368811825},"count":33},{"address":{"type":"absolute","value":5368811830},"count":32},{"address":{"type":"absolute","value":5368811835},"count":36},{"address":{"type":"absolute","value":5368811850},"count":33},{"address":{"type":"absolute","value":5368811855},"count":30},{"address":{"type":"absolute","value":5368811865},"count":59},{"address":{"type":"absolute","value":5368811870},"count":37},{"address":{"type":"absolute","value":5368811875},"count":67},{"address":{"type":"absolute","value":5368811880},"count":33},{"address":{"type":"absolute","value":5368811885},"count":33},{"address":{"type":"absolute","value":5368811890},"count":9},{"address":{"type":"absolute","value":5368811895},"count":35},{"address":{"type":"absolute","value":5368811905},"count":40},{"address":{"type":"absolute","value":5368811910},"count":31},{"address":{"type":"absolute","value":5368811915},"count":8},{"address":{"type":"absolute","value":5368811920},"count":32},{"address":{"type":"absolute","value":5368811925},"count":53},{"address":{"type":"absolute","value":5368811930},"count":31},{"address":{"type":"absolute","value":5368811955},"count":39},{"address":{"type":"absolute","value":5368811960},"count":33},{"address":{"type":"absolute","value":5368811965},"count":48},{"address":{"type":"absolute","value":5368811970},"count":9},{"address":{"type":"absolute","value":5368811975},"count":11},{"address":{"type":"absolute","value":5368811980},"count":31},{"address":{"type":"absolute","value":5368811985},"count":10},{"address":{"type":"absolute","value":5368811990},"count":50},{"address":{"type":"absolute","value":5368812010},"count":41},{"address":{"type":"absolute","value":5368812015},"count":39},{"address":{"type":"absolute","value":5368812020},"count":112},{"address":{"type":"absolute","value":5368812030},"count":37},{"address":{"type":"absolute","value":5368812035},"count":63},{"address":{"type":"absolute","value":5368812040},"count":31},{"address":{"type":"absolute","value":5368812050},"count":38},{"address":{"type":"absolute","value":5368812055},"count":39},{"address":{"type":"absolute","value":5368812065},"count":39},{"address":{"type":"absolute","value":5368812070},"count":31},{"address":{"type":"absolute","value":5368812075},"count":28},{"address":{"type":"absolute","value":5368812080},"count":33},{"address":{"type":"absolute","value":5368812085},"count":30},{"address":{"type":"absolute","value":5368812095},"count":28},{"address":{"type":"absolute","value":5368812100},"count":61},{"address":{"type":"absolute","value":5368812105},"count":38},{"address":{"type":"absolute","value":5368812110},"count":36},{"address":{"type":"absolute","value":5368812115},"count":50},{"address":{"type":"absolute","value":5368812120},"count":82},{"address":{"type":"absolute","value":5368812130},"count":9},{"address":{"type":"absolute","value":5368812140},"count":78},{"address":{"type":"absolute","value":5368812145},"count":31},{"address":{"type":"absolute","value":5368812150},"count":84},{"address":{"type":"absolute","value":5368812155},"count":9},{"address":{"type":"absolute","value":5368812165},"count":30},{"address":{"type":"absolute","value":5368812170},"count":54},{"address":{"type":"absolute","value":5368812175},"count":17},{"address":{"type":"absolute","value":5368812180},"count":47},{"address":{"type":"absolute","value":5368812185},"count":34},{"address":{"type":"absolute","value":5368812190},"count":31},{"address":{"type":"absolute","value":5368812195},"count":32},{"address":{"type":"absolute","value":5368812205},"count":37},{"address":{"type":"absolute","value":5368812210},"count":9},{"address":{"type":"absolute","value":5368812220},"count":21},{"address":{"type":"absolute","value":5368812230},"count":68},{"address":{"type":"absolute","value":5368812235},"count":28},{"address":{"type":"absolute","value":5368812240},"count":31},{"address":{"type":"absolute","value":5368812250},"count":9},{"address":{"type":"absolute","value":5368812255},"count":32},{"address":{"type":"absolute","value":5368812265},"count":10},{"address":{"type":"absolute","value":5368812270},"count":60},{"address":{"type":"absolute","value":5368812275},"count":31},{"address":{"type":"absolute","value":5368812285},"count":70},{"address":{"type":"absolute","value":5368812290},"count":36},{"address":{"type":"absolute","value":5368812295},"count":30},{"address":{"type":"absolute","value":5368812300},"count":38},{"address":{"type":"absolute","value":5368812305},"count":36},{"address":{"type":"absolute","value":5368812310},"count":45},{"address":{"type":"absolute","value":5368812315},"count":29},{"address":{"type":"absolute","value":5368812320},"count":29},{"address":{"type":"absolute","value":5368812325},"count":42},{"address":{"type":"absolute","value":5368812330},"count":36},{"address":{"type":"absolute","value":5368812335},"count":40},{"address":{"type":"absolute","value":5368812340},"count":70},{"address":{"type":"absolute","value":5368812350},"count":26},{"address":{"type":"absolute","value":5368812360},"count":108},{"address":{"type":"absolute","value":5368812380},"count":38},{"address":{"type":"absolute","value":5368812385},"count":36},{"address":{"type":"absolute","value":5368812390},"count":10},{"address":{"type":"absolute","value":5368812395},"count":104},{"address":{"type":"absolute","value":5368812405},"count":28},{"address":{"type":"absolute","value":5368812415},"count":30},{"address":{"type":"absolute","value":5368812425},"count":9},{"address":{"type":"absolute","value":5368812430},"count":43},{"address":{"type":"absolute","value":5368812445},"count":23},{"address":{"type":"absolute","value":5368812455},"count":49},{"address":{"type":"absolute","value":5368812465},"count":32},{"address":{"type":"absolute","value":5368812475},"count":29},{"address":{"type":"absolute","value":5368812480},"count":68},{"address":{"type":"absolute","value":5368812485},"count":36},{"address":{"type":"absolute","value":5368812495},"count":26},{"address":{"type":"absolute","value":5368812500},"count":35},{"address":{"type":"absolute","value":5368812505},"count":30},{"address":{"type":"absolute","value":5368812530},"count":78},{"address":{"type":"absolute","value":5368812550},"count":53},{"address":{"type":"absolute","value":5368812565},"count":30},{"address":{"type":"absolute","value":5368812575},"count":60},{"address":{"type":"absolute","value":5368812580},"count":30},{"address":{"type":"absolute","value":5368812585},"count":32},{"address":{"type":"absolute","value":5368812590},"count":72},{"address":{"type":"absolute","value":5368812600},"count":55},{"address":{"type":"absolute","value":5368812615},"count":36},{"address":{"type":"absolute","value":5368812640},"count":60},{"address":{"type":"absolute","value":5368812645},"count":9},{"address":{"type":"absolute","value":5368812650},"count":30},{"address":{"type":"absolute","value":5368812660},"count":29},{"address":{"type":"absolute","value":5368812665},"count":9},{"address":{"type":"absolute","value":5368812670},"count":57},{"address":{"type":"absolute","value":5368812675},"count":47},{"address":{"type":"absolute","value":5368812680},"count":49},{"address":{"type":"absolute","value":5368812685},"count":61},{"address":{"type":"absolute","value":5368812690},"count":9},{"address":{"type":"absolute","value":5368812695},"count":45},{"address":{"type":"absolute","value":5368812700},"count":39},{"address":{"type":"absolute","value":5368812710},"count":26},{"address":{"type":"absolute","value":5368812715},"count":77},{"address":{"type":"absolute","value":5368812725},"count":35},{"address":{"type":"absolute","value":5368812730},"count":31},{"address":{"type":"absolute","value":5368812735},"count":53},{"address":{"type":"absolute","value":5368812740},"count":8},{"address":{"type":"absolute","value":5368812745},"count":35},{"address":{"type":"absolute","value":5368812750},"count":9},{"address":{"type":"absolute","value":5368812770},"count":11},{"address":{"type":"absolute","value":5368812775},"count":27},{"address":{"type":"absolute","value":5368812780},"count":45},{"address":{"type":"absolute","value":5368812785},"count":36},{"address":{"type":"absolute","value":5368812805},"count":39},{"address":{"type":"absolute","value":5368812810},"count":28},{"address":{"type":"absolute","value":5368812830},"count":28},{"address":{"type":"absolute","value":5368812840},"count":31},{"address":{"type":"absolute","value":5368812845},"count":54},{"address":{"type":"absolute","value":5368812855},"count":31},{"address":{"type":"absolute","value":5368812860},"count":33},{"address":{"type":"absolute","value":5368812865},"count":19},{"address":{"type":"absolute","value":5368812870},"count":8},{"address":{"type":"absolute","value":5368812875},"count":89},{"address":{"type":"absolute","value":5368812880},"count":37},{"address":{"type":"absolute","value":5368812890},"count":31},{"address":{"type":"absolute","value":5368812895},"count":41},{"address":{"type":"absolute","value":5368812900},"count":38},{"address":{"type":"absolute","value":5368812910},"count":81},{"address":{"type":"absolute","value":5368812920},"count":33},{"address":{"type":"absolute","value":5368812925},"count":32},{"address":{"type":"absolute","value":5368812935},"count":36},{"address":{"type":"absolute","value":5368812950},"count":27},{"address":{"type":"absolute","value":5368812955},"count":28},{"address":{"type":"absolute","value":5368812960},"count":39},{"address":{"type":"absolute","value":5368812970},"count":35},{"address":{"type":"absolute","value":5368812975},"count":24},{"address":{"type":"absolute","value":5368812980},"count":35},{"address":{"type":"absolute","value":5368812985},"count":33},{"address":{"type":"absolute","value":5368812990},"count":54},{"address":{"type":"absolute","value":5368812995},"count":26},{"address":{"type":"absolute","value":5368813005},"count":9},{"address":{"type":"absolute","value":5368813020},"count":33},{"address":{"type":"absolute","value":5368813025},"count":10},{"address":{"type":"absolute","value":5368813030},"count":33},{"address":{"type":"absolute","value":5368813035},"count":64},{"address":{"type":"absolute","value":5368813040},"count":36},{"address":{"type":"absolute","value":5368813050},"count":26},{"address":{"type":"absolute","value":5368813055},"count":10},{"address":{"type":"absolute","value":5368813060},"count":32},{"address":{"type":"absolute","value":5368813065},"count":42},{"address":{"type":"absolute","value":5368813070},"count":31},{"address":{"type":"absolute","value":5368813075},"count":38},{"address":{"type":"absolute","value":5368813080},"count":39},{"address":{"type":"absolute","value":5368813085},"count":26},{"address":{"type":"absolute","value":5368813095},"count":29},{"address":{"type":"absolute","value":5368813100},"count":31},{"address":{"type":"absolute","value":5368813105},"count":35},{"address":{"type":"absolute","value":5368813115},"count":33},{"address":{"type":"absolute","value":5368813120},"count":40},{"address":{"type":"absolute","value":5368813125},"count":25},{"address":{"type":"absolute","value":5368813130},"count":12},{"address":{"type":"absolute","value":5368813135},"count":26},{"address":{"type":"absolute","value":5368813145},"count":31},{"address":{"type":"absolute","value":5368813155},"count":60},{"address":{"type":"absolute","value":5368813170},"count":65},{"address":{"type":"absolute","value":5368813175},"count":57},{"address":{"type":"absolute","value":5368813180},"count":42},{"address":{"type":"absolute","value":5368813185},"count":9},{"address":{"type":"absolute","value":5368813190},"count":44},{"address":{"type":"absolute","value":5368813195},"count":70},{"address":{"type":"absolute","value":5368813200},"count":62},{"address":{"type":"absolute","value":5368813205},"count":32},{"address":{"type":"absolute","value":5368813215},"count":28},{"address":{"type":"absolute","value":5368813220},"count":35},{"address":{"type":"absolute","value":5368813225},"count":35},{"address":{"type":"absolute","value":5368813235},"count":52},{"address":{"type":"absolute","value":5368813240},"count":37},{"address":{"type":"absolute","value":5368813245},"count":35},{"address":{"type":"absolute","value":5368813250},"count":9},{"address":{"type":"absolute","value":5368813255},"count":9},{"address":{"type":"absolute","value":5368813260},"count":22},{"address":{"type":"absolute","value":5368813265},"count":31},{"address":{"type":"absolute","value":5368813275},"count":53},{"address":{"type":"absolute","value":5368813280},"count":45},{"address":{"type":"absolute","value":5368813285},"count":38},{"address":{"type":"absolute","value":5368813290},"count":33},{"address":{"type":"absolute","value":5368813305},"count":9},{"address":{"type":"absolute","value":5368813310},"count":31},{"address":{"type":"absolute","value":5368813315},"count":48},{"address":{"type":"absolute","value":5368813335},"count":79},{"address":{"type":"absolute","value":5368813345},"count":28},{"address":{"type":"absolute","value":5368813350},"count":60},{"address":{"type":"absolute","value":5368813355},"count":58},{"address":{"type":"absolute","value":5368813365},"count":10},{"address":{"type":"absolute","value":5368813380},"count":29},{"address":{"type":"absolute","value":5368813390},"count":9},{"address":{"type":"absolute","value":5368813395},"count":66},{"address":{"type":"absolute","value":5368813400},"count":38},{"address":{"type":"absolute","value":5368813405},"count":62},{"address":{"type":"absolute","value":5368813415},"count":31},{"address":{"type":"absolute","value":5368813420},"count":59},{"address":{"type":"absolute","value":5368813435},"count":41},{"address":{"type":"absolute","value":5368813440},"count":51},{"address":{"type":"absolute","value":5368813445},"count":66},{"address":{"type":"absolute","value":5368813460},"count":37},{"address":{"type":"absolute","value":5368813465},"count":54},{"address":{"type":"absolute","value":5368813470},"count":35},{"address":{"type":"absolute","value":5368813475},"count":43},{"address":{"type":"absolute","value":5368813485},"count":27},{"address":{"type":"absolute","value":5368813490},"count":299},{"address":{"type":"absolute","value":5368813500},"count":40},{"address":{"type":"absolute","value":5368813505},"count":36},{"address":{"type":"absolute","value":5368813515},"count":60},{"address":{"type":"absolute","value":5368813525},"count":50},{"address":{"type":"absolute","value":5368813540},"count":60},{"address":{"type":"absolute","value":5368813545},"count":35},{"address":{"type":"absolute","value":5368813550},"count":33},{"address":{"type":"absolute","value":5368813555},"count":32},{"address":{"type":"absolute","value":5368813560},"count":29},{"address":{"type":"absolute","value":5368813565},"count":38},{"address":{"type":"absolute","value":5368813575},"count":9},{"address":{"type":"absolute","value":5368813580},"count":39},{"address":{"type":"absolute","value":5368813585},"count":66},{"address":{"type":"absolute","value":5368813590},"count":57},{"address":{"type":"absolute","value":5368813595},"count":31},{"address":{"type":"absolute","value":5368813600},"count":43},{"address":{"type":"absolute","value":5368813610},"count":28},{"address":{"type":"absolute","value":5368813615},"count":9},{"address":{"type":"absolute","value":5368813620},"count":10},{"address":{"type":"absolute","value":5368813625},"count":31},{"address":{"type":"absolute","value":5368813630},"count":14},{"address":{"type":"absolute","value":5368813635},"count":64},{"address":{"type":"absolute","value":5368813650},"count":27},{"address":{"type":"absolute","value":5368813665},"count":54},{"address":{"type":"absolute","value":5368813670},"count":70},{"address":{"type":"absolute","value":5368813675},"count":31},{"address":{"type":"absolute","value":5368813680},"count":61},{"address":{"type":"absolute","value":5368813685},"count":41},{"address":{"type":"absolute","value":5368813695},"count":36},{"address":{"type":"absolute","value":5368813700},"count":39},{"address":{"type":"absolute","value":5368813705},"count":69},{"address":{"type":"absolute","value":5368813710},"count":52},{"address":{"type":"absolute","value":5368813715},"count":34},{"address":{"type":"absolute","value":5368813720},"count":30},{"address":{"type":"absolute","value":5368813730},"count":26},{"address":{"type":"absolute","value":5368813735},"count":9},{"address":{"type":"absolute","value":5368813745},"count":52},{"address":{"type":"absolute","value":5368813750},"count":107},{"address":{"type":"absolute","value":5368813755},"count":38},{"address":{"type":"absolute","value":5368813760},"count":75},{"address":{"type":"absolute","value":5368813770},"count":61},{"address":{"type":"absolute","value":5368813780},"count":9},{"address":{"type":"absolute","value":5368813785},"count":34},{"address":{"type":"absolute","value":5368813795},"count":9},{"address":{"type":"absolute","value":5368813800},"count":38},{"address":{"type":"absolute","value":5368813805},"count":32},{"address":{"type":"absolute","value":5368813810},"count":30},{"address":{"type":"absolute","value":5368813815},"count":41},{"address":{"type":"absolute","value":5368813820},"count":36},{"address":{"type":"absolute","value":5368813825},"count":17},{"address":{"type":"absolute","value":5368813830},"count":36},{"address":{"type":"absolute","value":5368813835},"count":41},{"address":{"type":"absolute","value":5368813840},"count":61},{"address":{"type":"absolute","value":5368813845},"count":30},{"address":{"type":"absolute","value":5368813860},"count":27},{"address":{"type":"absolute","value":5368813865},"count":31},{"address":{"type":"absolute","value":5368813875},"count":42},{"address":{"type":"absolute","value":5368813890},"count":9},{"address":{"type":"absolute","value":5368813895},"count":64},{"address":{"type":"absolute","value":5368813900},"count":8},{"address":{"type":"absolute","value":5368813910},"count":53},{"address":{"type":"absolute","value":5368813915},"count":8},{"address":{"type":"absolute","value":5368813920},"count":31},{"address":{"type":"absolute","value":5368813925},"count":39},{"address":{"type":"absolute","value":5368813930},"count":60},{"address":{"type":"absolute","value":5368813935},"count":50},{"address":{"type":"absolute","value":5368813950},"count":35},{"address":{"type":"absolute","value":5368813960},"count":42},{"address":{"type":"absolute","value":5368813970},"count":30},{"address":{"type":"absolute","value":5368813975},"count":19},{"address":{"type":"absolute","value":5368813980},"count":17},{"address":{"type":"absolute","value":5368813990},"count":61},{"address":{"type":"absolute","value":5368814000},"count":22},{"address":{"type":"absolute","value":5368814015},"count":28},{"address":{"type":"absolute","value":5368814020},"count":35},{"address":{"type":"absolute","value":5368814025},"count":45},{"address":{"type":"absolute","value":5368814030},"count":27},{"address":{"type":"absolute","value":5368814035},"count":43},{"address":{"type":"absolute","value":5368814040},"count":53},{"address":{"type":"absolute","value":5368814045},"count":34},{"address":{"type":"absolute","value":5368814050},"count":39},{"address":{"type":"absolute","value":5368814055},"count":37},{"address":{"type":"absolute","value":5368814060},"count":33},{"address":{"type":"absolute","value":5368814065},"count":31},{"address":{"type":"absolute","value":5368814075},"count":35},{"address":{"type":"absolute","value":5368814090},"count":41},{"address":{"type":"absolute","value":5368814100},"count":44},{"address":{"type":"absolute","value":5368814110},"count":10},{"address":{"type":"absolute","value":5368814130},"count":63},{"address":{"type":"absolute","value":5368814135},"count":75},{"address":{"type":"absolute","value":5368814145},"count":43},{"address":{"type":"absolute","value":5368814160},"count":35},{"address":{"type":"absolute","value":5368814165},"count":36},{"address":{"type":"absolute","value":5368814175},"count":35},{"address":{"type":"absolute","value":5368814180},"count":54},{"address":{"type":"absolute","value":5368814195},"count":10},{"address":{"type":"absolute","value":5368814200},"count":35},{"address":{"type":"absolute","value":5368814205},"count":65},{"address":{"type":"absolute","value":5368814210},"count":44},{"address":{"type":"absolute","value":5368814215},"count":9},{"address":{"type":"absolute","value":5368814225},"count":31},{"address":{"type":"absolute","value":5368814230},"count":76},{"address":{"type":"absolute","value":5368814235},"count":8},{"address":{"type":"absolute","value":5368814240},"count":68},{"address":{"type":"absolute","value":5368814250},"count":33},{"address":{"type":"absolute","value":5368814255},"count":34},{"address":{"type":"absolute","value":5368814260},"count":9},{"address":{"type":"absolute","value":5368814270},"count":32},{"address":{"type":"absolute","value":5368814275},"count":8},{"address":{"type":"absolute","value":5368814290},"count":49},{"address":{"type":"absolute","value":5368814295},"count":30},{"address":{"type":"absolute","value":5368814300},"count":44},{"address":{"type":"absolute","value":5368814305},"count":41},{"address":{"type":"absolute","value":5368814310},"count":32},{"address":{"type":"absolute","value":5368814315},"count":62},{"address":{"type":"absolute","value":5368814325},"count":33},{"address":{"type":"absolute","value":5368814330},"count":30},{"address":{"type":"absolute","value":5368814335},"count":42},{"address":{"type":"absolute","value":5368814340},"count":28},{"address":{"type":"absolute","value":5368814345},"count":65},{"address":{"type":"absolute","value":5368814355},"count":9},{"address":{"type":"absolute","value":5368814360},"count":37},{"address":{"type":"absolute","value":5368814365},"count":42},{"address":{"type":"absolute","value":5368814375},"count":29},{"address":{"type":"absolute","value":5368814390},"count":35},{"address":{"type":"absolute","value":5368814400},"count":31},{"address":{"type":"absolute","value":5368814405},"count":9},{"address":{"type":"absolute","value":5368814410},"count":31},{"address":{"type":"absolute","value":5368814415},"count":19},{"address":{"type":"absolute","value":5368814425},"count":61},{"address":{"type":"absolute","value":5368814435},"count":36},{"address":{"type":"absolute","value":5368814440},"count":32},{"address":{"type":"absolute","value":5368814445},"count":46},{"address":{"type":"absolute","value":5368814450},"count":61},{"address":{"type":"absolute","value":5368814455},"count":53},{"address":{"type":"absolute","value":5368814460},"count":30},{"address":{"type":"absolute","value":5368814465},"count":33},{"address":{"type":"absolute","value":5368814470},"count":9},{"address":{"type":"absolute","value":5368814485},"count":33},{"address":{"type":"absolute","value":5368814490},"count":42},{"address":{"type":"absolute","value":5368814495},"count":10},{"address":{"type":"absolute","value":5368814500},"count":94},{"address":{"type":"absolute","value":5368814520},"count":9},{"address":{"type":"absolute","value":5368814530},"count":39},{"address":{"type":"absolute","value":5368814540},"count":49},{"address":{"type":"absolute","value":5368814545},"count":33},{"address":{"type":"absolute","value":5368814550},"count":33},{"address":{"type":"absolute","value":5368814555},"count":54},{"address":{"type":"absolute","value":5368814560},"count":27},{"address":{"type":"absolute","value":5368814585},"count":9},{"address":{"type":"absolute","value":5368814590},"count":81},{"address":{"type":"absolute","value":5368814600},"count":41},{"address":{"type":"absolute","value":5368814605},"count":50},{"address":{"type":"absolute","value":5368814615},"count":36},{"address":{"type":"absolute","value":5368814620},"count":45},{"address":{"type":"absolute","value":5368814630},"count":60},{"address":{"type":"absolute","value":5368814640},"count":61},{"address":{"type":"absolute","value":5368814645},"count":31},{"address":{"type":"absolute","value":5368814650},"count":43},{"address":{"type":"absolute","value":5368814665},"count":33},{"address":{"type":"absolute","value":5368814680},"count":28},{"address":{"type":"absolute","value":5368814685},"count":33},{"address":{"type":"absolute","value":5368814690},"count":109},{"address":{"type":"absolute","value":5368814695},"count":27},{"address":{"type":"absolute","value":5368814700},"count":42},{"address":{"type":"absolute","value":5368814705},"count":55},{"address":{"type":"absolute","value":5368814710},"count":39},{"address":{"type":"absolute","value":5368814715},"count":37},{"address":{"type":"absolute","value":5368814720},"count":32},{"address":{"type":"absolute","value":5368814725},"count":31},{"address":{"type":"absolute","value":5368814730},"count":32},{"address":{"type":"absolute","value":5368814735},"count":55},{"address":{"type":"absolute","value":5368814740},"count":30},{"address":{"type":"absolute","value":5368814745},"count":31},{"address":{"type":"absolute","value":5368814750},"count":15},{"address":{"type":"absolute","value":5368814755},"count":33},{"address":{"type":"absolute","value":5368814760},"count":9},{"address":{"type":"absolute","value":5368814765},"count":10},{"address":{"type":"absolute","value":5368814775},"count":56},{"address":{"type":"absolute","value":5368814780},"count":33},{"address":{"type":"absolute","value":5368814790},"count":38},{"address":{"type":"absolute","value":5368814795},"count":24},{"address":{"type":"absolute","value":5368814800},"count":61},{"address":{"type":"absolute","value":5368814810},"count":60},{"address":{"type":"absolute","value":5368814815},"count":30},{"address":{"type":"absolute","value":5368814820},"count":68},{"address":{"type":"absolute","value":5368814830},"count":29},{"address":{"type":"absolute","value":5368814835},"count":31},{"address":{"type":"absolute","value":5368814850},"count":42},{"address":{"type":"absolute","value":5368814855},"count":31},{"address":{"type":"absolute","value":5368814865},"count":118},{"address":{"type":"absolute","value":5368814870},"count":49},{"address":{"type":"absolute","value":5368814875},"count":43},{"address":{"type":"absolute","value":5368814880},"count":62},{"address":{"type":"absolute","value":5368814890},"count":24},{"address":{"type":"absolute","value":5368814895},"count":61},{"address":{"type":"absolute","value":5368814900},"count":22},{"address":{"type":"absolute","value":5368814905},"count":79},{"address":{"type":"absolute","value":5368814910},"count":9},{"address":{"type":"absolute","value":5368814925},"count":35},{"address":{"type":"absolute","value":5368814935},"count":73},{"address":{"type":"absolute","value":5368814940},"count":33},{"address":{"type":"absolute","value":5368814945},"count":41},{"address":{"type":"absolute","value":5368814955},"count":27},{"address":{"type":"absolute","value":5368814960},"count":28},{"address":{"type":"absolute","value":5368814965},"count":33},{"address":{"type":"absolute","value":5368814970},"count":36},{"address":{"type":"absolute","value":5368814980},"count":53},{"address":{"type":"absolute","value":5368814985},"count":31},{"address":{"type":"absolute","value":5368814990},"count":55},{"address":{"type":"absolute","value":5368814995},"count":31},{"address":{"type":"absolute","value":5368815005},"count":54},{"address":{"type":"absolute","value":5368815010},"count":33},{"address":{"type":"absolute","value":5368815025},"count":9},{"address":{"type":"absolute","value":5368815040},"count":84},{"address":{"type":"absolute","value":5368815045},"count":9},{"address":{"type":"absolute","value":5368815050},"count":73},{"address":{"type":"absolute","value":5368815055},"count":37},{"address":{"type":"absolute","value":5368815060},"count":52},{"address":{"type":"absolute","value":5368815070},"count":39},{"address":{"type":"absolute","value":5368815085},"count":39},{"address":{"type":"absolute","value":5368815090},"count":69},{"address":{"type":"absolute","value":5368815100},"count":42},{"address":{"type":"absolute","value":5368815105},"count":30},{"address":{"type":"absolute","value":5368815115},"count":53},{"address":{"type":"absolute","value":5368815125},"count":31},{"address":{"type":"absolute","value":5368815130},"count":13},{"address":{"type":"absolute","value":5368815135},"count":12},{"address":{"type":"absolute","value":5368815140},"count":16},{"address":{"type":"absolute","value":5368815145},"count":33},{"address":{"type":"absolute","value":5368815150},"count":64},{"address":{"type":"absolute","value":5368815160},"count":53},{"address":{"type":"absolute","value":5368815165},"count":62},{"address":{"type":"absolute","value":5368815170},"count":63},{"address":{"type":"absolute","value":5368815175},"count":56},{"address":{"type":"absolute","value":5368815180},"count":35},{"address":{"type":"absolute","value":5368815185},"count":30},{"address":{"type":"absolute","value":5368815190},"count":76},{"address":{"type":"absolute","value":5368815195},"count":30},{"address":{"type":"absolute","value":5368815200},"count":74},{"address":{"type":"absolute","value":5368815205},"count":31},{"address":{"type":"absolute","value":5368815210},"count":84},{"address":{"type":"absolute","value":5368815215},"count":54},{"address":{"type":"absolute","value":5368815225},"count":12},{"address":{"type":"absolute","value":5368815230},"count":87},{"address":{"type":"absolute","value":5368815240},"count":24},{"address":{"type":"absolute","value":5368815245},"count":40},{"address":{"type":"absolute","value":5368815250},"count":34},{"address":{"type":"absolute","value":5368815255},"count":32},{"address":{"type":"absolute","value":5368815260},"count":31},{"address":{"type":"absolute","value":5368815265},"count":60},{"address":{"type":"absolute","value":5368815270},"count":31},{"address":{"type":"absolute","value":5368815280},"count":38},{"address":{"type":"absolute","value":5368815290},"count":33},{"address":{"type":"absolute","value":5368815300},"count":53},{"address":{"type":"absolute","value":5368815305},"count":30},{"address":{"type":"absolute","value":5368815310},"count":33},{"address":{"type":"absolute","value":5368815315},"count":89},{"address":{"type":"absolute","value":5368815320},"count":39},{"address":{"type":"absolute","value":5368815325},"count":45},{"address":{"type":"absolute","value":5368815335},"count":35},{"address":{"type":"absolute","value":5368815340},"count":63},{"address":{"type":"absolute","value":5368815350},"count":78},{"address":{"type":"absolute","value":5368815360},"count":27},{"address":{"type":"absolute","value":5368815365},"count":39},{"address":{"type":"absolute","value":5368815370},"count":40},{"address":{"type":"absolute","value":5368815380},"count":37},{"address":{"type":"absolute","value":5368815385},"count":32},{"address":{"type":"absolute","value":5368815390},"count":36},{"address":{"type":"absolute","value":5368815400},"count":9},{"address":{"type":"absolute","value":5368815415},"count":28},{"address":{"type":"absolute","value":5368815435},"count":81},{"address":{"type":"absolute","value":5368815440},"count":52},{"address":{"type":"absolute","value":5368815450},"count":28},{"address":{"type":"absolute","value":5368815460},"count":31},{"address":{"type":"absolute","value":5368815470},"count":28},{"address":{"type":"absolute","value":5368815475},"count":32},{"address":{"type":"absolute","value":5368815480},"count":61},{"address":{"type":"absolute","value":5368815490},"count":31},{"address":{"type":"absolute","value":5368815495},"count":30},{"address":{"type":"absolute","value":5368815500},"count":43},{"address":{"type":"absolute","value":5368815505},"count":33},{"address":{"type":"absolute","value":5368815510},"count":31},{"address":{"type":"absolute","value":5368815515},"count":16},{"address":{"type":"absolute","value":5368815520},"count":33},{"address":{"type":"absolute","value":5368815525},"count":43},{"address":{"type":"absolute","value":5368815530},"count":30},{"address":{"type":"absolute","value":5368815535},"count":32},{"address":{"type":"absolute","value":5368815550},"count":38},{"address":{"type":"absolute","value":5368815555},"count":35},{"address":{"type":"absolute","value":5368815570},"count":9},{"address":{"type":"absolute","value":5368815575},"count":62},{"address":{"type":"absolute","value":5368815585},"count":44},{"address":{"type":"absolute","value":5368815590},"count":65},{"address":{"type":"absolute","value":5368815595},"count":32},{"address":{"type":"absolute","value":5368815600},"count":35},{"address":{"type":"absolute","value":5368815610},"count":56},{"address":{"type":"absolute","value":5368815615},"count":29},{"address":{"type":"absolute","value":5368815625},"count":41},{"address":{"type":"absolute","value":5368815630},"count":28},{"address":{"type":"absolute","value":5368815635},"count":35},{"address":{"type":"absolute","value":5368815640},"count":40},{"address":{"type":"absolute","value":5368815645},"count":24},{"address":{"type":"absolute","value":5368815655},"count":50},{"address":{"type":"absolute","value":5368815660},"count":29},{"address":{"type":"absolute","value":5368815670},"count":38},{"address":{"type":"absolute","value":5368815675},"count":72},{"address":{"type":"absolute","value":5368815680},"count":43},{"address":{"type":"absolute","value":5368815685},"count":22},{"address":{"type":"absolute","value":5368815690},"count":85},{"address":{"type":"absolute","value":5368815700},"count":30},{"address":{"type":"absolute","value":5368815705},"count":31},{"address":{"type":"absolute","value":5368815715},"count":82},{"address":{"type":"absolute","value":5368815720},"count":31},{"address":{"type":"absolute","value":5368815725},"count":41},{"address":{"type":"absolute","value":5368815735},"count":39},{"address":{"type":"absolute","value":5368815745},"count":31},{"address":{"type":"absolute","value":5368815755},"count":52},{"address":{"type":"absolute","value":5368815765},"count":47},{"address":{"type":"absolute","value":5368815770},"count":60},{"address":{"type":"absolute","value":5368815775},"count":38},{"address":{"type":"absolute","value":5368815780},"count":52},{"address":{"type":"absolute","value":5368815785},"count":19},{"address":{"type":"absolute","value":5368815795},"count":9},{"address":{"type":"absolute","value":5368815805},"count":134},{"address":{"type":"absolute","value":5368815820},"count":25},{"address":{"type":"absolute","value":5368815830},"count":9},{"address":{"type":"absolute","value":5368815835},"count":35},{"address":{"type":"absolute","value":5368815850},"count":28},{"address":{"type":"absolute","value":5368815855},"count":6},{"address":{"type":"absolute","value":5368815865},"count":57},{"address":{"type":"absolute","value":5368815870},"count":36},{"address":{"type":"absolute","value":5368815880},"count":39},{"address":{"type":"absolute","value":5368815890},"count":46},{"address":{"type":"absolute","value":5368815895},"count":33},{"address":{"type":"absolute","value":5368815900},"count":24},{"address":{"type":"absolute","value":5368815905},"count":43},{"address":{"type":"absolute","value":5368815910},"count":48},{"address":{"type":"absolute","value":5368815920},"count":10},{"address":{"type":"absolute","value":5368815925},"count":62},{"address":{"type":"absolute","value":5368815930},"count":40},{"address":{"type":"absolute","value":5368815940},"count":26},{"address":{"type":"absolute","value":5368815945},"count":31},{"address":{"type":"absolute","value":5368815955},"count":34},{"address":{"type":"absolute","value":5368815960},"count":59},{"address":{"type":"absolute","value":5368815965},"count":19},{"address":{"type":"absolute","value":5368815970},"count":57},{"address":{"type":"absolute","value":5368815975},"count":8},{"address":{"type":"absolute","value":5368815980},"count":45},{"address":{"type":"absolute","value":5368815985},"count":32},{"address":{"type":"absolute","value":5368815990},"count":32},{"address":{"type":"absolute","value":5368815995},"count":35},{"address":{"type":"absolute","value":5368816000},"count":39},{"address":{"type":"absolute","value":5368816005},"count":31},{"address":{"type":"absolute","value":5368816010},"count":87},{"address":{"type":"absolute","value":5368816015},"count":26},{"address":{"type":"absolute","value":5368816020},"count":33},{"address":{"type":"absolute","value":5368816025},"count":50},{"address":{"type":"absolute","value":5368816040},"count":38},{"address":{"type":"absolute","value":5368816045},"count":42},{"address":{"type":"absolute","value":5368816055},"count":32},{"address":{"type":"absolute","value":5368816060},"count":84},{"address":{"type":"absolute","value":5368816065},"count":52},{"address":{"type":"absolute","value":5368816070},"count":40},{"address":{"type":"absolute","value":5368816080},"count":43},{"address":{"type":"absolute","value":5368816085},"count":31},{"address":{"type":"absolute","value":5368816095},"count":28},{"address":{"type":"absolute","value":5368816100},"count":60},{"address":{"type":"absolute","value":5368816105},"count":55},{"address":{"type":"absolute","value":5368816110},"count":31},{"address":{"type":"absolute","value":5368816120},"count":40},{"address":{"type":"absolute","value":5368816125},"count":30},{"address":{"type":"absolute","value":5368816135},"count":19},{"address":{"type":"absolute","value":5368816145},"count":33},{"address":{"type":"absolute","value":5368816155},"count":76},{"address":{"type":"absolute","value":5368816160},"count":164},{"address":{"type":"absolute","value":5368816165},"count":107},{"address":{"type":"absolute","value":5368816170},"count":33},{"address":{"type":"absolute","value":5368816180},"count":32},{"address":{"type":"absolute","value":5368816185},"count":16},{"address":{"type":"absolute","value":5368816195},"count":38},{"address":{"type":"absolute","value":5368816205},"count":43},{"address":{"type":"absolute","value":5368816215},"count":69},{"address":{"type":"absolute","value":5368816220},"count":9},{"address":{"type":"absolute","value":5368816225},"count":36},{"address":{"type":"absolute","value":5368816230},"count":74},{"address":{"type":"absolute","value":5368816235},"count":34},{"address":{"type":"absolute","value":5368816240},"count":9},{"address":{"type":"absolute","value":5368816245},"count":114},{"address":{"type":"absolute","value":5368816250},"count":37},{"address":{"type":"absolute","value":5368816265},"count":32},{"address":{"type":"absolute","value":5368816270},"count":27},{"address":{"type":"absolute","value":5368816275},"count":29},{"address":{"type":"absolute","value":5368816280},"count":34},{"address":{"type":"absolute","value":5368816290},"count":8},{"address":{"type":"absolute","value":5368816295},"count":39},{"address":{"type":"absolute","value":5368816310},"count":54},{"address":{"type":"absolute","value":5368816320},"count":65},{"address":{"type":"absolute","value":5368816335},"count":9},{"address":{"type":"absolute","value":5368816340},"count":32},{"address":{"type":"absolute","value":5368816345},"count":31},{"address":{"type":"absolute","value":5368816355},"count":37},{"address":{"type":"absolute","value":5368816360},"count":35},{"address":{"type":"absolute","value":5368816365},"count":18},{"address":{"type":"absolute","value":5368816375},"count":24},{"address":{"type":"absolute","value":5368816380},"count":36},{"address":{"type":"absolute","value":5368816385},"count":43},{"address":{"type":"absolute","value":5368816400},"count":41},{"address":{"type":"absolute","value":5368816405},"count":33},{"address":{"type":"absolute","value":5368816415},"count":32},{"address":{"type":"absolute","value":5368816420},"count":31},{"address":{"type":"absolute","value":5368816425},"count":10},{"address":{"type":"absolute","value":5368816430},"count":9},{"address":{"type":"absolute","value":5368816445},"count":37},{"address":{"type":"absolute","value":5368816450},"count":28},{"address":{"type":"absolute","value":5368816455},"count":28},{"address":{"type":"absolute","value":5368816460},"count":66},{"address":{"type":"absolute","value":5368816465},"count":37},{"address":{"type":"absolute","value":5368816470},"count":31},{"address":{"type":"absolute","value":5368816480},"count":30},{"address":{"type":"absolute","value":5368816485},"count":32},{"address":{"type":"absolute","value":5368816490},"count":39},{"address":{"type":"absolute","value":5368816495},"count":26},{"address":{"type":"absolute","value":5368816500},"count":57},{"address":{"type":"absolute","value":5368816505},"count":29},{"address":{"type":"absolute","value":5368816510},"count":37},{"address":{"type":"absolute","value":5368816515},"count":36},{"address":{"type":"absolute","value":5368816525},"count":10},{"address":{"type":"absolute","value":5368816530},"count":31},{"address":{"type":"absolute","value":5368816540},"count":31},{"address":{"type":"absolute","value":5368816545},"count":37},{"address":{"type":"absolute","value":5368816550},"count":39},{"address":{"type":"absolute","value":5368816555},"count":30},{"address":{"type":"absolute","value":5368821600},"count":25},{"address":{"type":"absolute","value":5368821728},"count":61},{"address":{"type":"absolute","value":5368822176},"count":116},{"address":{"type":"absolute","value":5368824096},"count":61},{"address":{"type":"absolute","value":5368838672},"count":41},{"address":{"type":"absolute","value":5368882832},"count":94},{"address":{"type":"absolute","value":5368891376},"count":61},{"address":{"type":"absolute","value":5368891792},"count":59},{"address":{"type":"absolute","value":5368892096},"count":45},{"address":{"type":"absolute","value":5368892304},"count":43},{"address":{"type":"absolute","value":5368909136},"count":46},{"address":{"type":"absolute","value":5368960864},"count":60},{"address":{"type":"absolute","value":5368963056},"count":38},{"address":{"type":"absolute","value":5368964112},"count":54},{"address":{"type":"absolute","value":5368964496},"count":43},{"address":{"type":"absolute","value":5368971776},"count":30},{"address":{"type":"absolute","value":5368971888},"count":28},{"address":{"type":"absolute","value":5368986896},"count":61},{"address":{"type":"absolute","value":5368987312},"count":59},{"address":{"type":"absolute","value":5368988000},"count":45},{"address":{"type":"absolute","value":5368988208},"count":43},{"address":{"type":"absolute","value":5369037280},"count":21}]},"library_functions":[{"address":{"type":"absolute","value":5369005504},"name":"?find_pe_section@@YAPEAU_IMAGE_SECTION_HEADER@@QEAE_K@Z"},{"address":{"type":"absolute","value":5369005792},"name":"?is_potentially_valid_image_base@@YA_NQEAX@Z"},{"address":{"type":"absolute","value":5369008832},"name":"?"},{"address":{"type":"absolute","value":5369009024},"name":"?"},{"address":{"type":"absolute","value":5369009248},"name":"?pre_c_initialization@@YAHXZ"},{"address":{"type":"absolute","value":5369009472},"name":"mbedtls_des_setkey_enc"},{"address":{"type":"absolute","value":5369009504},"name":"?pre_cpp_initialization@@YAXXZ"},{"address":{"type":"absolute","value":5369009536},"name":"?__scrt_common_main@@YAHXZ"},{"address":{"type":"absolute","value":5369009568},"name":"?__scrt_common_main_seh@@YAHXZ"},{"address":{"type":"absolute","value":5369010096},"name":"?invoke_main@@YAHXZ"},{"address":{"type":"absolute","value":5369010320},"name":"?DebuggerProbe@@YA_NK@Z"},{"address":{"type":"absolute","value":5369010400},"name":"?DebuggerRuntime@@YA_NKHPEAXPEB_W@Z"},{"address":{"type":"absolute","value":5369011536},"name":"?_strlen_priv@@YA_KPEBD@Z"},{"address":{"type":"absolute","value":5369011568},"name":"?failwithmessage@@YAXPEAXHHPEBD@Z"},{"address":{"type":"absolute","value":5369012336},"name":"?notify_debugger@@YAXAEBUtagEXCEPTION_VISUALCPP_DEBUG_INFO@@@Z"},{"address":{"type":"absolute","value":5369016608},"name":"__get_entropy"},{"address":{"type":"absolute","value":5369017584},"name":"?GetPdbDll@@YAPEAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":5369018000},"name":"?GetPdbDllFromInstallPath@@YAPEAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":5369018864},"name":"?GetPdbDllPathFromFilePath@@YAHPEB_WPEA_W_K@Z"}]}},"rules":{"calculate modulo 256 via x86 assembly":{"meta":{"name":"calculate modulo 256 via x86 assembly","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"instruction"},"attack":[],"mbc":[{"parts":["Data","Modulo"],"objective":"Data","behavior":"Modulo","method":"","id":"C0058"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4049A9"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: calculate modulo 256 via x86 assembly\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: instruction\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Data::Modulo [C0058]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9\r\n  features:\r\n    #  and ecx, 800000FFh\r\n    #  and ecx, 0FFh\r\n    - and:\r\n      - mnemonic: and\r\n      - or:\r\n        - number: 0x800000FF\r\n        - number: 0xFF\r\n","matches":[[{"type":"absolute","value":5368911666},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":5368911666}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483903}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[{"type":"absolute","value":5368911666}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delay execution\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@ramen0x3f\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449770\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.Sleep\r\n          - api: kernel32.SleepEx\r\n          - api: kernel32.WaitForSingleObject\r\n          - api: kernel32.SignalObjectAndWait\r\n          - api: kernel32.WaitForSingleObjectEx\r\n          - api: kernel32.WaitForMultipleObjects\r\n          - api: kernel32.WaitForMultipleObjectsEx\r\n          - api: kernel32.RegisterWaitForSingleObject\r\n          - api: WaitOnAddress\r\n          - api: user32.MsgWaitForMultipleObjects\r\n          - api: user32.MsgWaitForMultipleObjectsEx\r\n          - api: NtDelayExecution\r\n          - api: KeWaitForSingleObject\r\n          - api: KeDelayExecutionThread\r\n      - and:\r\n        - os: linux\r\n        - or:\r\n          - api: sleep\r\n          - api: usleep\r\n","matches":[[{"type":"absolute","value":5368924448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5368924554}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368952779},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368952803}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368844166},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5368844171}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5368914514}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369002064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5369002067}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368951296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368951317}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369000118},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5369000134}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369000497},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5369000506}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368908237},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368908249}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368908692},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368908704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369001893},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5369001903}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955764},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368955788}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: open process\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Open Process [C0065]\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - or:\r\n      - api: kernel32.OpenProcess\r\n      - api: NtOpenProcess\r\n      - api: ZwOpenProcess\r\n","matches":[[{"type":"absolute","value":5368951918},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368951944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368863684},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368863698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368953892},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368953943}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368950804},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368950815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368993008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368993126}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368906656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368906713}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955014},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368955040}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate memory":{"meta":{"name":"allocate memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate memory\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA  # ntdll.NtAllocateVirtualMemory\r\n  features:\r\n    - or:\r\n      - api: kernel32.VirtualAlloc\r\n      - api: kernel32.VirtualAllocEx\r\n      - api: kernel32.VirtualAllocExNuma\r\n      - api: NtAllocateVirtualMemory\r\n      - api: ZwAllocateVirtualMemory\r\n      - api: NtMapViewOfSection\r\n      - api: ZwMapViewOfSection\r\n      - and:\r\n        - match: link function at runtime on Windows\r\n        - or:\r\n          - string: \"VirtualAlloc\"\r\n          - string: \"VirtualAllocEx\"\r\n          - string: \"VirtualAllocExNuma\"\r\n          - string: \"NtAllocateVirtualMemory\"\r\n          - string: \"ZwAllocateVirtualMemory\"\r\n          - string: \"NtMapViewOfSection\"\r\n          - string: \"ZwMapViewOfSection\"\r\n","matches":[[{"type":"absolute","value":5368952263},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368952388}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368953985},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368954085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368911264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911349}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368911394},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911413}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368839184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368839314}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368950968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910773}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910818},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368838128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368838196}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909660}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909711},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909730}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368841536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368841679}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912405}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912450},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912469}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955356},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368955481}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RW memory":{"meta":{"name":"allocate or change RW memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate or change RW memory\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate memory\r\n        - match: change memory protection\r\n      - or:\r\n        - number: 0x4 = PAGE_READWRITE\r\n        # lea     r9d, [rcx+4]  ; flProtect\r\n        # call    cs:VirtualAlloc\r\n        - instruction:\r\n          - mnemonic: lea\r\n          - offset: 0x4 = PAGE_READWRITE\r\n","matches":[[{"type":"absolute","value":5368952263},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368952388}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368952263}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368952361}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368953985},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368954085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368953985}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368954055}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368911264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911349}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368911330}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368950968},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368951069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910688},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910773}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368910688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368910754}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910818},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368910818}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368910818}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368838128},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368838196}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368838128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368838177}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909660}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368909568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368909641}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909711},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909730}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368909711}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368909711}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368841536},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368841679}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368841536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368841634},{"type":"absolute","value":5368841663}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368913856},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":5368913965}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368913856}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368913950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912320},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912405}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368912320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368912386}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912450},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912469}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368912450}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368912450}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955356},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368955481}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368955356}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368955454}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Program Files directory":{"meta":{"name":"get Program Files directory","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[],"references":[],"examples":["BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get Program Files directory\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    examples:\r\n      - BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880\r\n  features:\r\n    - and:\r\n      - or:\r\n        - number: 0x26 = CSIDL_PROGRAM_FILES\r\n        - number: 0x2A = CSIDL_PROGRAM_FILESX86\r\n      - or:\r\n        - api: shell32.SHGetFolderPath\r\n        - api: shell32.SHGetFolderLocation\r\n        - api: shell32.SHGetSpecialFolderPath\r\n        - api: shell32.SHGetSpecialFolderLocation\r\n","matches":[[{"type":"absolute","value":5368935773},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":5368935776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368935788}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368945965},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":5368945968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368945980}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open registry key\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Registry::Create Registry Key [C0036.004]\r\n      - Operating System::Registry::Open Registry Key [C0036.003]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\r\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\r\n      - 493167E85E45363D09495D0841C30648:0x404D60\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: advapi32.RegOpenKey\r\n      - api: advapi32.RegOpenKeyEx\r\n      - api: advapi32.RegCreateKey\r\n      - api: advapi32.RegCreateKeyEx\r\n      - api: advapi32.RegOpenCurrentUser\r\n      - api: advapi32.RegOpenKeyTransacted\r\n      - api: advapi32.RegOpenUserClassesRoot\r\n      - api: advapi32.RegCreateKeyTransacted\r\n      - api: ZwOpenKey\r\n      - api: ZwOpenKeyEx\r\n      - api: ZwCreateKey\r\n      - api: ZwOpenKeyTransacted\r\n      - api: ZwOpenKeyTransactedEx\r\n      - api: ZwCreateKeyTransacted\r\n      - api: NtOpenKey\r\n      - api: NtCreateKey\r\n      - api: SHRegOpenUSKey\r\n      - api: SHRegCreateUSKey\r\n      - api: RtlCreateRegistryKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\r\n","matches":[[{"type":"absolute","value":5368984512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":5368984654}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368984784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":5368984936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process image filename":{"meta":{"name":"get process image filename","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\r\nrule:\r\n  meta:\r\n    name: get process image filename\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.K32GetProcessImageFileName\r\n          - api: kernel32.GetProcessImageFileName\r\n      - and:\r\n        - api: System.Diagnostics.Process::GetCurrentProcess\r\n        - property/read: System.Diagnostics.Process::MainModule\r\n        - property/read: System.Diagnostics.ProcessModule::FileName\r\n","matches":[[{"type":"absolute","value":5368863767},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5368863804}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368881759},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5368881799}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815130},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5368815130}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369002823},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5369002823}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open thread":{"meta":{"name":"open thread","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Thread"],"objective":"Process","behavior":"Open Thread","method":"","id":"C0066"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: open thread\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Open Thread [C0066]\r\n    examples:\r\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C\r\n  features:\r\n    - or:\r\n      - api: kernel32.OpenThread\r\n      - api: NtOpenThread\r\n      - api: ZwOpenThread\r\n","matches":[[{"type":"absolute","value":5368954290},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":5368954304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368978428},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":5368978439}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Explorer PID":{"meta":{"name":"get Explorer PID","namespace":"host-interaction/process/list","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp"],"examples":["al-khaser_x86.exe_:0x425210"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get Explorer PID\r\n    namespace: host-interaction/process/list\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x425210\r\n  features:\r\n    - and:\r\n      - api: GetShellWindow\r\n      - api: GetWindowThreadProcessId\r\n","matches":[[{"type":"absolute","value":5368857936},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetShellWindow"}},"children":[],"locations":[{"type":"absolute","value":5368858002}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowThreadProcessId"}},"children":[],"locations":[{"type":"absolute","value":5368858015}],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RWX memory":{"meta":{"name":"allocate or change RWX memory","namespace":"host-interaction/process/inject","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate or change RWX memory\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - \"@mr-tz\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\r\n      # ntdll\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate memory\r\n        - match: change memory protection\r\n      - or:\r\n        - number: 0x40 = PAGE_EXECUTE_READWRITE\r\n        # lea     r9d, [rcx+40h]  ; flProtect\r\n        # call    cs:VirtualAlloc\r\n        - instruction:\r\n          - mnemonic: lea\r\n          - offset: 0x40 = PAGE_EXECUTE_READWRITE\r\n","matches":[[{"type":"absolute","value":5368911394},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911413}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368839184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368839314}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368839184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368839298}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for OutputDebugString error":{"meta":{"name":"check for OutputDebugString error","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","OutputDebugString"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"OutputDebugString","id":"B0001.016"}],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_:0x401020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for OutputDebugString error\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-02.exe_:0x401020\r\n  features:\r\n    - and:\r\n      - api: kernel32.SetLastError\r\n      - api: kernel32.GetLastError\r\n      - api: kernel32.OutputDebugString\r\n","matches":[[{"type":"absolute","value":5368844868},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetLastError"}},"children":[],"locations":[{"type":"absolute","value":5368844871}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[{"type":"absolute","value":5368844890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368844884}],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open file\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Create File [C0016]\r\n    examples:\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\r\n  features:\r\n    - or:\r\n      - api: CreateFile\r\n      - api: CreateFileEx\r\n      - api: IoCreateFile\r\n      - api: IoCreateFileEx\r\n      - api: ZwOpenFile\r\n      - api: ZwCreateFile\r\n      - api: NtOpenFile\r\n      - api: NtCreateFile\r\n      - api: LZCreateFile\r\n      - api: LZOpenFile\r\n      - api: fopen\r\n      - api: fopen64\r\n      - api: fdopen\r\n      - api: freopen\r\n      - api: open\r\n      - api: openat\r\n","matches":[[{"type":"absolute","value":5368945480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368945528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368935273},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368935321}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368919549},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368919649}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368919951},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368919997}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368920205},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368920251}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"PEB access":{"meta":{"name":"PEB access","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block","id":"B0001.019"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp"],"examples":["al-khaser_x86.exe_:0x420D20"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: PEB access\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x420D20\r\n  features:\r\n    - or:\r\n      - characteristic: peb access\r\n      - and:\r\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41\r\n        - arch: i386\r\n        - characteristic: fs access\r\n        - or:\r\n          # in 0f5d5d07c6533bc6d991836ce79daaa1\r\n          # then we have:\r\n          #\r\n          #     xor edx, edx\r\n          #     mov edx, fs:[edx+30h]\r\n          - offset: 0x30\r\n          - instruction:\r\n            # in the case of CallObfuscator, gs:[rax]\r\n            - mnemonic: add\r\n            - number: 0x30\r\n      - and:\r\n        - arch: amd64\r\n        - characteristic: gs access\r\n        - or:\r\n          - offset: 0x60\r\n          - instruction:\r\n            - mnemonic: add\r\n            - number: 0x60\r\n      - and:\r\n        # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000\r\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45\r\n        - characteristic: fs access\r\n        - instruction:\r\n          - mnemonic: sub\r\n          - number: 0x2000\r\n","matches":[[{"type":"absolute","value":5368914304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858838},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858534},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368840336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368921024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368921171}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368921171}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368837568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file attributes":{"meta":{"name":"get file attributes","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Get File Attributes"],"objective":"File System","behavior":"Get File Attributes","method":"","id":"C0049"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x180019824","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get file attributes\r\n    namespace: host-interaction/file-system/meta\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Get File Attributes [C0049]\r\n    examples:\r\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x180019824\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetFileAttributes\r\n      - api: ZwQueryDirectoryFile\r\n      - api: ZwQueryInformationFile\r\n      - api: NtQueryDirectoryFile\r\n      - api: NtQueryInformationFile\r\n      - api: System.IO.File::GetAttributes\r\n      - api: System.IO.File::GetCreationTime\r\n      - api: System.IO.File::GetCreationTimeUtc\r\n      - api: System.IO.File::GetLastAccessTime\r\n      - api: System.IO.File::GetLastAccessTimeUtc\r\n      - api: System.IO.File::GetLastWriteTime\r\n      - api: System.IO.File::GetLastWriteTimeUtc\r\n      - property/read: System.IO.FileSystemInfo::Attributes\r\n      - api: stat\r\n      - api: fstat\r\n      - api: lstat\r\n      - api: fstatat\r\n","matches":[[{"type":"absolute","value":5368997776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368997936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997997}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for trap flag exception":{"meta":{"name":"check for trap flag exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp"],"examples":["al-khaser_x86.exe_:0x431680","al-khaser_x64.exe_:0x140030CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for trap flag exception\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x431680\r\n      - al-khaser_x64.exe_:0x140030CB0\r\n  features:\r\n    - and:\r\n      - or:\r\n        - description: read/write EFLAGS register\r\n        - and:\r\n          - mnemonic: pushf\r\n          - mnemonic: popf\r\n        - and:\r\n          - mnemonic: pushfd\r\n          - mnemonic: popfd\r\n        - and:\r\n          - mnemonic: pushfq\r\n          - mnemonic: popfq\r\n      - or:\r\n        - description: set trap flag\r\n        - instruction:\r\n          - mnemonic: or\r\n          - number: 0x100\r\n        - instruction:\r\n          - mnemonic: bts\r\n          - number: 0x8\r\n","matches":[[{"type":"absolute","value":5368908976},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"set trap flag"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for trap flag exception/9ab3bbf6e8a8413499c9b03fa20f8cac"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"bts"}},"children":[],"locations":[{"type":"absolute","value":5368909061}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8}},"children":[],"locations":[{"type":"absolute","value":5368909061}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368909061}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"read/write EFLAGS register"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushf"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popf"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfd"}},"children":[],"locations":[{"type":"absolute","value":5368909050}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfd"}},"children":[],"locations":[{"type":"absolute","value":5368909075}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfq"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfq"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"change memory protection":{"meta":{"name":"change memory protection","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Change Memory Protection"],"objective":"Memory","behavior":"Change Memory Protection","method":"","id":"C0008"}],"references":[],"examples":["Practical Malware Analysis Lab 11-02.dll_:0x10001203"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: change memory protection\r\n    authors:\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Change Memory Protection [C0008]\r\n    examples:\r\n      - Practical Malware Analysis Lab 11-02.dll_:0x10001203\r\n  features:\r\n    - or:\r\n      - api: kernel32.VirtualProtect\r\n      - api: kernel32.VirtualProtectEx\r\n      - api: NtProtectVirtualMemory\r\n      - api: ZwProtectVirtualMemory\r\n      - and:\r\n        - match: link function at runtime on Windows\r\n        - or:\r\n          - string: \"VirtualProtect\"\r\n          - string: \"VirtualProtectEx\"\r\n          - string: \"NtProtectVirtualMemory\"\r\n          - string: \"ZwProtectVirtualMemory\"\r\n","matches":[[{"type":"absolute","value":5368839341},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":5368839386}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368913856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":5368913965}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create thread\r\n    namespace: host-interaction/thread/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Create Thread [C0038]\r\n    examples:\r\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.CreateThread\r\n          - api: _beginthread\r\n          - api: _beginthreadex\r\n          - api: PsCreateSystemThread\r\n          - api: SHCreateThread\r\n          - api: SHCreateThreadWithHandle\r\n          - api: kernel32.CreateRemoteThread\r\n          - api: kernel32.CreateRemoteThreadEx\r\n          - api: RtlCreateUserThread\r\n          - api: ntdll.NtCreateThread\r\n          - api: ntdll.NtCreateThreadEx\r\n          - api: ntdll.ZwCreateThread\r\n          - api: ntdll.ZwCreateThreadEx\r\n      - and:\r\n        - os: linux\r\n        - api: pthread_create\r\n      - and:\r\n        - api: System.Threading.Thread::Start\r\n        - optional:\r\n          - api: System.Threading.Thread::ctor\r\n","matches":[[{"type":"absolute","value":5368951220},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":5368951265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368908512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[{"type":"absolute","value":5368908592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unexpected memory writes":{"meta":{"name":"check for unexpected memory writes","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Memory Write Watching"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Memory Write Watching","id":"B0001.010"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp"],"examples":["al-khaser_x86.exe_:0x431EBC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for unexpected memory writes\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x431EBC\r\n  features:\r\n    - and:\r\n      - api: kernel32.GetWriteWatch\r\n      - number: 0x0\r\n","matches":[[{"type":"absolute","value":5368910906},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":5368910974}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":5368910911}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910144},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":5368910180}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":5368910156}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912538},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":5368912608}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":5368912549}],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap force flags":{"meta":{"name":"get process heap force flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get process heap force flags\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14\r\n    examples:\r\n      - al-khaser_x86.exe_:0x425470\r\n  features:\r\n    - and:\r\n      - match: PEB access\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - number: 0x18 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x44 = ProcessHeap->ForceFlags >= Vista\r\n            - number: 0x10 = ProcessHeap->ForceFlags < Vista\r\n        - and:\r\n          - arch: amd64\r\n          - number: 0x30 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x74 = ProcessHeap->ForceFlags >= Vista\r\n            - number: 0x18 = ProcessHeap->ForceFlags < Vista\r\n","matches":[[{"type":"absolute","value":5368858838},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858862}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"access PEB ldr_data":{"meta":{"name":"access PEB ldr_data","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm","https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8"],"examples":["3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: access PEB ldr_data\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    references:\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm\r\n      - https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8\r\n    examples:\r\n      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7\r\n  features:\r\n    - or:\r\n      - and:\r\n        - arch: i386\r\n        - description: x32\r\n\r\n        - match: PEB access\r\n\r\n        # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0\r\n        # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives\r\n\r\n        - offset: 0x0C = PEB.LDR_DATA\r\n\r\n        - or:\r\n          - description: resolve a module list\r\n          - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList\r\n          - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList\r\n          - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList\r\n\r\n      - and:\r\n        - arch: amd64\r\n        - description: x64\r\n\r\n        - match: PEB access\r\n\r\n        - offset: 0x18 = PEB.LDR_DATA\r\n\r\n        - or:\r\n          - description: resolve a module list\r\n          - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList\r\n          - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList\r\n          - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList\r\n","matches":[[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368914151}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914090}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get kernel32 base address":{"meta":{"name":"get kernel32 base address","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm"],"examples":["67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x406936"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get kernel32 base address\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    references:\r\n      - https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm\r\n    examples:\r\n      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x406936\r\n  features:\r\n    - and:\r\n      # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink\r\n      - match: access PEB ldr_data\r\n      # -> current module -> ntdll\r\n      - count(offset(0)): 2\r\n      # -> kernel32 -> LDR_DATA_TABLE_ENTRY.DllBase\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - offset: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase\r\n        - and:\r\n          - arch: amd64\r\n          - offset: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase\r\n","matches":[[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":2,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":5368858872},{"type":"absolute","value":5368858893}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368914151}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914090}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":2,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":5368914241},{"type":"absolute","value":5368914122}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368914151}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via IOCTL":{"meta":{"name":"interact with driver via IOCTL","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x40108c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: interact with driver via IOCTL\r\n    namespace: host-interaction/driver\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    examples:\r\n      - Practical Malware Analysis Lab 10-03.exe_:0x40108c\r\n  features:\r\n    - or:\r\n      - api: DeviceIoControl\r\n","matches":[[{"type":"absolute","value":5368919737},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368919808}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368920014},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920064}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368920268},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920318}],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap flags":{"meta":{"name":"get process heap flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get process heap flags\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13\r\n    examples:\r\n      - al-khaser_x86.exe_:0x425470\r\n  features:\r\n    - and:\r\n      - match: PEB access\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - number: 0x18 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x40 = ProcessHeap->HeapFlags >= Vista\r\n            - number: 0xC = ProcessHeap->HeapFlags < Vista\r\n        - and:\r\n          - arch: amd64\r\n          - number: 0x30 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x70 = ProcessHeap->HeapFlags >= Vista\r\n            - number: 0x14 = ProcessHeap->HeapFlags < Vista\r\n","matches":[[{"type":"absolute","value":5368858534},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858558}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858592}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"acquire debug privileges":{"meta":{"name":"acquire debug privileges","namespace":"host-interaction/process/modify","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x401174"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: acquire debug privileges\r\n    namespace: host-interaction/process/modify\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    att&ck:\r\n      - Privilege Escalation::Access Token Manipulation [T1134]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x401174\r\n  features:\r\n    - and:\r\n      - string: \"SeDebugPrivilege\"\r\n      - optional:\r\n        - match: modify access privileges\r\n","matches":[[{"type":"absolute","value":5368985322},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"SeDebugPrivilege"}},"children":[],"locations":[{"type":"absolute","value":5368985363}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"modify access privileges"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB BeingDebugged flag":{"meta":{"name":"check for PEB BeingDebugged flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block BeingDebugged"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block BeingDebugged","id":"B0001.035"}],"references":["Practical Malware Analysis, Chapter 16, p. 353"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for PEB BeingDebugged flag\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035]\r\n    references:\r\n      - Practical Malware Analysis, Chapter 16, p. 353\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\r\n  features:\r\n    - and:\r\n      - match: PEB access\r\n      - offset: 2 = PEB.BeingDebugged\r\n","matches":[[{"type":"absolute","value":5368837568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368837568}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":2,"description":"PEB.BeingDebugged"}},"children":[],"locations":[{"type":"absolute","value":5368837627}],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain loop\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    examples:\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - characteristic: loop\r\n      - characteristic: tight loop\r\n      - characteristic: recursive call\r\n","matches":[[{"type":"absolute","value":5368811525},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811525}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811540},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":5369005249}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811565},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811565}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811670}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811675}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811695},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811695}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811765},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811770},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811805},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811805}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811810}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811875}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812020},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812100},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812100}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812140}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812285},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812285}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812340}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812395}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812670}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812845},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812845}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812875}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812935}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813155},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813155}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813175},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813195}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813200}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813235},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813235}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813275},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813275}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813285},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813285}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813335},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813335}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813395}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813420},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813420}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813445}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813465},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813465}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813600},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813665},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813665}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813670}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813700},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813700}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813705}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813710},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813710}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813770},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813895},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813895}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814135},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814135}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814180},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814180}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814240}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814300},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814455},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814455}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814735},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814735}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814820},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814820}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814865},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814865}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814895},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814895}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814935}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815040}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815090},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815090}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815170},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815170}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815190},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815190}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815210},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815210}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815340}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815350},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815350}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815435},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815435}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815440}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815655},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815655}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815675}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815690},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815690}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815715}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815890},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815890}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816010},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816010}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816060}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816100},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816100}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816105},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816105}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816165},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816165}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816215},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816215}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816445}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816500}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368882832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368882832}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368891376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368891376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368891792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368891792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368960864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368960864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368986896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368986896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368987312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368987312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: link function at runtime on Windows\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - api: kernel32.GetProcAddress\r\n        - api: ntdll.LdrGetProcedureAddress\r\n      - optional:\r\n        - characteristic: indirect call\r\n        - api: kernel32.LoadLibrary\r\n        - api: kernel32.GetModuleHandle\r\n        - api: kernel32.GetModuleHandleEx\r\n        - api: ntdll.LdrLoadDll\r\n","matches":[[{"type":"absolute","value":5368811525},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368840106}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811715},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368952128},{"type":"absolute","value":5368952218},{"type":"absolute","value":5368952092}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368952738},{"type":"absolute","value":5368952701}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368952036},{"type":"absolute","value":5368951990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812020},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5369019487}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368953850}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368953782}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813155},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368958816}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":5368958750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813180},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368949789}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368949745}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368950923}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368950861}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816245},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368955221},{"type":"absolute","value":5368955133},{"type":"absolute","value":5368955311}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368955723},{"type":"absolute","value":5368955686}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368955153},{"type":"absolute","value":5368955083}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368956489}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":5368956421}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unmoving mouse cursor":{"meta":{"name":"check for unmoving mouse cursor","namespace":"anti-analysis/anti-vm/vm-detection","authors":["BitsOfBinary"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","User Activity Based Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"User Activity Based Checks","id":"T1497.002"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection","Human User Check"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"Human User Check","id":"B0009.012"}],"references":["https://www.joesecurity.org/blog/5852460122427342172"],"examples":["d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for unmoving mouse cursor\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - BitsOfBinary\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check [B0009.012]\r\n    references:\r\n      - https://www.joesecurity.org/blog/5852460122427342172\r\n    examples:\r\n      - d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118\r\n  features:\r\n    - and:\r\n      - count(api(user32.GetCursorPos)): 2 or more\r\n","matches":[[{"type":"absolute","value":5368811655},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetCursorPos"}}},"children":[],"locations":[{"type":"absolute","value":5368924564},{"type":"absolute","value":5368924543}],"captures":{}}],"locations":[],"captures":{}}]]},"reference WMI statements":{"meta":{"name":"reference WMI statements","namespace":"collection/database/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Data from Information Repositories"],"tactic":"Collection","technique":"Data from Information Repositories","subtechnique":"","id":"T1213"}],"mbc":[],"references":[],"examples":["al-khaser_x86.exe_:0x433490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference WMI statements\r\n    namespace: collection/database/wmi\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Collection::Data from Information Repositories [T1213]\r\n    examples:\r\n      - al-khaser_x86.exe_:0x433490\r\n  features:\r\n    - or:\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+CIM_./\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_./\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./\r\n","matches":[[{"type":"absolute","value":5368811695},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368941125}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":5368941125}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811755},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915850}],"captures":{"SELECT * FROM CIM_Sensor":[{"type":"absolute","value":5368915850}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368939285}],"captures":{"SELECT * FROM Win32_NetworkAdapterConfiguration":[{"type":"absolute","value":5368939285}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368922549}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":5368922549}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812110},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368925402}],"captures":{"SELECT * FROM Win32_PerfFormattedData_Counters_ThermalZoneInformation":[{"type":"absolute","value":5368925402}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368936139}],"captures":{"SELECT * FROM Win32_NTEventlogFile":[{"type":"absolute","value":5368936139}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812330},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915738}],"captures":{"SELECT * FROM CIM_PhysicalConnector":[{"type":"absolute","value":5368915738}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812485},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368925626}],"captures":{"SELECT * FROM Win32_PortConnector":[{"type":"absolute","value":5368925626}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812615},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368928522}],"captures":{"SELECT * FROM Win32_SMBIOSMemory":[{"type":"absolute","value":5368928522}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368926085}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":5368926085}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915626}],"captures":{"SELECT * FROM CIM_NumericSensor":[{"type":"absolute","value":5368915626}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368914666}],"captures":{"SELECT * FROM Win32_CacheMemory":[{"type":"absolute","value":5368914666}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368940229}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":5368940229}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368941797}],"captures":{"SELECT * FROM Win32_PnPDevice":[{"type":"absolute","value":5368941797}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368923813}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":5368923813}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813505},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915514}],"captures":{"SELECT * FROM CIM_Memory":[{"type":"absolute","value":5368915514}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813695},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368923610}],"captures":{"SELECT * FROM Win32_MemoryDevice":[{"type":"absolute","value":5368923610}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368927061}],"captures":{"SELECT * FROM Win32_BIOS":[{"type":"absolute","value":5368927061}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813820},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368925514}],"captures":{"SELECT * FROM Win32_PhysicalMemory":[{"type":"absolute","value":5368925514}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368918694}],"captures":{"SELECT * FROM Win32_LogicalDisk":[{"type":"absolute","value":5368918694}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814435},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368923498}],"captures":{"SELECT * FROM Win32_MemoryArray":[{"type":"absolute","value":5368923498}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814455},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368916399}],"captures":{"SELECT * FROM Win32_Fan":[{"type":"absolute","value":5368916399}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915962}],"captures":{"SELECT * FROM CIM_Slot":[{"type":"absolute","value":5368915962}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815090},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368934293}],"captures":{"SELECT * FROM Win32_Bus":[{"type":"absolute","value":5368934293}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368924837}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":5368924837}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815870},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368916186}],"captures":{"SELECT * FROM CIM_VoltageSensor":[{"type":"absolute","value":5368916186}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816215},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368933334}],"captures":{"SELECT * FROM Win32_BaseBoard":[{"type":"absolute","value":5368933334}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816225},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368928810}],"captures":{"SELECT * FROM Win32_VoltageProbe":[{"type":"absolute","value":5368928810}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[{"type":"absolute","value":5368917781}],"captures":{"SELECT * FROM MSAcpi_ThermalZoneTemperature":[{"type":"absolute","value":5368917781}]}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816515},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368916074}],"captures":{"SELECT * FROM CIM_TemperatureSensor":[{"type":"absolute","value":5368916074}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write process memory":{"meta":{"name":"write process memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Process Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"","id":"T1055"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: write process memory\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Defense Evasion::Process Injection [T1055]\r\n    examples:\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\r\n  features:\r\n    - or:\r\n      - api: kernel32.WriteProcessMemory\r\n      - api: ntdll.NtWriteVirtualMemory\r\n      - api: ntdll.ZwWriteVirtualMemory\r\n      - api: NtWow64WriteVirtualMemory64\r\n","matches":[[{"type":"absolute","value":5368811715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368952486}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368954178}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368951194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816245},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368955579}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get common file path\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\r\n      - 972B219F18379907A045431303F4DA7D:0x404887\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetTempPath\r\n      - api: kernel32.GetTempFileName\r\n      - api: kernel32.GetSystemDirectory\r\n      - api: kernel32.GetWindowsDirectory\r\n      - api: kernel32.GetSystemWow64Directory\r\n      - api: GetAllUsersProfileDirectory\r\n      - api: GetAppContainerFolderPath\r\n      - api: GetCurrentDirectory\r\n      - api: GetDefaultUserProfileDirectory\r\n      - api: GetProfilesDirectory\r\n      - api: GetUserProfileDirectory\r\n      - api: SHGetFolderPathAndSubDir\r\n      - api: shell32.SHGetFolderPath\r\n      - api: shell32.SHGetFolderLocation\r\n      - api: shell32.SHGetKnownFolderPath\r\n      - api: shell32.SHGetSpecialFolderPath\r\n      - api: shell32.SHGetSpecialFolderLocation\r\n      - api: System.IO.Directory::GetCurrentDirectory\r\n      - api: System.Environment::GetFolderPath\r\n      - property/read: System.Environment::SystemDirectory\r\n      - property/read: System.Environment::CurrentDirectory\r\n","matches":[[{"type":"absolute","value":5368811740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368935788}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":5368937556}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[{"type":"absolute","value":5368881771}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":5368946447}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816310},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368945980}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query environment variable":{"meta":{"name":"query environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com","@_re_fox"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x401880","0761142efbda6c4b1e801223de723578:0x65483490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query environment variable\r\n    namespace: host-interaction/environment-variable\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    examples:\r\n      - Practical Malware Analysis Lab 14-02.exe_:0x401880\r\n      - 0761142efbda6c4b1e801223de723578:0x65483490\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetEnvironmentVariable\r\n      - api: kernel32.GetEnvironmentStrings\r\n      - api: kernel32.ExpandEnvironmentStrings\r\n      - api: msvcr90.getenv\r\n      - api: msvcrt.getenv\r\n      - api: System.Environment::GetEnvironmentVariable\r\n      - api: System.Environment::GetEnvironmentVariables\r\n      - api: System.Environment::ExpandEnvironmentVariables\r\n","matches":[[{"type":"absolute","value":5368811740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":5368935765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":5368909873}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":5368881871}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816310},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":5368945957}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get system information on Windows":{"meta":{"name":"get system information on Windows","namespace":"host-interaction/os/info","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get system information on Windows\r\n    namespace: host-interaction/os/info\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - joakim@intezer.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    examples:\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - api: kernel32.GetSystemInfo\r\n        - api: kernel32.GetNativeSystemInfo\r\n        - api: NtQuerySystemInformation\r\n        - api: NtQuerySystemInformationEx\r\n        - api: ntdll.RtlGetNativeSystemInformation\r\n        - api: ZwQuerySystemInformation\r\n        - api: ZwQuerySystemInformationEx\r\n","matches":[[{"type":"absolute","value":5368811805},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368851199}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812035},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368852431}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813635},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368839289}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816160},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368978878}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"print debug messages":{"meta":{"name":"print debug messages","namespace":"host-interaction/log/debug/write-event","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: print debug messages\r\n    namespace: host-interaction/log/debug/write-event\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x401000\r\n  features:\r\n    - or:\r\n      - api: DbgPrint\r\n      - api: kernel32.OutputDebugString\r\n","matches":[[{"type":"absolute","value":5368811805},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368851717},{"type":"absolute","value":5368851655},{"type":"absolute","value":5368851977},{"type":"absolute","value":5368851692},{"type":"absolute","value":5368851437},{"type":"absolute","value":5368851533},{"type":"absolute","value":5368852050},{"type":"absolute","value":5368851955},{"type":"absolute","value":5368851606},{"type":"absolute","value":5368851511},{"type":"absolute","value":5368851735},{"type":"absolute","value":5368851901}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812430},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368844884}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368908061}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368908349},{"type":"absolute","value":5368908277},{"type":"absolute","value":5368908316},{"type":"absolute","value":5368908301},{"type":"absolute","value":5368908364},{"type":"absolute","value":5368908221}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368908610},{"type":"absolute","value":5368908771},{"type":"absolute","value":5368908756},{"type":"absolute","value":5368908676},{"type":"absolute","value":5368908804},{"type":"absolute","value":5368908819},{"type":"absolute","value":5368908732}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368907858},{"type":"absolute","value":5368907903}],"captures":{}}],"locations":[],"captures":{}}]]},"parse PE header":{"meta":{"name":"parse PE header","namespace":"load-code/pe","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403DD0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: parse PE header\r\n    namespace: load-code/pe\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic, operand[1].offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - and:\r\n        - mnemonic: cmp\r\n        - or:\r\n          - number: 0x4550 = IMAGE_NT_SIGNATURE (PE)\r\n          - and:\r\n            - number: 0x50\r\n            - number: 0x45\r\n        - or:\r\n          - number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ)\r\n          - and:\r\n            - number: 0x4D\r\n            - number: 0x5A\r\n        - optional:\r\n          - and:\r\n            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n            - or:\r\n              - and:\r\n                - arch: i386\r\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\r\n                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n              - and:\r\n                - arch: amd64\r\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\r\n                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase\r\n          - basic block:\r\n            - and:\r\n              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n              - 3 or more:\r\n                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine\r\n                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\r\n                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\r\n                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics\r\n                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit\r\n                - or:\r\n                  - and:\r\n                    - arch: i386\r\n                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\r\n                  - and:\r\n                    - arch: amd64\r\n                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\r\n","matches":[[{"type":"absolute","value":5368812020},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5369019394},{"type":"absolute","value":5369019331},{"type":"absolute","value":5369019427},{"type":"absolute","value":5369019386},{"type":"absolute","value":5369019813},{"type":"absolute","value":5369019972},{"type":"absolute","value":5369019966},{"type":"absolute","value":5369019402},{"type":"absolute","value":5369019307},{"type":"absolute","value":5369019820},{"type":"absolute","value":5369019979},{"type":"absolute","value":5369019407},{"type":"absolute","value":5369019952},{"type":"absolute","value":5369019572},{"type":"absolute","value":5369019418},{"type":"absolute","value":5369019806}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":5369019331}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":5369019302}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":5369019316}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[{"type":"absolute","value":5369019254}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/b9b4ad7a16e14936bcf46acdb475b08d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815575},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5369016033},{"type":"absolute","value":5369016097},{"type":"absolute","value":5369016161},{"type":"absolute","value":5369016118},{"type":"absolute","value":5369016134},{"type":"absolute","value":5369016056}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":5369016097}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":5369016056}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":5369016072}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/b9b4ad7a16e14936bcf46acdb475b08d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for debugger via API":{"meta":{"name":"check for debugger via API","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","CheckRemoteDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"CheckRemoteDebuggerPresent","id":"B0001.002"},{"parts":["Anti-Behavioral Analysis","Debugger Detection","WudfIsAnyDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"WudfIsAnyDebuggerPresent","id":"B0001.031"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp"],"examples":["al-khaser_x86.exe_:0x420000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for debugger via API\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]\r\n      - Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x420000\r\n  features:\r\n    - or:\r\n      # We're not including kernel32.IsDebuggerPresent here because some exception handlers and other compiler-inserted\r\n      # code may add calls to it, especially in debug builds. So, likely even with pretty good library code detection\r\n      # this feature could result in many false positives.\r\n      - api: kernel32.CheckRemoteDebuggerPresent\r\n      - api: WUDFPlatform.WudfIsAnyDebuggerPresent\r\n      - api: WUDFPlatform.WudfIsKernelDebuggerPresent\r\n      - api: WUDFPlatform.WudfIsUserDebuggerPresent\r\n      - property/read: System.Diagnostics.Debugger::IsAttached\r\n      - api: System.Diagnostics.Debugger::IsLogging\r\n","matches":[[{"type":"absolute","value":5368812145},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CheckRemoteDebuggerPresent"}},"children":[],"locations":[{"type":"absolute","value":5368837791}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsAnyDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsKernelDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsUserDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Debugger::IsAttached"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Debugger::IsLogging"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check process job object":{"meta":{"name":"check process job object","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp"],"examples":["al-khaser_x86.exe_:0x426730"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check process job object\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x426730\r\n  features:\r\n    - or:\r\n      # static\r\n      - and:\r\n        - match: contain loop\r\n        - basic block:\r\n          - and:\r\n            - api: kernel32.QueryInformationJobObject\r\n            - number: 0x3 = JobObjectBasicProcessIdList\r\n        - basic block:\r\n          - and:\r\n            - api: kernel32.OpenProcess\r\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\r\n      # dynamic\r\n      - and:\r\n        - call:\r\n          - and:\r\n            - api: kernel32.QueryInformationJobObject\r\n            - number: 0x3 = JobObjectBasicProcessIdList\r\n        - call:\r\n          - and:\r\n            - api: kernel32.OpenProcess\r\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\r\n","matches":[[{"type":"absolute","value":5368812150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/32a83c80df664d7bae9319c33769c72d"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/2df68db0ccc148dbab4fe2eb86c952c5"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368812150}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryInformationJobObject"}},"children":[],"locations":[{"type":"absolute","value":5368863567}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"JobObjectBasicProcessIdList"}},"children":[],"locations":[{"type":"absolute","value":5368863560}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368863518}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368863698}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1024,"description":"PROCESS_QUERY_INFORMATION"}},"children":[],"locations":[{"type":"absolute","value":5368863693}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368863684}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute anti-debugging instructions":{"meta":{"name":"execute anti-debugging instructions","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Anti-debugging Instructions"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Anti-debugging Instructions","id":"B0001.034"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x401300"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: execute anti-debugging instructions\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-03.exe_:0x401300\r\n  features:\r\n    - or:\r\n      - count(mnemonic(rdtsc)): 2 or more\r\n      - mnemonic: icebp\r\n","matches":[[{"type":"absolute","value":5368812230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":5368999657},{"type":"absolute","value":5368999623}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815890},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":5368999336},{"type":"absolute","value":5368999355},{"type":"absolute","value":5368999376}],"captures":{}}],"locations":[],"captures":{}}]]},"terminate process":{"meta":{"name":"terminate process","namespace":"host-interaction/process/terminate","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Terminate Process"],"objective":"Process","behavior":"Terminate Process","method":"","id":"C0018"}],"references":[],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x401A77","9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: terminate process\r\n    namespace: host-interaction/process/terminate\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Terminate Process [C0018]\r\n    examples:\r\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\r\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\r\n  features:\r\n    - or:\r\n      - api: System.Diagnostics.Process::Kill\r\n      - api: System.Diagnostics.Process::WaitForExit\r\n      - api: System.Diagnostics.Process::WaitForExitAsync\r\n      - api: System.Environment::Exit\r\n      - api: System.Windows.Forms.Application::Exit\r\n      - api: exit\r\n      - api: Exit\r\n      - and:\r\n        - optional:\r\n          - match: open process\r\n        - or:\r\n          - api: kernel32.TerminateProcess\r\n          - api: ntdll.NtTerminateProcess\r\n          - api: kernel32.ExitProcess\r\n","matches":[[{"type":"absolute","value":5368812350},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[{"type":"absolute","value":5369007930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812690},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":5368812690},{"type":"absolute","value":5369020774}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":5368971169},{"type":"absolute","value":5368971223}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject APC":{"meta":{"name":"inject APC","namespace":"host-interaction/process/inject","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Asynchronous Procedure Call"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Asynchronous Procedure Call","id":"T1055.004"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x140019348"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: inject APC\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Asynchronous Procedure Call [T1055.004]\r\n    examples:\r\n      - al-khaser_x64.exe_:0x140019348\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: write process memory\r\n        - match: create or open section object\r\n        - api: kernel32.MapViewOfFile\r\n      - or:\r\n        - api: kernel32.QueueUserAPC\r\n        - api: ntdll.NtQueueApcThread\r\n      - optional:\r\n        - or:\r\n          - number: 0x1fffff = THREAD_ALL_ACCESS\r\n          - api: kernel32.CreateProcess\r\n          - api: kernel32.OpenProcess\r\n","matches":[[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueueUserAPC"}},"children":[],"locations":[{"type":"absolute","value":5368954348}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueueApcThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368954178}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368812360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open section object"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MapViewOfFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2097151,"description":"THREAD_ALL_ACCESS"}},"children":[],"locations":[{"type":"absolute","value":5368953938},{"type":"absolute","value":5368954299}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368953943}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate threads":{"meta":{"name":"enumerate threads","namespace":"host-interaction/thread/list","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[{"parts":["Process","Enumerate Threads"],"objective":"Process","behavior":"Enumerate Threads","method":"","id":"C0064"}],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x10006BD5"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate threads\r\n    namespace: host-interaction/thread/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    mbc:\r\n      - Process::Enumerate Threads [C0064]\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x10006BD5\r\n  features:\r\n    - and:\r\n      - api: kernel32.Thread32First\r\n      - api: kernel32.Thread32Next\r\n      - optional:\r\n        - basic block:\r\n          - and:\r\n            - or:\r\n              - number: 0x4 = TH32CS_SNAPTHREAD\r\n              # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot\r\n            - api: kernel32.CreateToolhelp32Snapshot\r\n        - call:\r\n          - and:\r\n            - or:\r\n              - number: 0x4 = TH32CS_SNAPTHREAD\r\n            - api: kernel32.CreateToolhelp32Snapshot\r\n","matches":[[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":5368954263}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":5368954437}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368954212}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":5368954207}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368954205}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/e918d7b548ab4219afd7b1e887aa7333"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813035},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":5368978399}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":5368978503}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368978364}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":5368978359}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368978288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/e918d7b548ab4219afd7b1e887aa7333"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute shellcode via indirect call":{"meta":{"name":"execute shellcode via indirect call","namespace":"load-code/shellcode","authors":["ronnie.salomonsen@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: execute shellcode via indirect call\r\n    namespace: load-code/shellcode\r\n    authors:\r\n      - ronnie.salomonsen@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n  features:\r\n    - and:\r\n      - match: allocate or change RWX memory\r\n      - or:\r\n        - characteristic: indirect call\r\n        - characteristic: cross section flow\r\n","matches":[[{"type":"absolute","value":5368812395},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911413}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368911866}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813635},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368839314}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368839184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368839298}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368839184}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368839400}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send ICMP echo request":{"meta":{"name":"send ICMP echo request","namespace":"communication/icmp","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","ICMP Communication","Echo Request"],"objective":"Communication","behavior":"ICMP Communication","method":"Echo Request","id":"C0014.002"}],"references":["https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/"],"examples":["al-khaser_x86.exe_:0x449510"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send ICMP echo request\r\n    namespace: communication/icmp\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::ICMP Communication::Echo Request [C0014.002]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449510\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: IcmpSendEcho\r\n        - api: IcmpSendEcho2\r\n        - api: IcmpSendEcho2Ex\r\n        - api: Icmp6SendEcho2\r\n      - optional:\r\n        - or:\r\n          - api: IcmpCreateFile\r\n          - api: Icmp6CreateFile\r\n        - api: IcmpCloseHandle\r\n","matches":[[{"type":"absolute","value":5368812530},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho"}},"children":[],"locations":[{"type":"absolute","value":5369001023}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2Ex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6SendEcho2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCreateFile"}},"children":[],"locations":[{"type":"absolute","value":5369000837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6CreateFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5369001033},{"type":"absolute","value":5369000941}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processors":{"meta":{"name":"get number of processors","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361"],"examples":["al-khaser_x86.exe_:0x432CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get number of processors\r\n    namespace: host-interaction/hardware/cpu\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires property features\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361\r\n    examples:\r\n      - al-khaser_x86.exe_:0x432CB0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - match: PEB access\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - number: 0x64 = PEB->NumberOfProcessors\r\n          - and:\r\n            - arch: amd64\r\n            - number: 0xB8 = PEB->NumberOfProcessors\r\n      - property/read: System.Environment::ProcessorCount\r\n","matches":[[{"type":"absolute","value":5368812675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::ProcessorCount"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914304}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":100,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":184,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[{"type":"absolute","value":5368914355}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if file exists":{"meta":{"name":"check if file exists","namespace":"host-interaction/file-system/exists","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["31600AD0D1A7EA615690DF111AE36C73:0x401284"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check if file exists\r\n    namespace: host-interaction/file-system/exists\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\r\n  features:\r\n    - or:\r\n      - basic block:\r\n        - and:\r\n          - api: kernel32.GetFileAttributes\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\r\n      - basic block:\r\n        - and:\r\n          - api: kernel32.GetLastError\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 2 = ERROR_FILE_NOT_FOUND\r\n      - api: shlwapi.PathFileExists\r\n      - api: System.IO.File::Exists\r\n      - property/read: System.IO.FileSystemInfo::Exists\r\n","matches":[[{"type":"absolute","value":5368812680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997837}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368997846}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":5368997846}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368997846}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368997776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/a039fdffa08040fabf99312614f547a5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816025},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997997}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368998006}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":5368998006}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368998006}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368997936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/a039fdffa08040fabf99312614f547a5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"connect to WMI namespace via WbemLocator":{"meta":{"name":"connect to WMI namespace via WbemLocator","namespace":"host-interaction/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Windows Management Instrumentation"],"tactic":"Execution","technique":"Windows Management Instrumentation","subtechnique":"","id":"T1047"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x14001956e","al-khaser_x86.exe_:0x00445270"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\r\nrule:\r\n  meta:\r\n    name: connect to WMI namespace via WbemLocator\r\n    namespace: host-interaction/wmi\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires offset, bytes features\r\n    att&ck:\r\n      - Execution::Windows Management Instrumentation [T1047]\r\n    examples:\r\n      - al-khaser_x64.exe_:0x14001956e\r\n      - al-khaser_x86.exe_:0x00445270\r\n  features:\r\n    - and:\r\n      - basic block:\r\n        - and:\r\n          - api: ole32.CoCreateInstance\r\n          - com/class: WbemLocator  # 11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24 = CLSID_WbemLocator\r\n          - com/interface: IWbemLocator  # 87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24 = IID_IWbemLocator\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - offset: 0xC = ppv->ConnectServer\r\n        - and:\r\n          - arch: amd64\r\n          - offset: 0x18 = ppv->ConnectServer\r\n      - optional:\r\n        - string: /ROOT\\\\CIMV2/i\r\n        - string: /ROOT\\\\DEFAULT/i\r\n","matches":[[{"type":"absolute","value":5368812910},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CoCreateInstance"}},"children":[],"locations":[{"type":"absolute","value":5368983484}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"4590f811-1d3a-11d0-891f-00aa004b2e24","description":"CLSID_WbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"11f890453a1dd011891f00aa004b2e24","description":"CLSID_WbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":5368983477}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"dc12a687-737f-11cf-884d-00aa004b2e24","description":"IID_IWbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"87a612dc7f73cf11884d00aa004b2e24","description":"IID_IWbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":5368983462}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368983445}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"ppv->ConnectServer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"ppv->ConnectServer"}},"children":[],"locations":[{"type":"absolute","value":5368983248},{"type":"absolute","value":5368983632}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\CIMV2/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\DEFAULT/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if process is running under wine":{"meta":{"name":"check if process is running under wine","namespace":"anti-analysis/anti-emulation/wine","authors":["@_re_fox"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Emulator Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Emulator Detection","method":"","id":"B0004"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp"],"examples":["ccbf7cba35bab56563c0fbe4237fdc41:0x40d750"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check if process is running under wine\r\n    namespace: anti-analysis/anti-emulation/wine\r\n    authors:\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Emulator Detection [B0004]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp\r\n    examples:\r\n      - ccbf7cba35bab56563c0fbe4237fdc41:0x40d750\r\n  features:\r\n    - or:\r\n      - string: /SOFTWARE\\\\Wine/i\r\n      - and:\r\n        - api: GetModuleHandle\r\n        - api: GetProcAddress\r\n        - string: \"wine_get_unix_file_name\"\r\n        - or:\r\n          - string: \"kernel32.dll\"\r\n          - string: \"ntdll.dll\"\r\n","matches":[[{"type":"absolute","value":5368813180},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368949745}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368949789}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[{"type":"absolute","value":5368949778}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[{"type":"absolute","value":5368949738}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[{"type":"absolute","value":5368949915}],"captures":{"SOFTWARE\\Wine":[{"type":"absolute","value":5368949915}]}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate processes":{"meta":{"name":"enumerate processes","namespace":"host-interaction/process/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"},{"parts":["Discovery","Software Discovery"],"tactic":"Discovery","technique":"Software Discovery","subtechnique":"","id":"T1518"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403DAB","35d04ecd797041eee796f4ddaa96cae8:0x10004F34"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate processes\r\n    namespace: host-interaction/process/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n      - Discovery::Software Discovery [T1518]\r\n    examples:\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403DAB\r\n      - 35d04ecd797041eee796f4ddaa96cae8:0x10004F34\r\n  features:\r\n    - or:\r\n      - api: System.Diagnostics.Process::GetProcesses\r\n      - and:\r\n        - api: kernel32.Process32First\r\n        - api: kernel32.Process32Next\r\n        - optional:\r\n          - basic block:\r\n            - and:\r\n              - or:\r\n                - number: 0xF = TH32CS_SNAPALL\r\n                - number: 0x2 = TH32CS_SNAPPROCESS\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n          - call:\r\n            - and:\r\n              - or:\r\n                - number: 0xF = TH32CS_SNAPALL\r\n                - number: 0x2 = TH32CS_SNAPPROCESS\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n","matches":[[{"type":"absolute","value":5368813355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetProcesses"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32First"}},"children":[],"locations":[{"type":"absolute","value":5368982946}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32Next"}},"children":[],"locations":[{"type":"absolute","value":5368983034}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368982887}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"TH32CS_SNAPALL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"TH32CS_SNAPPROCESS"}},"children":[],"locations":[{"type":"absolute","value":5368982882}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368982784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate processes/bc9a3c91e8f94c8ba66842d00377c5d0"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get OS version":{"meta":{"name":"get OS version","authors":["@mr-tz"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000","5f66b82558ca92e54e77f216ef4c066c:0x44580A"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get OS version\r\n    authors:\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x401000\r\n      - 5f66b82558ca92e54e77f216ef4c066c:0x44580A\r\n  features:\r\n    - or:\r\n      - api: RtlGetVersion\r\n      - api: ntoskrnl.PsGetVersion\r\n      - api: GetVersion\r\n      - api: GetVersionEx\r\n      - api: VerifyVersionInfo\r\n      - api: VerSetConditionMask\r\n      - api: RtlGetNtVersionNumbers\r\n      - api: GetProductInfo\r\n      - and:\r\n        - match: PEB access\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - or:\r\n              - offset: 0xA4 = PEB->OSMajorVersion\r\n              - offset: 0xA8 = PEB->OSMinorVersion\r\n              - offset: 0xAC = PEB->OSBuildNumber\r\n          - and:\r\n            - arch: amd64\r\n            - or:\r\n              - offset: 0x118 = PEB->OSMajorVersion\r\n              - offset: 0x11C = PEB->OSMinorVersion\r\n              - offset: 0x120 = PEB->OSBuildNumber\r\n","matches":[[{"type":"absolute","value":5368813515},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":5368844532}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":5368844452},{"type":"absolute","value":5368844469}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815925},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":5368843269}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":5368843172},{"type":"absolute","value":5368843189},{"type":"absolute","value":5368843206}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for time delay via GetTickCount":{"meta":{"name":"check for time delay via GetTickCount","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Timing/Delay Check GetTickCount"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Timing/Delay Check GetTickCount","id":"B0001.032"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x4013d0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for time delay via GetTickCount\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-03.exe_:0x4013d0\r\n  features:\r\n    - and:\r\n      - count(api(kernel32.GetTickCount)): 2 or more\r\n      - basic block:\r\n        - and:\r\n          - mnemonic: sub\r\n          - mnemonic: cmp\r\n","matches":[[{"type":"absolute","value":5368813565},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"sub"}},"children":[],"locations":[{"type":"absolute","value":5368914545},{"type":"absolute","value":5368914435},{"type":"absolute","value":5368914535}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368914550}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914432}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetTickCount"}}},"children":[],"locations":[{"type":"absolute","value":5368914520},{"type":"absolute","value":5368914502}],"captures":{}}],"locations":[],"captures":{}}]]},"inject dll":{"meta":{"name":"inject dll","namespace":"host-interaction/process/inject","authors":["0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Dynamic-link Library Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Dynamic-link Library Injection","id":"T1055.001"}],"mbc":[],"references":["Practical Malware Analysis, p. 676","https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis","https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf","https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf","https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/","https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf","https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: inject dll\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001]\r\n    references:\r\n      - Practical Malware Analysis, p. 676\r\n      - https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis\r\n      - https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf\r\n      - https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf\r\n      - https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/\r\n      - https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf\r\n      - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - or:\r\n          - match: open process\r\n          - match: host-interaction/process/create\r\n      - match: allocate or change RW memory\r\n      - match: write process memory\r\n      - and:\r\n        - or:\r\n          - api: kernel32.GetModuleHandle\r\n          - api: kernel32.GetModuleHandleEx\r\n        - string: \"/LoadLibrary[AW]/\"\r\n      - match: create thread\r\n","matches":[[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368951069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368951194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368813750}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":5368951265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368951220}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368950815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950804}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368950861}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LoadLibrary[AW]/"}},"children":[],"locations":[{"type":"absolute","value":5368950912}],"captures":{"LoadLibraryW":[{"type":"absolute","value":5368950912}]}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject thread":{"meta":{"name":"inject thread","namespace":"host-interaction/process/inject","authors":["anamaria.martinezgom@mandiant.com","0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Thread Execution Hijacking"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Thread Execution Hijacking","id":"T1055.003"},{"parts":["Defense Evasion","Reflective Code Loading"],"tactic":"Defense Evasion","technique":"Reflective Code Loading","subtechnique":"","id":"T1620"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-01.exe_:0x4010D0","2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: inject thread\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - anamaria.martinezgom@mandiant.com\r\n      - 0x534a@mailbox.org\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003]\r\n      - Defense Evasion::Reflective Code Loading [T1620]\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-01.exe_:0x4010D0\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate or change RWX memory\r\n        - match: allocate or change RW memory\r\n      - match: write process memory\r\n      - match: create thread\r\n      - optional:\r\n        - or:\r\n          - match: host-interaction/process/create\r\n          - match: open process\r\n          - number: 0x3000 = MEM_COMMIT or MEM_RESERVE\r\n","matches":[[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368951194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368813750}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":5368951265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368951220}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368951069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368950815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950804}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12288,"description":"MEM_COMMIT or MEM_RESERVE"}},"children":[],"locations":[{"type":"absolute","value":5368951077}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get memory capacity":{"meta":{"name":"get memory capacity","namespace":"host-interaction/hardware/memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get memory capacity\r\n    namespace: host-interaction/hardware/memory\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\r\n  features:\r\n    - or:\r\n      - api: kernel32.GlobalMemoryStatus\r\n      - api: kernel32.GlobalMemoryStatusEx\r\n        # TODO kernel32.GetSystemInfo with offset\r\n","matches":[[{"type":"absolute","value":5368813815},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatusEx"}},"children":[],"locations":[{"type":"absolute","value":5368923310}],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate process modules":{"meta":{"name":"enumerate process modules","namespace":"host-interaction/process/modules/list","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":[],"examples":["6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8","9B2FD471274C41626B75DDBB5C897877:0x100046B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate process modules\r\n    namespace: host-interaction/process/modules/list\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    examples:\r\n      - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8\r\n      - 9B2FD471274C41626B75DDBB5C897877:0x100046B0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - optional:\r\n          - or:\r\n            - api: kernel32.OpenProcess\r\n            - api: kernel32.CloseHandle\r\n        - or:\r\n          - api: kernel32.K32EnumProcessModules\r\n          - api: kernel32.K32EnumProcessModulesEx\r\n          - api: kernel32.K32EnumProcesses\r\n          # depending on OS version in kernel32 or psapi\r\n          - api: EnumProcessModules\r\n          - api: EnumProcessModulesEx\r\n          - api: EnumProcesses\r\n      - and:\r\n        - api: kernel32.Module32First\r\n        - api: kernel32.Module32Next\r\n        - optional:\r\n          - basic block:\r\n            - and:\r\n              - or:\r\n                - number: 0x8 = TH32CS_SNAPMODULE\r\n                - number: 0x10 = TH32CS_SNAPMODULE32\r\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n          - call:\r\n            - and:\r\n              - or:\r\n                - number: 0x8 = TH32CS_SNAPMODULE\r\n                - number: 0x10 = TH32CS_SNAPMODULE32\r\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n      - and:\r\n        - property/read: System.Diagnostics.Process::Modules\r\n        - property/read: System.Diagnostics.ProcessModuleCollection::Item\r\n","matches":[[{"type":"absolute","value":5368813990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":5368890180}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":5368890266}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368890108}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[{"type":"absolute","value":5368890103}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368890032}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5368890301}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":5368953371}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":5368953421}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368953340}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[{"type":"absolute","value":5368953335}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368953248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5368953434}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for software breakpoints":{"meta":{"name":"check for software breakpoints","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Software Breakpoints"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Software Breakpoints","id":"B0001.025"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp","https://anti-debug.checkpoint.com/techniques/assembly.html"],"examples":["al-khaser_x86.exe_:0x431020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for software breakpoints\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp\r\n      - https://anti-debug.checkpoint.com/techniques/assembly.html\r\n    examples:\r\n      - al-khaser_x86.exe_:0x431020\r\n  features:\r\n    - and:\r\n      - or:\r\n        - instruction:\r\n          - mnemonic: cmp\r\n          - number: 0xCC = INT3\r\n        - and:\r\n          - description: INT3 (long form)\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0xCD = INT3 (long form byte 1)\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0x03 = INT3 (long form byte 2)\r\n      - match: contain loop\r\n","matches":[[{"type":"absolute","value":5368814035},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368814035}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368907642}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":204,"description":"INT3"}},"children":[],"locations":[{"type":"absolute","value":5368907642}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368907642}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"INT3 (long form)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/6ad668bfa45a4a4cab8bb6ca25b4f893"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/2abefe1474b74891a1c248a9969463cb"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set console window title":{"meta":{"name":"set console window title","namespace":"host-interaction/gui/console","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Console"],"objective":"Operating System","behavior":"Console","method":"","id":"C0033"}],"references":[],"examples":["mimikatz.exe_:0x44570F"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set console window title\r\n    namespace: host-interaction/gui/console\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Console [C0033]\r\n    examples:\r\n      - mimikatz.exe_:0x44570F\r\n  features:\r\n    - or:\r\n      - api: kernel32.SetConsoleTitle\r\n","matches":[[{"type":"absolute","value":5368814050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetConsoleTitle"}},"children":[],"locations":[{"type":"absolute","value":5368969441}],"captures":{}}],"locations":[],"captures":{}}]]},"get disk size":{"meta":{"name":"get disk size","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347"],"examples":["al-khaser_x86.exe_:0x4343D0","al-khaser_x86.exe_:0x434010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get disk size\r\n    namespace: host-interaction/hardware/storage\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347\r\n    examples:\r\n      - al-khaser_x86.exe_:0x4343D0\r\n      - al-khaser_x86.exe_:0x434010\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetDiskFreeSpace\r\n      - api: kernel32.GetDiskFreeSpaceEx\r\n      - property/read: System.IO.DriveInfo::TotalSize\r\n      - property/read: System.IO.DriveInfo::TotalFreeSpace\r\n      - property/read: System.IO.DriveInfo::AvailableFreeSpace\r\n      - basic block:\r\n        - and:\r\n          - match: interact with driver via IOCTL\r\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\r\n      - call:\r\n        - and:\r\n          - match: interact with driver via IOCTL\r\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\r\n      - and:\r\n        - or:\r\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i\r\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i\r\n        - string: \"Size\"\r\n","matches":[[{"type":"absolute","value":5368814865},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920318}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368920268}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":5368920309}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920064}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368920014}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":5368920055}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368920268},{"type":"absolute","value":5368920014}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/caf381278ac947948b25a47c8c0e29a2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815525},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[{"type":"absolute","value":5368918405}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/382eca0b8cf844eaa82f18e35725ccad"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/caf381278ac947948b25a47c8c0e29a2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate services":{"meta":{"name":"enumerate services","namespace":"host-interaction/service/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Service Discovery"],"tactic":"Discovery","technique":"System Service Discovery","subtechnique":"","id":"T1007"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x1000B823"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate services\r\n    namespace: host-interaction/service/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Service Discovery [T1007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x1000B823\r\n  features:\r\n    - or:\r\n      - api: advapi32.EnumServicesStatus\r\n      - api: advapi32.EnumServicesStatusEx\r\n      - api: advapi32.EnumDependentServices\r\n","matches":[[{"type":"absolute","value":5368814905},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatusEx"}},"children":[],"locations":[{"type":"absolute","value":5368932939},{"type":"absolute","value":5368932726}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumDependentServices"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate disk properties":{"meta":{"name":"enumerate disk properties","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518"],"examples":["al-khaser_x86.exe_:0x4369B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate disk properties\r\n    namespace: host-interaction/hardware/storage\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires bytes features\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518\r\n    examples:\r\n      - al-khaser_x86.exe_:0x4369B0\r\n  features:\r\n    - and:\r\n      - basic block:\r\n        - and:\r\n          - api: setupapi.SetupDiGetClassDevs\r\n          - bytes: 67 E9 36 4D 25 E3 CE 11 BF C1 08 00 2B E1 03 18 = GUID_DEVCLASS_DISKDRIVE\r\n      - api: setupapi.SetupDiEnumDeviceInfo\r\n      - api: setupapi.SetupDiGetDeviceRegistryProperty\r\n      - optional:\r\n        - api: setupapi.SetupDiDestroyDeviceInfoList\r\n","matches":[[{"type":"absolute","value":5368815040},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetClassDevs"}},"children":[],"locations":[{"type":"absolute","value":5368927847}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e9364d25e3ce11bfc108002be10318","description":"GUID_DEVCLASS_DISKDRIVE"}},"children":[],"locations":[{"type":"absolute","value":5368927840}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368927760}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiEnumDeviceInfo"}},"children":[],"locations":[{"type":"absolute","value":5368927927}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetDeviceRegistryProperty"}},"children":[],"locations":[{"type":"absolute","value":5368927996}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiDestroyDeviceInfoList"}},"children":[],"locations":[{"type":"absolute","value":5368928245}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get disk information":{"meta":{"name":"get disk information","namespace":"host-interaction/hardware/storage","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0","972B219F18379907A045431303F4DA7D:0x41064E"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get disk information\r\n    namespace: host-interaction/hardware/storage\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\r\n      - 972B219F18379907A045431303F4DA7D:0x41064E\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetDriveType\r\n      - api: kernel32.GetLogicalDrives\r\n      - api: kernel32.GetVolumeInformation\r\n      - api: kernel32.GetVolumeNameForVolumeMountPoint\r\n      - api: kernel32.GetVolumePathNamesForVolumeName\r\n      - api: kernel32.GetLogicalDriveStrings\r\n      - api: kernel32.QueryDosDevice\r\n      - property/read: System.IO.DriveInfo::VolumeLabel\r\n      - property/read: System.IO.DriveInfo::DriveType\r\n      - property/read: System.IO.DriveInfo::DriveFormat\r\n      - property/read: System.IO.DriveInfo::Name\r\n","matches":[[{"type":"absolute","value":5368815050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":5368881902}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368882832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":5368883201}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB NtGlobalFlag flag":{"meta":{"name":"check for PEB NtGlobalFlag flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block NtGlobalFlag"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block NtGlobalFlag","id":"B0001.036"}],"references":["Practical Malware Analysis, Chapter 16, p. 355","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for PEB NtGlobalFlag flag\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires offset, mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]\r\n    references:\r\n      - Practical Malware Analysis, Chapter 16, p. 355\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\r\n  features:\r\n    - and:\r\n      - basic block:\r\n        - and:\r\n          - match: PEB access\r\n          - or:\r\n            - and:\r\n              - arch: i386\r\n              - offset: 0x68 = PEB.NtGlobalFlag\r\n            - and:\r\n              - arch: amd64\r\n              - offset: 0xBC = PEB.NtGlobalFlag\r\n            - instruction:\r\n              - arch: i386\r\n              - mnemonic: add\r\n              - offset: 0x68 = PEB.NtGlobalFlag\r\n            - instruction:\r\n              - arch: amd64\r\n              - mnemonic: add\r\n              - offset: 0xBC = PEB.NtGlobalFlag\r\n      - number: 0x70 = (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)\r\n","matches":[[{"type":"absolute","value":5368815115},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368840336}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":104,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":188,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":5368840403}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for PEB NtGlobalFlag flag/b837da6a639b481c9721ac21a5fe6ba1/5a15099436914caa93ca620b517a4f61"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368840403}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":188,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":5368840403}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368840403}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368840336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"(FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)"}},"children":[],"locations":[{"type":"absolute","value":5368840426},{"type":"absolute","value":5368840477}],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query or enumerate registry value\r\n    namespace: host-interaction/registry\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Query Registry [T1012]\r\n    mbc:\r\n      - Operating System::Registry::Query Registry Value [C0036.006]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - match: create or open registry key\r\n      - or:\r\n        - api: advapi32.RegGetValue\r\n        - api: advapi32.RegEnumValue\r\n        - api: advapi32.RegQueryValue\r\n        - api: advapi32.RegQueryValueEx\r\n        - api: advapi32.RegQueryMultipleValues\r\n        - api: ZwQueryValueKey\r\n        - api: ZwEnumerateValueKey\r\n        - api: NtQueryValueKey\r\n        - api: NtEnumerateValueKey\r\n        - api: RtlQueryRegistryValues\r\n        - api: SHGetValue\r\n        - api: SHEnumValue\r\n        - api: SHRegGetInt\r\n        - api: SHRegGetPath\r\n        - api: SHRegGetValue\r\n        - api: SHQueryValueEx\r\n        - api: SHRegGetUSValue\r\n        - api: SHOpenRegStream\r\n        - api: SHRegEnumUSValue\r\n        - api: SHOpenRegStream2\r\n        - api: SHRegQueryUSValue\r\n        - api: SHRegGetBoolUSValue\r\n        - api: SHRegGetValueFromHKCUHKLM\r\n        - api: SHRegGetBoolValueFromHKCUHKLM\r\n        - api: Microsoft.Win32.RegistryKey::GetValue\r\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\r\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\r\n        - api: Microsoft.Win32.Registry::GetValue\r\n","matches":[[{"type":"absolute","value":5368815165},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":5368984936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368984784}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":5368984984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"modify access privileges":{"meta":{"name":"modify access privileges","namespace":"host-interaction/process/modify","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403BE0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: modify access privileges\r\n    namespace: host-interaction/process/modify\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Privilege Escalation::Access Token Manipulation [T1134]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403BE0\r\n  features:\r\n    - and:\r\n      - api: advapi32.AdjustTokenPrivileges\r\n      - optional:\r\n        - or:\r\n          - api: advapi32.LookupPrivilegeValue\r\n","matches":[[{"type":"absolute","value":5368815200},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"AdjustTokenPrivileges"}},"children":[],"locations":[{"type":"absolute","value":5368985413}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LookupPrivilegeValue"}},"children":[],"locations":[{"type":"absolute","value":5368985372}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"find graphical window":{"meta":{"name":"find graphical window","namespace":"host-interaction/gui/window/find","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","Application Window Discovery"],"tactic":"Discovery","technique":"Application Window Discovery","subtechnique":"","id":"T1010"}],"mbc":[],"references":[],"examples":["7C843E75D4F02087B932FE280DF9C90C:0x41B180"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: find graphical window\r\n    namespace: host-interaction/gui/window/find\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::Application Window Discovery [T1010]\r\n    examples:\r\n      - 7C843E75D4F02087B932FE280DF9C90C:0x41B180\r\n  features:\r\n    - or:\r\n      - api: user32.FindWindow\r\n      - api: user32.FindWindowEx\r\n","matches":[[{"type":"absolute","value":5368815245},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"FindWindow"}},"children":[],"locations":[{"type":"absolute","value":5368944355},{"type":"absolute","value":5368944374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"FindWindowEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processor cores":{"meta":{"name":"get number of processor cores","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207"],"examples":["al-khaser_x86.exe_:0x435BA0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get number of processor cores\r\n    namespace: host-interaction/hardware/cpu\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207\r\n    examples:\r\n      - al-khaser_x86.exe_:0x435BA0\r\n  features:\r\n    - and:\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/\r\n      - string: \"NumberOfCores\"\r\n","matches":[[{"type":"absolute","value":5368815340},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"NumberOfCores"}},"children":[],"locations":[{"type":"absolute","value":5368925008}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/"}},"children":[],"locations":[{"type":"absolute","value":5368924837}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":5368924837}]}}],"locations":[],"captures":{}}]]},"create mutex":{"meta":{"name":"create mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Mutex"],"objective":"Process","behavior":"Create Mutex","method":"","id":"C0042"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create mutex\r\n    namespace: host-interaction/mutex\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Mutex [C0042]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - api: kernel32.CreateMutex\r\n      - api: kernel32.CreateMutexEx\r\n      - api: System.Threading.Mutex::ctor\r\n","matches":[[{"type":"absolute","value":5368815500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutex"}},"children":[],"locations":[{"type":"absolute","value":5368906981}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutexEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for protected handle exception":{"meta":{"name":"check for protected handle exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","SetHandleInformation"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"SetHandleInformation","id":"B0001.024"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp"],"examples":["al-khaser_x86.exe_:0x430D20"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for protected handle exception\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x430D20\r\n  features:\r\n    - and:\r\n      - or:\r\n        - description: SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);\r\n        - basic block:\r\n          - and:\r\n            - count(number(2)): 2 or more\r\n            - api: SetHandleInformation\r\n        - call:\r\n          - and:\r\n            - count(number(2)): 2 or more\r\n            - api: SetHandleInformation\r\n      - api: CloseHandle\r\n","matches":[[{"type":"absolute","value":5368815500},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5368907024}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetHandleInformation"}},"children":[],"locations":[{"type":"absolute","value":5368907013}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"number","number":2}}},"children":[],"locations":[{"type":"absolute","value":5368907004},{"type":"absolute","value":5368906998}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368906998}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for protected handle exception/14e241b95d104a0fbfa0db5d508b8e69"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get MAC address on Windows":{"meta":{"name":"get MAC address on Windows","namespace":"collection/network","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","echernofsky@google.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128","https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific"],"examples":["al-khaser_x64.exe_:0x14001A1BC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get MAC address on Windows\r\n    namespace: collection/network\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - echernofsky@google.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128\r\n      - https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific\r\n    examples:\r\n      - al-khaser_x64.exe_:0x14001A1BC\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - and:\r\n          - api: iphlpapi.GetAdaptersInfo\r\n          - or:\r\n            - offset: 0x194 = IP_ADAPTER_INFO.Address\r\n            - offset: 0x195 = IP_ADAPTER_INFO.Address+1\r\n            - offset: 0x196 = IP_ADAPTER_INFO.Address+2\r\n            - offset: 0x197 = IP_ADAPTER_INFO.Address+3\r\n            - offset: 0x198 = IP_ADAPTER_INFO.Address+4\r\n            - offset: 0x199 = IP_ADAPTER_INFO.Address+5\r\n          - optional:\r\n            - string: \"%02X-%02X-%02X-%02X-%02X-%02X\"\r\n        - and:\r\n          - api: iphlpapi.GetAdaptersAddresses\r\n          - offset: 0x2C = PhysicalAddress\r\n","matches":[[{"type":"absolute","value":5368816060},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersInfo"}},"children":[],"locations":[{"type":"absolute","value":5368994669},{"type":"absolute","value":5368994549}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":404,"description":"IP_ADAPTER_INFO.Address"}},"children":[],"locations":[{"type":"absolute","value":5368994782}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":405,"description":"IP_ADAPTER_INFO.Address+1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":406,"description":"IP_ADAPTER_INFO.Address+2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":407,"description":"IP_ADAPTER_INFO.Address+3"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":408,"description":"IP_ADAPTER_INFO.Address+4"}},"children":[],"locations":[{"type":"absolute","value":5368994795}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":409,"description":"IP_ADAPTER_INFO.Address+5"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"%02X-%02X-%02X-%02X-%02X-%02X"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersAddresses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":44,"description":"PhysicalAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set application hook":{"meta":{"name":"set application hook","namespace":"host-interaction/gui","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set application hook\r\n    namespace: host-interaction/gui\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: user32.SetWindowsHookEx\r\n        - api: user32.UnhookWindowsHookEx\r\n","matches":[[{"type":"absolute","value":5368816460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":5368956573}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"log keystrokes via application hook":{"meta":{"name":"log keystrokes via application hook","namespace":"collection/keylog","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Collection","Input Capture","Keylogging"],"tactic":"Collection","technique":"Input Capture","subtechnique":"Keylogging","id":"T1056.001"}],"mbc":[{"parts":["Collection","Keylogging","Application Hook"],"objective":"Collection","behavior":"Keylogging","method":"Application Hook","id":"F0002.001"}],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: log keystrokes via application hook\r\n    namespace: collection/keylog\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Collection::Input Capture::Keylogging [T1056.001]\r\n    mbc:\r\n      - Collection::Keylogging::Application Hook [F0002.001]\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\r\n  features:\r\n    - and:\r\n      - match: set application hook\r\n      - or:\r\n        - number: 13 = WH_KEYBOARD_LL\r\n        - number: 2  = WH_KEYBOARD\r\n","matches":[[{"type":"absolute","value":5368816460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"set application hook"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":5368956573}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368816460}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"WH_KEYBOARD_LL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"WH_KEYBOARD"}},"children":[],"locations":[{"type":"absolute","value":5368956568}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain a thread local storage (.tls) section":{"meta":{"name":"contain a thread local storage (.tls) section","namespace":"executable/pe/section/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain a thread local storage (.tls) section\r\n    namespace: executable/pe/section/tls\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-02.exe_\r\n  features:\r\n    - section: .tls\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"section","section":".tls"}},"children":[],"locations":[{"type":"absolute","value":5369344000}],"captures":{}}]]},"read raw disk data":{"meta":{"name":"read raw disk data","namespace":"host-interaction/file-system","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read raw disk data\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n  features:\r\n    - or:\r\n      - string: \"\\\\\\\\.\\\\PhysicalDrive0\"\r\n      - string: \"\\\\\\\\.\\\\C:\"\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\PhysicalDrive0"}},"children":[],"locations":[{"type":"file","value":281800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\C:"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference analysis tools strings\r\n    namespace: anti-analysis\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    mbc:\r\n      - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /ollydbg(\\.exe)?/i\r\n      - string: /ProcessHacker(\\.exe)?/i\r\n      - string: /tcpview(\\.exe)?/i\r\n      - string: /autoruns(\\.exe)?/i\r\n      - string: /autorunsc(\\.exe)?/i\r\n      - string: /filemon(\\.exe)?/i\r\n      - string: /procmon(\\.exe)?/i\r\n      - string: /regmon(\\.exe)?/i\r\n      - string: /procexp(\\.exe)?/i\r\n      - string: /(?<!\\w)ida[gqtuw]?(\\.exe)?$/i\r\n      - string: /ida[gqtuw]?64(\\.exe)?$/i\r\n      - string: /ImmunityDebugger(\\.exe)?/i\r\n      - string: /Wireshark(\\.exe)?/i\r\n      - string: /dumpcap(\\.exe)?/i\r\n      - string: /HookExplorer(\\.exe)?/i\r\n      - string: /ImportREC(\\.exe)?/i\r\n      - string: /PETools(\\.exe)?/i\r\n      - string: /LordPE(\\.exe)?/i\r\n      - string: /SysInspector(\\.exe)?/i\r\n      - string: /proc_analyzer(\\.exe)?/i\r\n      - string: /sysAnalyzer(\\.exe)?/i\r\n      - string: /sniff_hit(\\.exe)?/i\r\n      - string: /windbg(\\.exe)?/i\r\n      - string: /joeboxcontrol(\\.exe)?/i\r\n      - string: /joeboxserver(\\.exe)?/i\r\n      - string: /ResourceHacker(\\.exe)?/i\r\n      - string: /x32dbg(\\.exe)?/i\r\n      - string: /x64dbg(\\.exe)?/i\r\n      - string: /Fiddler(\\.exe)?/i\r\n      - string: /httpdebugger(\\.exe)?/i\r\n      - string: /fakenet(\\.exe)?/i\r\n      - string: /netmon(\\.exe)?/i\r\n      - string: /WPE PRO(\\.exe)?/i\r\n      - string: /decompile(\\.exe)?/i\r\n      - string: /scylla/i\r\n      - string: /megadumper/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248760}],"captures":{"ollydbg.exe":[{"type":"file","value":248760}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248792}],"captures":{"ProcessHacker.exe":[{"type":"file","value":248792}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248840}],"captures":{"tcpview.exe":[{"type":"file","value":248840}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248872},{"type":"file","value":248904}],"captures":{"autoruns.exe":[{"type":"file","value":248872}],"autorunsc.exe":[{"type":"file","value":248904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248904}],"captures":{"autorunsc.exe":[{"type":"file","value":248904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248944}],"captures":{"filemon.exe":[{"type":"file","value":248944}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248976}],"captures":{"procmon.exe":[{"type":"file","value":248976}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249008}],"captures":{"regmon.exe":[{"type":"file","value":249008}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249040}],"captures":{"procexp.exe":[{"type":"file","value":249040}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/(?<!\\w)ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":249072}],"captures":{"idaq.exe":[{"type":"file","value":249072}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?64(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":249096}],"captures":{"idaq64.exe":[{"type":"file","value":249096}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249128}],"captures":{"ImmunityDebugger.exe":[{"type":"file","value":249128}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249184}],"captures":{"Wireshark.exe":[{"type":"file","value":249184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249224}],"captures":{"dumpcap.exe":[{"type":"file","value":249224}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249256}],"captures":{"HookExplorer.exe":[{"type":"file","value":249256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249296}],"captures":{"ImportREC.exe":[{"type":"file","value":249296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249336}],"captures":{"PETools.exe":[{"type":"file","value":249336}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249368}],"captures":{"LordPE.exe":[{"type":"file","value":249368}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249400}],"captures":{"SysInspector.exe":[{"type":"file","value":249400}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249440}],"captures":{"proc_analyzer.exe":[{"type":"file","value":249440}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249488}],"captures":{"sysAnalyzer.exe":[{"type":"file","value":249488}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249528}],"captures":{"sniff_hit.exe":[{"type":"file","value":249528}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249568}],"captures":{"windbg.exe":[{"type":"file","value":249568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249600}],"captures":{"joeboxcontrol.exe":[{"type":"file","value":249600}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249648}],"captures":{"joeboxserver.exe":[{"type":"file","value":249648}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249688}],"captures":{"ResourceHacker.exe":[{"type":"file","value":249688}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249736}],"captures":{"x32dbg.exe":[{"type":"file","value":249736}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249768}],"captures":{"x64dbg.exe":[{"type":"file","value":249768}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249800}],"captures":{"Fiddler.exe":[{"type":"file","value":249800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249832}],"captures":{"httpdebugger.exe":[{"type":"file","value":249832}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contains PDB path":{"meta":{"name":"contains PDB path","namespace":"executable/pe/pdb","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["464EF2CA59782CE697BC329713698CCC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contains PDB path\r\n    namespace: executable/pe/pdb\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    examples:\r\n      - 464EF2CA59782CE697BC329713698CCC  # level32.exe\r\n  features:\r\n    - string: /:\\\\.*\\.pdb/\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/:\\\\.*\\.pdb/"}},"children":[],"locations":[{"type":"file","value":335856}],"captures":{"C:\\Users\\spring\\Desktop\\al-khaser-master\\x64\\Debug\\al-khaser.pdb":[{"type":"file","value":335856}]}}]]},"reference anti-VM strings targeting Parallels":{"meta":{"name":"reference anti-VM strings targeting Parallels","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting Parallels\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /Parallels/i\r\n      - string: /prl_cc.exe/i\r\n      - string: /prl_tools.exe/i\r\n      - string: /prl hyperv/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Parallels/i"}},"children":[],"locations":[{"type":"file","value":284592}],"captures":{"Checking Parallels processes: %s":[{"type":"file","value":284592}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_cc.exe/i"}},"children":[],"locations":[{"type":"file","value":284512}],"captures":{"prl_cc.exe":[{"type":"file","value":284512}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_tools.exe/i"}},"children":[],"locations":[{"type":"file","value":284544}],"captures":{"prl_tools.exe":[{"type":"file","value":284544}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl hyperv/i"}},"children":[],"locations":[{"type":"file","value":282048}],"captures":{"prl hyperv  ":[{"type":"file","value":282048}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Qemu":{"meta":{"name":"reference anti-VM strings targeting Qemu","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting Qemu\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /Qemu/i\r\n      - string: /qemu-ga.exe/i\r\n      - string: /BOCHS/i\r\n      - string: /^BXPC/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Qemu/i"}},"children":[],"locations":[{"type":"file","value":282512},{"type":"file","value":246072},{"type":"file","value":285828},{"type":"file","value":281880},{"type":"file","value":285720},{"type":"file","value":285752},{"type":"file","value":285820}],"captures":{"qemu":[{"type":"file","value":281880},{"type":"file","value":285820}],"QEMU":[{"type":"file","value":282512},{"type":"file","value":285828}],"QEMU Detection":[{"type":"file","value":246072}],"qemu-ga.exe":[{"type":"file","value":285720}],"Checking qemu processes %s ":[{"type":"file","value":285752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/qemu-ga.exe/i"}},"children":[],"locations":[{"type":"file","value":285720}],"captures":{"qemu-ga.exe":[{"type":"file","value":285720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/BOCHS/i"}},"children":[],"locations":[{"type":"file","value":285836}],"captures":{"BOCHS":[{"type":"file","value":285836}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^BXPC/i"}},"children":[],"locations":[{"type":"file","value":285844}],"captures":{"BXPC":[{"type":"file","value":285844}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualBox":{"meta":{"name":"reference anti-VM strings targeting VirtualBox","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting VirtualBox\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /VBOX/i\r\n      - string: /VEN_VBOX/i\r\n      - string: /VirtualBox/i\r\n      - string: /06/23/99/i\r\n      - string: /HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i\r\n      - string: /HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i\r\n      - string: /HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i\r\n      - string: /SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i\r\n      - string: /VBoxMouse\\.sys/i\r\n      - string: /VBoxGuest\\.sys/i\r\n      - string: /VBoxSF\\.sys/i\r\n      - string: /VBoxVideo\\.sys/i\r\n      - string: /vboxdisp\\.dll/i\r\n      - string: /vboxhook\\.dll/i\r\n      - string: /vboxmrxnp\\.dll/i\r\n      - string: /vboxogl\\.dll/i\r\n      - string: /vboxoglarrayspu\\.dll/i\r\n      - string: /vboxoglcrutil\\.dll/i\r\n      - string: /vboxoglerrorspu\\.dll/i\r\n      - string: /vboxoglfeedbackspu\\.dll/i\r\n      - string: /vboxoglpackspu\\.dll/i\r\n      - string: /vboxoglpassthroughspu\\.dll/i\r\n      - string: /vboxservice\\.exe/i\r\n      - string: /vboxtray\\.exe/i\r\n      - string: /VBoxControl\\.exe/i\r\n      - string: /oracle\\\\virtualbox guest additions\\\\/i\r\n      - string: /\\\\\\\\.\\\\VBoxMiniRdrDN/i\r\n      - string: /\\\\\\\\.\\\\VBoxGuest/i\r\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i\r\n      - string: /\\\\\\\\.\\\\VBoxTrayIPC/i\r\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i\r\n      - string: /VBoxTrayToolWndClass/i\r\n      - string: /VBoxTrayToolWnd/i\r\n      - string: /vboxservice\\.exe/i\r\n      - string: /vboxtray.exe/i\r\n      - string: /vboxvideo/i\r\n      - string: /VBoxVideoW8/i\r\n      - string: /VBoxWddm/i\r\n      - string: /PCI\\\\VEN_80EE&DEV_CAFE/i\r\n      - string: /82801FB/i\r\n      - string: /82441FX/i\r\n      - string: /82371SB/i\r\n      - string: /OpenHCD/i\r\n      - string: /ACPIBus_BUS_0/i\r\n      - string: /PCI_BUS_0/i\r\n      - string: /PNP_BUS_0/i\r\n      - string: /Oracle Corporation/i\r\n      - string: /VBoxWdd/i\r\n      - string: /VBoxS/i\r\n        description: VirtualBox Shared Folders\r\n      - string: /VBoxMouse/i\r\n        description: VirtualBox Guest Mouse\r\n      - string: /VBoxGuest/i\r\n        description: VirtualBox Guest Driver\r\n      - string: /VBoxVBoxVBox/i\r\n      - string: /innotek GmbH/i\r\n      - string: /drivers\\\\vboxdrv/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBOX/i"}},"children":[],"locations":[{"type":"file","value":296832},{"type":"file","value":245248},{"type":"file","value":294912},{"type":"file","value":295040},{"type":"file","value":295552},{"type":"file","value":295808},{"type":"file","value":286472},{"type":"file","value":294664},{"type":"file","value":295432},{"type":"file","value":294032},{"type":"file","value":294800},{"type":"file","value":295184},{"type":"file","value":295952},{"type":"file","value":296824},{"type":"file","value":296592},{"type":"file","value":289184},{"type":"file","value":294432},{"type":"file","value":296096},{"type":"file","value":297504},{"type":"file","value":296616},{"type":"file","value":244656},{"type":"file","value":244912},{"type":"file","value":293624},{"type":"file","value":293936},{"type":"file","value":293752},{"type":"file","value":295344},{"type":"file","value":295856},{"type":"file","value":294968},{"type":"file","value":293688},{"type":"file","value":295992},{"type":"file","value":293312},{"type":"file","value":294336},{"type":"file","value":294592},{"type":"file","value":295104},{"type":"file","value":296256},{"type":"file","value":286408},{"type":"file","value":294856},{"type":"file","value":295496},{"type":"file","value":245072},{"type":"file","value":294744},{"type":"file","value":295896},{"type":"file","value":296152},{"type":"file","value":282080},{"type":"file","value":286432},{"type":"file","value":294240},{"type":"file","value":295264},{"type":"file","value":296296},{"type":"file","value":286448},{"type":"file","value":294128},{"type":"file","value":294512},{"type":"file","value":281848}],"captures":{"szVBoxSources":[{"type":"file","value":289184}],"vbox":[{"type":"file","value":296824},{"type":"file","value":281848}],"VBOX":[{"type":"file","value":296832},{"type":"file","value":293312}],"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":244656}],"Checking Win32_PnPDevice DeviceId from WMI for VBox PCI device ":[{"type":"file","value":244912}],"Checking Win32_PnPDevice Name from WMI for VBox controller hardware ":[{"type":"file","value":245072}],"Checking Win32_PnPDevice Name from WMI for VBOX names ":[{"type":"file","value":245248}],"VBoxVBoxVBox":[{"type":"file","value":282080}],"VBoxWddm":[{"type":"file","value":286408}],"VBoxSF":[{"type":"file","value":286432}],"VBoxMouse":[{"type":"file","value":286448}],"VBoxGuest":[{"type":"file","value":286472}],"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":293624}],"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":293688}],"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":293752}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":293936}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":294032}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":294128}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":294240}],"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":294336}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":294432}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":294512}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":294592}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":294664}],"System32\\vboxdisp.dll":[{"type":"file","value":294744}],"System32\\vboxhook.dll":[{"type":"file","value":294800}],"System32\\vboxmrxnp.dll":[{"type":"file","value":294856}],"System32\\vboxogl.dll":[{"type":"file","value":294912}],"System32\\vboxoglarrayspu.dll":[{"type":"file","value":294968}],"System32\\vboxoglcrutil.dll":[{"type":"file","value":295040}],"System32\\vboxoglerrorspu.dll":[{"type":"file","value":295104}],"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":295184}],"System32\\vboxoglpackspu.dll":[{"type":"file","value":295264}],"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":295344}],"System32\\vboxservice.exe":[{"type":"file","value":295432}],"System32\\vboxtray.exe":[{"type":"file","value":295496}],"System32\\VBoxControl.exe":[{"type":"file","value":295552}],"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":295808}],"\\\\.\\VBoxGuest":[{"type":"file","value":295856}],"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":295896}],"\\\\.\\VBoxTrayIPC":[{"type":"file","value":295952}],"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":295992}],"VBoxTrayToolWndClass":[{"type":"file","value":296096}],"VBoxTrayToolWnd":[{"type":"file","value":296152}],"vboxservice.exe":[{"type":"file","value":296256}],"vboxtray.exe":[{"type":"file","value":296296}],"vboxvideo":[{"type":"file","value":296592}],"VBoxVideoW8":[{"type":"file","value":296616}],"VEN_VBOX":[{"type":"file","value":297504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VEN_VBOX/i"}},"children":[],"locations":[{"type":"file","value":297504}],"captures":{"VEN_VBOX":[{"type":"file","value":297504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualBox/i"}},"children":[],"locations":[{"type":"file","value":293824},{"type":"file","value":296192},{"type":"file","value":293368},{"type":"file","value":296808},{"type":"file","value":244272},{"type":"file","value":244336},{"type":"file","value":244784},{"type":"file","value":295664},{"type":"file","value":296336},{"type":"file","value":282392}],"captures":{"VirtualBox":[{"type":"file","value":296808},{"type":"file","value":282392}],"VirtualBox Detection":[{"type":"file","value":244272}],"Checking VirtualBox Guest Additions directory ":[{"type":"file","value":244336}],"Checking VirtualBox Shared Folders network provider ":[{"type":"file","value":244784}],"VIRTUALBOX":[{"type":"file","value":293368}],"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":293824}],"oracle\\virtualbox guest additions\\":[{"type":"file","value":295664}],"VirtualBox Shared Folders":[{"type":"file","value":296192}],"Checking VirtualBox process %s ":[{"type":"file","value":296336}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/06/23/99/i"}},"children":[],"locations":[{"type":"file","value":293440}],"captures":{"06/23/99":[{"type":"file","value":293440}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":293624}],"captures":{"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":293624}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":293688}],"captures":{"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":293688}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":293752}],"captures":{"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":293752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i"}},"children":[],"locations":[{"type":"file","value":293824}],"captures":{"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":293824}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":293936}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":293936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i"}},"children":[],"locations":[{"type":"file","value":294032}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":294032}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i"}},"children":[],"locations":[{"type":"file","value":294128}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":294128}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i"}},"children":[],"locations":[{"type":"file","value":294240}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":294240}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i"}},"children":[],"locations":[{"type":"file","value":294336}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":294336}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294432}],"captures":{"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":294432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294512}],"captures":{"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":294512}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxSF\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294592}],"captures":{"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":294592}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideo\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294664}],"captures":{"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":294664}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxdisp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294744}],"captures":{"System32\\vboxdisp.dll":[{"type":"file","value":294744}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxhook\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294800}],"captures":{"System32\\vboxhook.dll":[{"type":"file","value":294800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxmrxnp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294856}],"captures":{"System32\\vboxmrxnp.dll":[{"type":"file","value":294856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxogl\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294912}],"captures":{"System32\\vboxogl.dll":[{"type":"file","value":294912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglarrayspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294968}],"captures":{"System32\\vboxoglarrayspu.dll":[{"type":"file","value":294968}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglcrutil\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295040}],"captures":{"System32\\vboxoglcrutil.dll":[{"type":"file","value":295040}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglerrorspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295104}],"captures":{"System32\\vboxoglerrorspu.dll":[{"type":"file","value":295104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglfeedbackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295184}],"captures":{"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":295184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295264}],"captures":{"System32\\vboxoglpackspu.dll":[{"type":"file","value":295264}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpassthroughspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295344}],"captures":{"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":295344}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295432},{"type":"file","value":296256}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":295432}],"vboxservice.exe":[{"type":"file","value":296256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295496},{"type":"file","value":296296}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":295496}],"vboxtray.exe":[{"type":"file","value":296296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxControl\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295552}],"captures":{"System32\\VBoxControl.exe":[{"type":"file","value":295552}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/oracle\\\\virtualbox guest additions\\\\/i"}},"children":[],"locations":[{"type":"file","value":295664}],"captures":{"oracle\\virtualbox guest additions\\":[{"type":"file","value":295664}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxMiniRdrDN/i"}},"children":[],"locations":[{"type":"file","value":295808}],"captures":{"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":295808}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":295856}],"captures":{"\\\\.\\VBoxGuest":[{"type":"file","value":295856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i"}},"children":[],"locations":[{"type":"file","value":295896}],"captures":{"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":295896}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":295952}],"captures":{"\\\\.\\VBoxTrayIPC":[{"type":"file","value":295952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":295992}],"captures":{"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":295992}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWndClass/i"}},"children":[],"locations":[{"type":"file","value":244656},{"type":"file","value":296096}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":244656}],"VBoxTrayToolWndClass":[{"type":"file","value":296096}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWnd/i"}},"children":[],"locations":[{"type":"file","value":244656},{"type":"file","value":296096},{"type":"file","value":296152}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":244656}],"VBoxTrayToolWndClass":[{"type":"file","value":296096}],"VBoxTrayToolWnd":[{"type":"file","value":296152}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295432},{"type":"file","value":296256}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":295432}],"vboxservice.exe":[{"type":"file","value":296256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray.exe/i"}},"children":[],"locations":[{"type":"file","value":295496},{"type":"file","value":296296}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":295496}],"vboxtray.exe":[{"type":"file","value":296296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxvideo/i"}},"children":[],"locations":[{"type":"file","value":294336},{"type":"file","value":294664},{"type":"file","value":296592},{"type":"file","value":296616}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":294336}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":294664}],"vboxvideo":[{"type":"file","value":296592}],"VBoxVideoW8":[{"type":"file","value":296616}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideoW8/i"}},"children":[],"locations":[{"type":"file","value":296616}],"captures":{"VBoxVideoW8":[{"type":"file","value":296616}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWddm/i"}},"children":[],"locations":[{"type":"file","value":286408}],"captures":{"VBoxWddm":[{"type":"file","value":286408}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI\\\\VEN_80EE&DEV_CAFE/i"}},"children":[],"locations":[{"type":"file","value":296936}],"captures":{"PCI\\VEN_80EE&DEV_CAFE":[{"type":"file","value":296936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82801FB/i"}},"children":[],"locations":[{"type":"file","value":297008}],"captures":{"82801FB":[{"type":"file","value":297008}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82441FX/i"}},"children":[],"locations":[{"type":"file","value":297032}],"captures":{"82441FX":[{"type":"file","value":297032}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82371SB/i"}},"children":[],"locations":[{"type":"file","value":297056}],"captures":{"82371SB":[{"type":"file","value":297056}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/OpenHCD/i"}},"children":[],"locations":[{"type":"file","value":297080}],"captures":{"OpenHCD":[{"type":"file","value":297080}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ACPIBus_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":297168}],"captures":{"ACPIBus_BUS_0":[{"type":"file","value":297168}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":297208}],"captures":{"PCI_BUS_0":[{"type":"file","value":297208}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PNP_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":297232}],"captures":{"PNP_BUS_0":[{"type":"file","value":297232}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Oracle Corporation/i"}},"children":[],"locations":[{"type":"file","value":297352}],"captures":{"Oracle Corporation":[{"type":"file","value":297352}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWdd/i"}},"children":[],"locations":[{"type":"file","value":286408}],"captures":{"VBoxWddm":[{"type":"file","value":286408}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxS/i","description":"VirtualBox Shared Folders"}},"children":[],"locations":[{"type":"file","value":289184},{"type":"file","value":286432},{"type":"file","value":294240},{"type":"file","value":294128},{"type":"file","value":294592},{"type":"file","value":296256},{"type":"file","value":295432}],"captures":{"szVBoxSources":[{"type":"file","value":289184}],"VBoxSF":[{"type":"file","value":286432}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":294128}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":294240}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":294592}],"System32\\vboxservice.exe":[{"type":"file","value":295432}],"vboxservice.exe":[{"type":"file","value":296256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse/i","description":"VirtualBox Guest Mouse"}},"children":[],"locations":[{"type":"file","value":286448},{"type":"file","value":294432},{"type":"file","value":294032}],"captures":{"VBoxMouse":[{"type":"file","value":286448}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":294032}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":294432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest/i","description":"VirtualBox Guest Driver"}},"children":[],"locations":[{"type":"file","value":286472},{"type":"file","value":293936},{"type":"file","value":294512},{"type":"file","value":295856}],"captures":{"VBoxGuest":[{"type":"file","value":286472}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":293936}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":294512}],"\\\\.\\VBoxGuest":[{"type":"file","value":295856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVBoxVBox/i"}},"children":[],"locations":[{"type":"file","value":282080}],"captures":{"VBoxVBoxVBox":[{"type":"file","value":282080}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/innotek GmbH/i"}},"children":[],"locations":[{"type":"file","value":282480}],"captures":{"innotek GmbH":[{"type":"file","value":282480}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/drivers\\\\vboxdrv/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Xen":{"meta":{"name":"reference anti-VM strings targeting Xen","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting Xen\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /^Xen/i\r\n      - string: /XenVMMXenVMM/i\r\n      - string: /xenservice.exe/i\r\n      - string: /XenVMMXenVMM/i\r\n      - string: /HVM domU/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^Xen/i"}},"children":[],"locations":[{"type":"file","value":246112},{"type":"file","value":302960},{"type":"file","value":282016}],"captures":{"Xen Detection":[{"type":"file","value":246112}],"XenVMMXenVMM":[{"type":"file","value":282016}],"xenservice.exe":[{"type":"file","value":302960}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":282016}],"captures":{"XenVMMXenVMM":[{"type":"file","value":282016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/xenservice.exe/i"}},"children":[],"locations":[{"type":"file","value":302960}],"captures":{"xenservice.exe":[{"type":"file","value":302960}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":282016}],"captures":{"XenVMMXenVMM":[{"type":"file","value":282016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HVM domU/i"}},"children":[],"locations":[{"type":"file","value":282424}],"captures":{"HVM domU":[{"type":"file","value":282424}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings":{"meta":{"name":"reference anti-VM strings","namespace":"anti-analysis/anti-vm/vm-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp"],"examples":["Practical Malware Analysis Lab 17-02.dll_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_\r\n  features:\r\n    - or:\r\n      - string: /HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i\r\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i\r\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i\r\n      - string: /HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i\r\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i\r\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i\r\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i\r\n      - string: /A M I/i\r\n      - string: /Hyper-V/i\r\n      - string: /Kernel-VMDetection-Private/i\r\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L699\r\n      - string: /KVMKVMKVM/i\r\n        description: KVM\r\n      - string: /Microsoft Hv/i\r\n        description: Microsoft Hyper-V or Windows Virtual PC\r\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L8\r\n      - string: /avghookx.dll/i\r\n        description: AVG\r\n      - string: /avghooka.dll/i\r\n        description: AVG\r\n      - string: /snxhk.dll/i\r\n        description: Avast\r\n      - string: /pstorec.dll/i\r\n        description: SunBelt Sandbox\r\n      - string: /vmcheck.dll/i\r\n        description: Virtual PC\r\n      - string: /wpespy.dll/i\r\n        description: WPE Pro\r\n      - string: /cmdvrt64.dll/i\r\n        description: Comodo Container\r\n      - string: /cmdvrt32.dll/i\r\n        description: Comodo Container\r\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L46\r\n      - string: /sample.exe/i\r\n      - string: /bot.exe/i\r\n      - string: /sandbox.exe/i\r\n      - string: /malware.exe/i\r\n      - string: /test.exe/i\r\n      - string: /klavme.exe/i\r\n      - string: /myapp.exe/i\r\n      - string: /testapp.exe/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i"}},"children":[],"locations":[{"type":"file","value":285328}],"captures":{"HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0":[{"type":"file","value":285328}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/A M I/i"}},"children":[],"locations":[{"type":"file","value":282272}],"captures":{"A M I":[{"type":"file","value":282272}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Hyper-V/i"}},"children":[],"locations":[{"type":"file","value":282928}],"captures":{"Hyper-V":[{"type":"file","value":282928}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Kernel-VMDetection-Private/i"}},"children":[],"locations":[{"type":"file","value":242672},{"type":"file","value":282952}],"captures":{"Checking NtQueryLicenseValue with Kernel-VMDetection-Private ":[{"type":"file","value":242672}],"Kernel-VMDetection-Private":[{"type":"file","value":282952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/KVMKVMKVM/i","description":"KVM"}},"children":[],"locations":[{"type":"file","value":281920}],"captures":{"KVMKVMKVM":[{"type":"file","value":281920}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Microsoft Hv/i","description":"Microsoft Hyper-V or Windows Virtual PC"}},"children":[],"locations":[{"type":"file","value":281952}],"captures":{"Microsoft Hv":[{"type":"file","value":281952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghookx.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":280496}],"captures":{"avghookx.dll":[{"type":"file","value":280496}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghooka.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":280528}],"captures":{"avghooka.dll":[{"type":"file","value":280528}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/snxhk.dll/i","description":"Avast"}},"children":[],"locations":[{"type":"file","value":280560}],"captures":{"snxhk.dll":[{"type":"file","value":280560}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/pstorec.dll/i","description":"SunBelt Sandbox"}},"children":[],"locations":[{"type":"file","value":280720}],"captures":{"pstorec.dll":[{"type":"file","value":280720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmcheck.dll/i","description":"Virtual PC"}},"children":[],"locations":[{"type":"file","value":280752}],"captures":{"vmcheck.dll":[{"type":"file","value":280752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/wpespy.dll/i","description":"WPE Pro"}},"children":[],"locations":[{"type":"file","value":280784}],"captures":{"wpespy.dll":[{"type":"file","value":280784}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt64.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":280816}],"captures":{"cmdvrt64.dll":[{"type":"file","value":280816}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt32.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":280848}],"captures":{"cmdvrt32.dll":[{"type":"file","value":280848}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sample.exe/i"}},"children":[],"locations":[{"type":"file","value":281000}],"captures":{"sample.exe":[{"type":"file","value":281000}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/bot.exe/i"}},"children":[],"locations":[{"type":"file","value":281032}],"captures":{"bot.exe":[{"type":"file","value":281032}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sandbox.exe/i"}},"children":[],"locations":[{"type":"file","value":281056}],"captures":{"sandbox.exe":[{"type":"file","value":281056}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/malware.exe/i"}},"children":[],"locations":[{"type":"file","value":281088}],"captures":{"malware.exe":[{"type":"file","value":281088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/test.exe/i"}},"children":[],"locations":[{"type":"file","value":281120}],"captures":{"test.exe":[{"type":"file","value":281120}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/klavme.exe/i"}},"children":[],"locations":[{"type":"file","value":281144}],"captures":{"klavme.exe":[{"type":"file","value":281144}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/myapp.exe/i"}},"children":[],"locations":[{"type":"file","value":281176}],"captures":{"myapp.exe":[{"type":"file","value":281176}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/testapp.exe/i"}},"children":[],"locations":[{"type":"file","value":281200}],"captures":{"testapp.exe":[{"type":"file","value":281200}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualPC":{"meta":{"name":"reference anti-VM strings targeting VirtualPC","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting VirtualPC\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /VirtualPC/i\r\n      - string: /VMSrvc.exe/i\r\n      - string: /VMUSrvc.exe/i\r\n      - string: /SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualPC/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":297920}],"captures":{"VMSrvc.exe":[{"type":"file","value":297920}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMUSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":297952}],"captures":{"VMUSrvc.exe":[{"type":"file","value":297952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i"}},"children":[],"locations":[{"type":"file","value":298080}],"captures":{"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters":[{"type":"file","value":298080}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VMWare":{"meta":{"name":"reference anti-VM strings targeting VMWare","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com","@johnk3r"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp"],"examples":["al-khaser_x86.exe_","b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting VMWare\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@johnk3r\"\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n      - b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80\r\n  features:\r\n    - or:\r\n      - string: /VMWare/i\r\n      - string: /VMTools/i\r\n      - string: /SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i\r\n      - string: /vmnet\\.sys/i\r\n      - string: /vmmouse\\.sys/i\r\n      - string: /vmusb\\.sys/i\r\n      - string: /vm3dmp\\.sys/i\r\n      - string: /vmci\\.sys/i\r\n      - string: /vmhgfs\\.sys/i\r\n      - string: /vmmemctl\\.sys/i\r\n      - string: /vmx86\\.sys/i\r\n      - string: /vmrawdsk\\.sys/i\r\n      - string: /vmusbmouse\\.sys/i\r\n      - string: /vmkdb\\.sys/i\r\n      - string: /vmnetuserif\\.sys/i\r\n      - string: /vmnetadapter\\.sys/i\r\n      - string: /\\\\\\\\.\\\\HGFS/i\r\n      - string: /\\\\\\\\.\\\\vmci/i\r\n      - string: /vmtoolsd\\.exe/i\r\n      - string: /vmwaretray\\.exe/i\r\n      - string: /vmwareuser\\.exe/i\r\n      - string: /VGAuthService\\.exe/i\r\n      - string: /vmacthlp\\.exe/i\r\n      - string: /vmci/i\r\n        description: VMWare VMCI Bus Driver\r\n      - string: /vmhgfs/i\r\n        description: VMWare Host Guest Control Redirector\r\n      - string: /vmmouse/i\r\n      - string: /vmmemctl/i\r\n        description: VMWare Guest Memory Controller Driver\r\n      - string: /vmusb/i\r\n      - string: /vmusbmouse/i\r\n      - string: /vmx_svga/i\r\n      - string: /vmxnet/i\r\n      - string: /vmx86/i\r\n      - string: /VMwareVMware/i\r\n      - string: /vmGuestLib\\.dll/i\r\n      - string: /vmGuestLib\\.dll/i\r\n      - string: /Applications\\\\VMwareHostOpen\\.exe/i\r\n      - string: /vm3dgl\\.dll/i\r\n      - string: /vmdum\\.dll/i\r\n      - string: /vm3dver\\.dll/i\r\n      - string: /vmtray\\.dll/i\r\n      - string: /VMToolsHook\\.dll/i\r\n      - string: /vmmousever\\.dll/i\r\n      - string: /VmGuestLibJava\\.dll/i\r\n      - string: /vmscsi\\.sys/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMWare/i"}},"children":[],"locations":[{"type":"file","value":245856},{"type":"file","value":245952},{"type":"file","value":281984},{"type":"file","value":282208},{"type":"file","value":300864},{"type":"file","value":281864},{"type":"file","value":300200},{"type":"file","value":302216},{"type":"file","value":302444},{"type":"file","value":302256},{"type":"file","value":301880},{"type":"file","value":302452},{"type":"file","value":245816}],"captures":{"VMware":[{"type":"file","value":302444}],"VMWARE":[{"type":"file","value":300200},{"type":"file","value":302452}],"VMWare Detection":[{"type":"file","value":245816}],"Checking VMWare network adapter name ":[{"type":"file","value":245856}],"Checking VMWare directory ":[{"type":"file","value":245952}],"vmware":[{"type":"file","value":281864}],"VMwareVMware":[{"type":"file","value":281984}],"VMWare":[{"type":"file","value":282208}],"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":300864}],"VMWare\\":[{"type":"file","value":301880}],"vmwaretray.exe":[{"type":"file","value":302216}],"vmwareuser.exe":[{"type":"file","value":302256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMTools/i"}},"children":[],"locations":[{"type":"file","value":302184}],"captures":{"vmtoolsd.exe":[{"type":"file","value":302184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i"}},"children":[],"locations":[{"type":"file","value":300864}],"captures":{"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":300864}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnet\\.sys/i"}},"children":[],"locations":[{"type":"file","value":300952}],"captures":{"System32\\drivers\\vmnet.sys":[{"type":"file","value":300952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301016}],"captures":{"System32\\drivers\\vmmouse.sys":[{"type":"file","value":301016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301088}],"captures":{"System32\\drivers\\vmusb.sys":[{"type":"file","value":301088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dmp\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301152}],"captures":{"System32\\drivers\\vm3dmp.sys":[{"type":"file","value":301152}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301224}],"captures":{"System32\\drivers\\vmci.sys":[{"type":"file","value":301224}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301288}],"captures":{"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":301288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301360}],"captures":{"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":301360}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301432}],"captures":{"System32\\drivers\\vmx86.sys":[{"type":"file","value":301432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmrawdsk\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301496}],"captures":{"System32\\drivers\\vmrawdsk.sys":[{"type":"file","value":301496}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301568}],"captures":{"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":301568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmkdb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301648}],"captures":{"System32\\drivers\\vmkdb.sys":[{"type":"file","value":301648}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetuserif\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301712}],"captures":{"System32\\drivers\\vmnetuserif.sys":[{"type":"file","value":301712}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetadapter\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301792}],"captures":{"System32\\drivers\\vmnetadapter.sys":[{"type":"file","value":301792}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\HGFS/i"}},"children":[],"locations":[{"type":"file","value":302136}],"captures":{"\\\\.\\HGFS":[{"type":"file","value":302136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\vmci/i"}},"children":[],"locations":[{"type":"file","value":302160}],"captures":{"\\\\.\\vmci":[{"type":"file","value":302160}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtoolsd\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302184}],"captures":{"vmtoolsd.exe":[{"type":"file","value":302184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwaretray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302216}],"captures":{"vmwaretray.exe":[{"type":"file","value":302216}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwareuser\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302256}],"captures":{"vmwareuser.exe":[{"type":"file","value":302256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VGAuthService\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302296}],"captures":{"VGAuthService.exe":[{"type":"file","value":302296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmacthlp\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302344}],"captures":{"vmacthlp.exe":[{"type":"file","value":302344}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci/i","description":"VMWare VMCI Bus Driver"}},"children":[],"locations":[{"type":"file","value":286496},{"type":"file","value":302160},{"type":"file","value":301224}],"captures":{"vmci":[{"type":"file","value":286496}],"System32\\drivers\\vmci.sys":[{"type":"file","value":301224}],"\\\\.\\vmci":[{"type":"file","value":302160}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs/i","description":"VMWare Host Guest Control Redirector"}},"children":[],"locations":[{"type":"file","value":286512},{"type":"file","value":301288}],"captures":{"vmhgfs":[{"type":"file","value":286512}],"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":301288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse/i"}},"children":[],"locations":[{"type":"file","value":286528},{"type":"file","value":301016}],"captures":{"vmmouse":[{"type":"file","value":286528}],"System32\\drivers\\vmmouse.sys":[{"type":"file","value":301016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl/i","description":"VMWare Guest Memory Controller Driver"}},"children":[],"locations":[{"type":"file","value":286552},{"type":"file","value":301360}],"captures":{"vmmemctl":[{"type":"file","value":286552}],"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":301360}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb/i"}},"children":[],"locations":[{"type":"file","value":286576},{"type":"file","value":301568},{"type":"file","value":301088},{"type":"file","value":286592}],"captures":{"vmusb":[{"type":"file","value":286576}],"vmusbmouse":[{"type":"file","value":286592}],"System32\\drivers\\vmusb.sys":[{"type":"file","value":301088}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":301568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse/i"}},"children":[],"locations":[{"type":"file","value":286592},{"type":"file","value":301568}],"captures":{"vmusbmouse":[{"type":"file","value":286592}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":301568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx_svga/i"}},"children":[],"locations":[{"type":"file","value":286624}],"captures":{"vmx_svga":[{"type":"file","value":286624}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmxnet/i"}},"children":[],"locations":[{"type":"file","value":286648}],"captures":{"vmxnet":[{"type":"file","value":286648}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86/i"}},"children":[],"locations":[{"type":"file","value":286664},{"type":"file","value":301432}],"captures":{"vmx86":[{"type":"file","value":286664}],"System32\\drivers\\vmx86.sys":[{"type":"file","value":301432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMwareVMware/i"}},"children":[],"locations":[{"type":"file","value":281984}],"captures":{"VMwareVMware":[{"type":"file","value":281984}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Applications\\\\VMwareHostOpen\\.exe/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dgl\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmdum\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dver\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtray\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMToolsHook\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmousever\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VmGuestLibJava\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmscsi\\.sys/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
+{"meta":{"timestamp":"2024-06-10T17:47:46.349365","version":"7.0.1","argv":["./tests/data/al-khaser_x64.exe_","--json"],"sample":{"md5":"3cb21ae76ff3da4b7e02d77ff76e82be","sha1":"7156270661549f75c253f169fe8988690f6fc700","sha256":"c2c49f2592f78b7a70fd984dbbb25f7251dd1c851caa884f39ff1c8075f0b228","path":"/Users/fariss/Desktop/capa/tests/data/al-khaser_x64.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"amd64","os":"windows","extractor":"VivisectFeatureExtractor","rules":["/Users/fariss/Desktop/capa/rules"],"base_address":{"type":"absolute","value":5368709120},"layout":{"functions":[{"address":{"type":"absolute","value":5368811525},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840006}}]},{"address":{"type":"absolute","value":5368811530},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013168}}]},{"address":{"type":"absolute","value":5368811540},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005200}},{"address":{"type":"absolute","value":5369005266}}]},{"address":{"type":"absolute","value":5368811565},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368959552}},{"address":{"type":"absolute","value":5368959622}},{"address":{"type":"absolute","value":5368959757}},{"address":{"type":"absolute","value":5368960000}}]},{"address":{"type":"absolute","value":5368811570},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368846160}}]},{"address":{"type":"absolute","value":5368811655},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368924448}}]},{"address":{"type":"absolute","value":5368811660},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368890800}}]},{"address":{"type":"absolute","value":5368811670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368942720}}]},{"address":{"type":"absolute","value":5368811675},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368931152}},{"address":{"type":"absolute","value":5368931316}}]},{"address":{"type":"absolute","value":5368811680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368872240}}]},{"address":{"type":"absolute","value":5368811690},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010288}}]},{"address":{"type":"absolute","value":5368811695},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368940992}}]},{"address":{"type":"absolute","value":5368811715},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368951744}},{"address":{"type":"absolute","value":5368951918}},{"address":{"type":"absolute","value":5368952263}},{"address":{"type":"absolute","value":5368952779}}]},{"address":{"type":"absolute","value":5368811720},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368861728}}]},{"address":{"type":"absolute","value":5368811740},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368935773}}]},{"address":{"type":"absolute","value":5368811755},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915808}}]},{"address":{"type":"absolute","value":5368811765},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368854880}},{"address":{"type":"absolute","value":5368854976}}]},{"address":{"type":"absolute","value":5368811785},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013600}}]},{"address":{"type":"absolute","value":5368811805},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368851327}},{"address":{"type":"absolute","value":5368851370}},{"address":{"type":"absolute","value":5368851795}}]},{"address":{"type":"absolute","value":5368811810},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368939152}}]},{"address":{"type":"absolute","value":5368811820},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368917392}}]},{"address":{"type":"absolute","value":5368811825},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013504}}]},{"address":{"type":"absolute","value":5368811865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997328}},{"address":{"type":"absolute","value":5368997449}}]},{"address":{"type":"absolute","value":5368811870},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858960}}]},{"address":{"type":"absolute","value":5368811875},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368922416}}]},{"address":{"type":"absolute","value":5368811905},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869472}}]},{"address":{"type":"absolute","value":5368811925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368984512}}]},{"address":{"type":"absolute","value":5368811990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368844166}}]},{"address":{"type":"absolute","value":5368812010},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368893712}},{"address":{"type":"absolute","value":5368893848}}]},{"address":{"type":"absolute","value":5368812015},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368839769}}]},{"address":{"type":"absolute","value":5368812020},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369019328}},{"address":{"type":"absolute","value":5369019343}},{"address":{"type":"absolute","value":5369019390}},{"address":{"type":"absolute","value":5369019817}},{"address":{"type":"absolute","value":5369019949}},{"address":{"type":"absolute","value":5369020147}}]},{"address":{"type":"absolute","value":5368812035},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368852559}},{"address":{"type":"absolute","value":5368852602}},{"address":{"type":"absolute","value":5368852710}}]},{"address":{"type":"absolute","value":5368812055},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368962880}}]},{"address":{"type":"absolute","value":5368812100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368855200}},{"address":{"type":"absolute","value":5368855365}}]},{"address":{"type":"absolute","value":5368812110},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925360}}]},{"address":{"type":"absolute","value":5368812115},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368938720}}]},{"address":{"type":"absolute","value":5368812120},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368935952}}]},{"address":{"type":"absolute","value":5368812150},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368863408}},{"address":{"type":"absolute","value":5368863518}},{"address":{"type":"absolute","value":5368863684}},{"address":{"type":"absolute","value":5368863767}},{"address":{"type":"absolute","value":5368863913}}]},{"address":{"type":"absolute","value":5368812180},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368859792}},{"address":{"type":"absolute","value":5368860125}}]},{"address":{"type":"absolute","value":5368812185},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368920720}}]},{"address":{"type":"absolute","value":5368812195},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013857}}]},{"address":{"type":"absolute","value":5368812220},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005424}}]},{"address":{"type":"absolute","value":5368812230},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368999623}},{"address":{"type":"absolute","value":5368999700}}]},{"address":{"type":"absolute","value":5368812255},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368862720}}]},{"address":{"type":"absolute","value":5368812270},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368977872}}]},{"address":{"type":"absolute","value":5368812285},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368905856}},{"address":{"type":"absolute","value":5368905952}}]},{"address":{"type":"absolute","value":5368812290},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369004455}}]},{"address":{"type":"absolute","value":5368812310},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368866464}}]},{"address":{"type":"absolute","value":5368812315},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368957520}}]},{"address":{"type":"absolute","value":5368812320},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017312}},{"address":{"type":"absolute","value":5369017341}}]},{"address":{"type":"absolute","value":5368812325},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368831168}}]},{"address":{"type":"absolute","value":5368812330},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915696}}]},{"address":{"type":"absolute","value":5368812340},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368993792}},{"address":{"type":"absolute","value":5368994097}}]},{"address":{"type":"absolute","value":5368812350},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007888}}]},{"address":{"type":"absolute","value":5368812360},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368953552}},{"address":{"type":"absolute","value":5368953892}},{"address":{"type":"absolute","value":5368953985}},{"address":{"type":"absolute","value":5368954205}},{"address":{"type":"absolute","value":5368954290}}]},{"address":{"type":"absolute","value":5368812385},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368857936}}]},{"address":{"type":"absolute","value":5368812395},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368911264}},{"address":{"type":"absolute","value":5368911394}},{"address":{"type":"absolute","value":5368911647}}]},{"address":{"type":"absolute","value":5368812430},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368844868}}]},{"address":{"type":"absolute","value":5368812455},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368992784}}]},{"address":{"type":"absolute","value":5368812465},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013777}}]},{"address":{"type":"absolute","value":5368812475},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368957232}}]},{"address":{"type":"absolute","value":5368812485},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925584}}]},{"address":{"type":"absolute","value":5368812530},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369000672}}]},{"address":{"type":"absolute","value":5368812550},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368986160}}]},{"address":{"type":"absolute","value":5368812575},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368989264}}]},{"address":{"type":"absolute","value":5368812590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368945360}},{"address":{"type":"absolute","value":5368945480}}]},{"address":{"type":"absolute","value":5368812600},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368967072}}]},{"address":{"type":"absolute","value":5368812615},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368928480}}]},{"address":{"type":"absolute","value":5368812640},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368855536}}]},{"address":{"type":"absolute","value":5368812670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925952}}]},{"address":{"type":"absolute","value":5368812675},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914304}}]},{"address":{"type":"absolute","value":5368812680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997776}}]},{"address":{"type":"absolute","value":5368812685},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007991}},{"address":{"type":"absolute","value":5369007998}}]},{"address":{"type":"absolute","value":5368812700},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368865536}}]},{"address":{"type":"absolute","value":5368812710},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368883600}}]},{"address":{"type":"absolute","value":5368812715},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368968522}},{"address":{"type":"absolute","value":5368968591}}]},{"address":{"type":"absolute","value":5368812735},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368963792}}]},{"address":{"type":"absolute","value":5368812780},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368859424}}]},{"address":{"type":"absolute","value":5368812785},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915584}}]},{"address":{"type":"absolute","value":5368812845},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002128}}]},{"address":{"type":"absolute","value":5368812865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013632}}]},{"address":{"type":"absolute","value":5368812875},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368852912}},{"address":{"type":"absolute","value":5368853061}},{"address":{"type":"absolute","value":5368853126}},{"address":{"type":"absolute","value":5368853235}},{"address":{"type":"absolute","value":5368853300}}]},{"address":{"type":"absolute","value":5368812895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368988624}},{"address":{"type":"absolute","value":5368988760}}]},{"address":{"type":"absolute","value":5368812910},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368983248}},{"address":{"type":"absolute","value":5368983445}}]},{"address":{"type":"absolute","value":5368812925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907312}}]},{"address":{"type":"absolute","value":5368812935},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017488}},{"address":{"type":"absolute","value":5369017534}},{"address":{"type":"absolute","value":5369017543}}]},{"address":{"type":"absolute","value":5368812970},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368972656}}]},{"address":{"type":"absolute","value":5368812990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369001472}}]},{"address":{"type":"absolute","value":5368812995},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013328}}]},{"address":{"type":"absolute","value":5368813035},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368978288}},{"address":{"type":"absolute","value":5368978428}}]},{"address":{"type":"absolute","value":5368813040},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914624}}]},{"address":{"type":"absolute","value":5368813065},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368867136}}]},{"address":{"type":"absolute","value":5368813080},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368908976}}]},{"address":{"type":"absolute","value":5368813105},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368845952}}]},{"address":{"type":"absolute","value":5368813120},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869616}}]},{"address":{"type":"absolute","value":5368813170},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369011040}},{"address":{"type":"absolute","value":5369011098}},{"address":{"type":"absolute","value":5369011194}}]},{"address":{"type":"absolute","value":5368813175},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368959159}}]},{"address":{"type":"absolute","value":5368813180},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368949696}}]},{"address":{"type":"absolute","value":5368813190},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368876128}}]},{"address":{"type":"absolute","value":5368813195},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368940096}}]},{"address":{"type":"absolute","value":5368813200},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368946880}}]},{"address":{"type":"absolute","value":5368813215},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369004272}},{"address":{"type":"absolute","value":5369004285}},{"address":{"type":"absolute","value":5369004330}}]},{"address":{"type":"absolute","value":5368813260},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010208}}]},{"address":{"type":"absolute","value":5368813275},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368995360}},{"address":{"type":"absolute","value":5368995656}}]},{"address":{"type":"absolute","value":5368813280},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858112}}]},{"address":{"type":"absolute","value":5368813285},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005387}}]},{"address":{"type":"absolute","value":5368813315},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368996618}},{"address":{"type":"absolute","value":5368996644}}]},{"address":{"type":"absolute","value":5368813335},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368943320}}]},{"address":{"type":"absolute","value":5368813350},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368894864}}]},{"address":{"type":"absolute","value":5368813355},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368982784}}]},{"address":{"type":"absolute","value":5368813380},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013664}}]},{"address":{"type":"absolute","value":5368813395},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368941664}}]},{"address":{"type":"absolute","value":5368813405},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369006893}}]},{"address":{"type":"absolute","value":5368813420},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368965144}}]},{"address":{"type":"absolute","value":5368813435},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368893968}},{"address":{"type":"absolute","value":5368894104}}]},{"address":{"type":"absolute","value":5368813440},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840864}}]},{"address":{"type":"absolute","value":5368813445},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923680}}]},{"address":{"type":"absolute","value":5368813465},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368929536}}]},{"address":{"type":"absolute","value":5368813475},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368877280}}]},{"address":{"type":"absolute","value":5368813500},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368967728}}]},{"address":{"type":"absolute","value":5368813505},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915472}}]},{"address":{"type":"absolute","value":5368813515},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368844272}}]},{"address":{"type":"absolute","value":5368813525},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368837088}}]},{"address":{"type":"absolute","value":5368813540},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368898912}}]},{"address":{"type":"absolute","value":5368813555},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013937}}]},{"address":{"type":"absolute","value":5368813560},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858352}}]},{"address":{"type":"absolute","value":5368813565},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914432}}]},{"address":{"type":"absolute","value":5368813585},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368895248}},{"address":{"type":"absolute","value":5368895480}}]},{"address":{"type":"absolute","value":5368813590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368928880}}]},{"address":{"type":"absolute","value":5368813595},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368921760}}]},{"address":{"type":"absolute","value":5368813610},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007594}}]},{"address":{"type":"absolute","value":5368813630},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369015968}}]},{"address":{"type":"absolute","value":5368813635},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368839184}},{"address":{"type":"absolute","value":5368839341}}]},{"address":{"type":"absolute","value":5368813665},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368944560}}]},{"address":{"type":"absolute","value":5368813670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368905440}},{"address":{"type":"absolute","value":5368905536}}]},{"address":{"type":"absolute","value":5368813680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368898240}},{"address":{"type":"absolute","value":5368898405}}]},{"address":{"type":"absolute","value":5368813685},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368848000}}]},{"address":{"type":"absolute","value":5368813695},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923568}}]},{"address":{"type":"absolute","value":5368813700},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002064}}]},{"address":{"type":"absolute","value":5368813705},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368926928}}]},{"address":{"type":"absolute","value":5368813745},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368986448}}]},{"address":{"type":"absolute","value":5368813750},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368950592}},{"address":{"type":"absolute","value":5368950804}},{"address":{"type":"absolute","value":5368950968}},{"address":{"type":"absolute","value":5368951220}},{"address":{"type":"absolute","value":5368951296}}]},{"address":{"type":"absolute","value":5368813760},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368910688}},{"address":{"type":"absolute","value":5368910818}},{"address":{"type":"absolute","value":5368910906}}]},{"address":{"type":"absolute","value":5368813770},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368898576}},{"address":{"type":"absolute","value":5368898741}}]},{"address":{"type":"absolute","value":5368813815},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923216}}]},{"address":{"type":"absolute","value":5368813820},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925472}}]},{"address":{"type":"absolute","value":5368813825},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016224}}]},{"address":{"type":"absolute","value":5368813830},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368865680}}]},{"address":{"type":"absolute","value":5368813840},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368958453}}]},{"address":{"type":"absolute","value":5368813895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368938016}}]},{"address":{"type":"absolute","value":5368813910},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368866222}},{"address":{"type":"absolute","value":5368866309}}]},{"address":{"type":"absolute","value":5368813925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368848272}}]},{"address":{"type":"absolute","value":5368813930},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368899264}}]},{"address":{"type":"absolute","value":5368813935},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368926592}}]},{"address":{"type":"absolute","value":5368813960},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368871664}}]},{"address":{"type":"absolute","value":5368813975},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014016}}]},{"address":{"type":"absolute","value":5368813980},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369008240}}]},{"address":{"type":"absolute","value":5368813990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368890032}},{"address":{"type":"absolute","value":5368890242}}]},{"address":{"type":"absolute","value":5368814025},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368947424}}]},{"address":{"type":"absolute","value":5368814035},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907625}}]},{"address":{"type":"absolute","value":5368814040},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368864464}},{"address":{"type":"absolute","value":5368864594}},{"address":{"type":"absolute","value":5368864642}}]},{"address":{"type":"absolute","value":5368814065},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017216}}]},{"address":{"type":"absolute","value":5368814090},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368847824}}]},{"address":{"type":"absolute","value":5368814100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368862560}}]},{"address":{"type":"absolute","value":5368814130},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368838128}}]},{"address":{"type":"absolute","value":5368814135},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368935273}}]},{"address":{"type":"absolute","value":5368814145},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368976496}}]},{"address":{"type":"absolute","value":5368814200},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002562}}]},{"address":{"type":"absolute","value":5368814205},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368999904}},{"address":{"type":"absolute","value":5369000118}}]},{"address":{"type":"absolute","value":5368814210},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369001216}}]},{"address":{"type":"absolute","value":5368814230},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368884334}}]},{"address":{"type":"absolute","value":5368814240},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368918544}}]},{"address":{"type":"absolute","value":5368814290},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907088}},{"address":{"type":"absolute","value":5368907176}},{"address":{"type":"absolute","value":5368907213}}]},{"address":{"type":"absolute","value":5368814300},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369006077}}]},{"address":{"type":"absolute","value":5368814305},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368853616}},{"address":{"type":"absolute","value":5368853752}}]},{"address":{"type":"absolute","value":5368814335},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368996768}}]},{"address":{"type":"absolute","value":5368814345},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368891040}},{"address":{"type":"absolute","value":5368891218}}]},{"address":{"type":"absolute","value":5368814390},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368870592}}]},{"address":{"type":"absolute","value":5368814415},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007856}}]},{"address":{"type":"absolute","value":5368814425},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369000320}},{"address":{"type":"absolute","value":5369000497}}]},{"address":{"type":"absolute","value":5368814435},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368923456}}]},{"address":{"type":"absolute","value":5368814450},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368842521}}]},{"address":{"type":"absolute","value":5368814455},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916256}}]},{"address":{"type":"absolute","value":5368814490},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368925696}},{"address":{"type":"absolute","value":5368925779}}]},{"address":{"type":"absolute","value":5368814500},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368909568}},{"address":{"type":"absolute","value":5368909711}},{"address":{"type":"absolute","value":5368910144}}]},{"address":{"type":"absolute","value":5368814540},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368842752}}]},{"address":{"type":"absolute","value":5368814555},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368893136}}]},{"address":{"type":"absolute","value":5368814590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368931728}}]},{"address":{"type":"absolute","value":5368814600},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997120}}]},{"address":{"type":"absolute","value":5368814605},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368986672}}]},{"address":{"type":"absolute","value":5368814620},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016272}},{"address":{"type":"absolute","value":5369016379}}]},{"address":{"type":"absolute","value":5368814630},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368853872}}]},{"address":{"type":"absolute","value":5368814640},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368908237}}]},{"address":{"type":"absolute","value":5368814690},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369015535}},{"address":{"type":"absolute","value":5369015736}}]},{"address":{"type":"absolute","value":5368814700},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368846752}}]},{"address":{"type":"absolute","value":5368814705},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007028}},{"address":{"type":"absolute","value":5369007110}}]},{"address":{"type":"absolute","value":5368814710},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368867760}}]},{"address":{"type":"absolute","value":5368814735},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869042}},{"address":{"type":"absolute","value":5368869087}}]},{"address":{"type":"absolute","value":5368814750},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005760}}]},{"address":{"type":"absolute","value":5368814775},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858838}},{"address":{"type":"absolute","value":5368858872}}]},{"address":{"type":"absolute","value":5368814800},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368929888}}]},{"address":{"type":"absolute","value":5368814810},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368874096}},{"address":{"type":"absolute","value":5368874319}},{"address":{"type":"absolute","value":5368874689}}]},{"address":{"type":"absolute","value":5368814830},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369015264}},{"address":{"type":"absolute","value":5369015293}}]},{"address":{"type":"absolute","value":5368814850},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368871952}}]},{"address":{"type":"absolute","value":5368814865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368919549}},{"address":{"type":"absolute","value":5368919737}},{"address":{"type":"absolute","value":5368919951}},{"address":{"type":"absolute","value":5368920014}},{"address":{"type":"absolute","value":5368920079}},{"address":{"type":"absolute","value":5368920205}},{"address":{"type":"absolute","value":5368920268}}]},{"address":{"type":"absolute","value":5368814870},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368841264}}]},{"address":{"type":"absolute","value":5368814875},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368877056}}]},{"address":{"type":"absolute","value":5368814880},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368993008}}]},{"address":{"type":"absolute","value":5368814895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368990848}},{"address":{"type":"absolute","value":5368991013}}]},{"address":{"type":"absolute","value":5368814900},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014144}}]},{"address":{"type":"absolute","value":5368814905},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368932480}},{"address":{"type":"absolute","value":5368932788}}]},{"address":{"type":"absolute","value":5368814935},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368908512}},{"address":{"type":"absolute","value":5368908692}}]},{"address":{"type":"absolute","value":5368814945},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368874928}}]},{"address":{"type":"absolute","value":5368814970},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368915920}}]},{"address":{"type":"absolute","value":5368814980},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858534}},{"address":{"type":"absolute","value":5368858568}}]},{"address":{"type":"absolute","value":5368814990},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368907712}},{"address":{"type":"absolute","value":5368907842}}]},{"address":{"type":"absolute","value":5368815005},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368892464}}]},{"address":{"type":"absolute","value":5368815040},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368927760}},{"address":{"type":"absolute","value":5368928040}}]},{"address":{"type":"absolute","value":5368815050},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368881759}},{"address":{"type":"absolute","value":5368882019}},{"address":{"type":"absolute","value":5368882175}}]},{"address":{"type":"absolute","value":5368815060},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368872528}}]},{"address":{"type":"absolute","value":5368815070},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368859600}}]},{"address":{"type":"absolute","value":5368815090},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368934160}}]},{"address":{"type":"absolute","value":5368815100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368973264}}]},{"address":{"type":"absolute","value":5368815115},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840336}}]},{"address":{"type":"absolute","value":5368815130},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368815130}},{"address":{"type":"absolute","value":5369002823}}]},{"address":{"type":"absolute","value":5368815140},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010256}}]},{"address":{"type":"absolute","value":5368815150},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368899968}}]},{"address":{"type":"absolute","value":5368815160},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368966608}}]},{"address":{"type":"absolute","value":5368815165},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368984784}}]},{"address":{"type":"absolute","value":5368815170},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368860320}},{"address":{"type":"absolute","value":5368860417}},{"address":{"type":"absolute","value":5368860540}},{"address":{"type":"absolute","value":5368860552}}]},{"address":{"type":"absolute","value":5368815175},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368914080}}]},{"address":{"type":"absolute","value":5368815190},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368948908}}]},{"address":{"type":"absolute","value":5368815200},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368985322}}]},{"address":{"type":"absolute","value":5368815210},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368845568}},{"address":{"type":"absolute","value":5368845680}},{"address":{"type":"absolute","value":5368845793}}]},{"address":{"type":"absolute","value":5368815215},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368962560}}]},{"address":{"type":"absolute","value":5368815230},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368921024}}]},{"address":{"type":"absolute","value":5368815245},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368944304}}]},{"address":{"type":"absolute","value":5368815265},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368899616}}]},{"address":{"type":"absolute","value":5368815300},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368969872}}]},{"address":{"type":"absolute","value":5368815315},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368884640}},{"address":{"type":"absolute","value":5368884960}},{"address":{"type":"absolute","value":5368884998}},{"address":{"type":"absolute","value":5368885084}},{"address":{"type":"absolute","value":5368885421}},{"address":{"type":"absolute","value":5368885459}},{"address":{"type":"absolute","value":5368885632}},{"address":{"type":"absolute","value":5368885693}}]},{"address":{"type":"absolute","value":5368815325},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368837568}}]},{"address":{"type":"absolute","value":5368815340},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368924704}},{"address":{"type":"absolute","value":5368925052}}]},{"address":{"type":"absolute","value":5368815350},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916800}}]},{"address":{"type":"absolute","value":5368815370},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368906656}}]},{"address":{"type":"absolute","value":5368815385},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369020497}}]},{"address":{"type":"absolute","value":5368815390},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368865840}}]},{"address":{"type":"absolute","value":5368815480},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368897904}},{"address":{"type":"absolute","value":5368898069}}]},{"address":{"type":"absolute","value":5368815500},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368906928}},{"address":{"type":"absolute","value":5368906998}}]},{"address":{"type":"absolute","value":5368815515},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017088}}]},{"address":{"type":"absolute","value":5368815525},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368918304}}]},{"address":{"type":"absolute","value":5368815530},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368957808}}]},{"address":{"type":"absolute","value":5368815555},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368871008}}]},{"address":{"type":"absolute","value":5368815575},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016016}},{"address":{"type":"absolute","value":5369016067}},{"address":{"type":"absolute","value":5369016177}}]},{"address":{"type":"absolute","value":5368815585},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369001792}},{"address":{"type":"absolute","value":5369001893}}]},{"address":{"type":"absolute","value":5368815590},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368971024}},{"address":{"type":"absolute","value":5368971322}}]},{"address":{"type":"absolute","value":5368815610},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368964656}}]},{"address":{"type":"absolute","value":5368815625},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368998896}}]},{"address":{"type":"absolute","value":5368815660},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007252}},{"address":{"type":"absolute","value":5369007274}}]},{"address":{"type":"absolute","value":5368815670},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007296}},{"address":{"type":"absolute","value":5369007416}}]},{"address":{"type":"absolute","value":5368815675},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368965504}},{"address":{"type":"absolute","value":5368965587}},{"address":{"type":"absolute","value":5368965631}},{"address":{"type":"absolute","value":5368965660}}]},{"address":{"type":"absolute","value":5368815680},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368849296}}]},{"address":{"type":"absolute","value":5368815685},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002571}}]},{"address":{"type":"absolute","value":5368815690},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368970112}},{"address":{"type":"absolute","value":5368970395}},{"address":{"type":"absolute","value":5368970461}},{"address":{"type":"absolute","value":5368970515}},{"address":{"type":"absolute","value":5368970547}},{"address":{"type":"absolute","value":5368970619}},{"address":{"type":"absolute","value":5368970649}}]},{"address":{"type":"absolute","value":5368815715},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368841536}},{"address":{"type":"absolute","value":5368841775}},{"address":{"type":"absolute","value":5368841964}},{"address":{"type":"absolute","value":5368842047}}]},{"address":{"type":"absolute","value":5368815725},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368894224}},{"address":{"type":"absolute","value":5368894360}}]},{"address":{"type":"absolute","value":5368815745},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013008}}]},{"address":{"type":"absolute","value":5368815755},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368974336}}]},{"address":{"type":"absolute","value":5368815765},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368930496}}]},{"address":{"type":"absolute","value":5368815770},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368894480}}]},{"address":{"type":"absolute","value":5368815780},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368847040}}]},{"address":{"type":"absolute","value":5368815785},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007824}}]},{"address":{"type":"absolute","value":5368815805},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014192}},{"address":{"type":"absolute","value":5369014382}},{"address":{"type":"absolute","value":5369014472}},{"address":{"type":"absolute","value":5369014657}},{"address":{"type":"absolute","value":5369014716}},{"address":{"type":"absolute","value":5369014793}},{"address":{"type":"absolute","value":5369014834}},{"address":{"type":"absolute","value":5369014938}},{"address":{"type":"absolute","value":5369015008}}]},{"address":{"type":"absolute","value":5368815865},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368890480}}]},{"address":{"type":"absolute","value":5368815870},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916144}}]},{"address":{"type":"absolute","value":5368815890},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368999336}}]},{"address":{"type":"absolute","value":5368815895},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369006544}},{"address":{"type":"absolute","value":5369006612}}]},{"address":{"type":"absolute","value":5368815905},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368877504}}]},{"address":{"type":"absolute","value":5368815910},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368840608}}]},{"address":{"type":"absolute","value":5368815925},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368842992}}]},{"address":{"type":"absolute","value":5368815930},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368913856}}]},{"address":{"type":"absolute","value":5368815955},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368920912}}]},{"address":{"type":"absolute","value":5368815960},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368953248}}]},{"address":{"type":"absolute","value":5368815965},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369013968}}]},{"address":{"type":"absolute","value":5368815970},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368886745}},{"address":{"type":"absolute","value":5368886781}}]},{"address":{"type":"absolute","value":5368815980},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369008302}}]},{"address":{"type":"absolute","value":5368816000},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368858656}}]},{"address":{"type":"absolute","value":5368816010},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368887327}},{"address":{"type":"absolute","value":5368887482}},{"address":{"type":"absolute","value":5368887733}},{"address":{"type":"absolute","value":5368887794}},{"address":{"type":"absolute","value":5368887937}}]},{"address":{"type":"absolute","value":5368816025},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368997936}}]},{"address":{"type":"absolute","value":5368816045},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368996944}}]},{"address":{"type":"absolute","value":5368816060},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368994400}},{"address":{"type":"absolute","value":5368994791}}]},{"address":{"type":"absolute","value":5368816065},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368873312}}]},{"address":{"type":"absolute","value":5368816080},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368882496}}]},{"address":{"type":"absolute","value":5368816085},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369016848}},{"address":{"type":"absolute","value":5369016959}}]},{"address":{"type":"absolute","value":5368816100},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368869250}},{"address":{"type":"absolute","value":5368869313}},{"address":{"type":"absolute","value":5368869337}}]},{"address":{"type":"absolute","value":5368816105},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369003728}},{"address":{"type":"absolute","value":5369003794}},{"address":{"type":"absolute","value":5369003826}},{"address":{"type":"absolute","value":5369003841}}]},{"address":{"type":"absolute","value":5368816135},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369004352}}]},{"address":{"type":"absolute","value":5368816155},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368912320}},{"address":{"type":"absolute","value":5368912450}},{"address":{"type":"absolute","value":5368912538}}]},{"address":{"type":"absolute","value":5368816160},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368978884}},{"address":{"type":"absolute","value":5368979231}},{"address":{"type":"absolute","value":5368979385}},{"address":{"type":"absolute","value":5368979938}},{"address":{"type":"absolute","value":5368980220}},{"address":{"type":"absolute","value":5368980317}},{"address":{"type":"absolute","value":5368980473}},{"address":{"type":"absolute","value":5368980815}}]},{"address":{"type":"absolute","value":5368816165},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368888611}},{"address":{"type":"absolute","value":5368888766}},{"address":{"type":"absolute","value":5368889163}},{"address":{"type":"absolute","value":5368889407}},{"address":{"type":"absolute","value":5368889461}}]},{"address":{"type":"absolute","value":5368816185},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369005472}}]},{"address":{"type":"absolute","value":5368816205},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368965328}}]},{"address":{"type":"absolute","value":5368816215},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368933200}}]},{"address":{"type":"absolute","value":5368816225},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368928768}}]},{"address":{"type":"absolute","value":5368816245},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368954848}},{"address":{"type":"absolute","value":5368955014}},{"address":{"type":"absolute","value":5368955356}},{"address":{"type":"absolute","value":5368955764}}]},{"address":{"type":"absolute","value":5368816265},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369014064}},{"address":{"type":"absolute","value":5369014111}}]},{"address":{"type":"absolute","value":5368816310},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368945965}}]},{"address":{"type":"absolute","value":5368816320},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368966232}},{"address":{"type":"absolute","value":5368966375}}]},{"address":{"type":"absolute","value":5368816360},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368870800}}]},{"address":{"type":"absolute","value":5368816365},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369010176}}]},{"address":{"type":"absolute","value":5368816400},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368845408}}]},{"address":{"type":"absolute","value":5368816445},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369017392}},{"address":{"type":"absolute","value":5369017438}},{"address":{"type":"absolute","value":5369017447}}]},{"address":{"type":"absolute","value":5368816450},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369007194}}]},{"address":{"type":"absolute","value":5368816460},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368956192}},{"address":{"type":"absolute","value":5368956528}}]},{"address":{"type":"absolute","value":5368816465},"matched_basic_blocks":[{"address":{"type":"absolute","value":5369002562}},{"address":{"type":"absolute","value":5369002568}}]},{"address":{"type":"absolute","value":5368816515},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368916032}}]},{"address":{"type":"absolute","value":5368821728},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368821728}}]},{"address":{"type":"absolute","value":5368822176},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368822176}}]},{"address":{"type":"absolute","value":5368824096},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368824096}}]},{"address":{"type":"absolute","value":5368838672},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368838672}}]},{"address":{"type":"absolute","value":5368882832},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368882832}},{"address":{"type":"absolute","value":5368882955}},{"address":{"type":"absolute","value":5368883110}},{"address":{"type":"absolute","value":5368883232}}]},{"address":{"type":"absolute","value":5368891376},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368891498}},{"address":{"type":"absolute","value":5368891614}}]},{"address":{"type":"absolute","value":5368891792},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368891898}}]},{"address":{"type":"absolute","value":5368892096},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368892096}}]},{"address":{"type":"absolute","value":5368892304},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368892304}}]},{"address":{"type":"absolute","value":5368909136},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368909136}}]},{"address":{"type":"absolute","value":5368960864},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368961024}},{"address":{"type":"absolute","value":5368961046}}]},{"address":{"type":"absolute","value":5368964112},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368964112}}]},{"address":{"type":"absolute","value":5368964496},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368964496}}]},{"address":{"type":"absolute","value":5368986896},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368987018}},{"address":{"type":"absolute","value":5368987134}}]},{"address":{"type":"absolute","value":5368987312},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368987418}}]},{"address":{"type":"absolute","value":5368988000},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368988000}}]},{"address":{"type":"absolute","value":5368988208},"matched_basic_blocks":[{"address":{"type":"absolute","value":5368988208}}]}]},"feature_counts":{"file":2217,"functions":[{"address":{"type":"absolute","value":5368811525},"count":58},{"address":{"type":"absolute","value":5368811530},"count":28},{"address":{"type":"absolute","value":5368811535},"count":10},{"address":{"type":"absolute","value":5368811540},"count":40},{"address":{"type":"absolute","value":5368811550},"count":9},{"address":{"type":"absolute","value":5368811555},"count":33},{"address":{"type":"absolute","value":5368811560},"count":8},{"address":{"type":"absolute","value":5368811565},"count":78},{"address":{"type":"absolute","value":5368811570},"count":38},{"address":{"type":"absolute","value":5368811585},"count":10},{"address":{"type":"absolute","value":5368811590},"count":49},{"address":{"type":"absolute","value":5368811605},"count":31},{"address":{"type":"absolute","value":5368811620},"count":30},{"address":{"type":"absolute","value":5368811625},"count":32},{"address":{"type":"absolute","value":5368811630},"count":30},{"address":{"type":"absolute","value":5368811655},"count":40},{"address":{"type":"absolute","value":5368811660},"count":56},{"address":{"type":"absolute","value":5368811670},"count":54},{"address":{"type":"absolute","value":5368811675},"count":72},{"address":{"type":"absolute","value":5368811680},"count":43},{"address":{"type":"absolute","value":5368811685},"count":9},{"address":{"type":"absolute","value":5368811690},"count":14},{"address":{"type":"absolute","value":5368811695},"count":62},{"address":{"type":"absolute","value":5368811705},"count":28},{"address":{"type":"absolute","value":5368811715},"count":130},{"address":{"type":"absolute","value":5368811720},"count":38},{"address":{"type":"absolute","value":5368811740},"count":54},{"address":{"type":"absolute","value":5368811745},"count":31},{"address":{"type":"absolute","value":5368811750},"count":34},{"address":{"type":"absolute","value":5368811755},"count":36},{"address":{"type":"absolute","value":5368811760},"count":31},{"address":{"type":"absolute","value":5368811765},"count":58},{"address":{"type":"absolute","value":5368811770},"count":50},{"address":{"type":"absolute","value":5368811775},"count":9},{"address":{"type":"absolute","value":5368811780},"count":36},{"address":{"type":"absolute","value":5368811785},"count":19},{"address":{"type":"absolute","value":5368811790},"count":9},{"address":{"type":"absolute","value":5368811795},"count":30},{"address":{"type":"absolute","value":5368811800},"count":30},{"address":{"type":"absolute","value":5368811805},"count":95},{"address":{"type":"absolute","value":5368811810},"count":63},{"address":{"type":"absolute","value":5368811820},"count":64},{"address":{"type":"absolute","value":5368811825},"count":33},{"address":{"type":"absolute","value":5368811830},"count":32},{"address":{"type":"absolute","value":5368811835},"count":36},{"address":{"type":"absolute","value":5368811850},"count":33},{"address":{"type":"absolute","value":5368811855},"count":30},{"address":{"type":"absolute","value":5368811865},"count":59},{"address":{"type":"absolute","value":5368811870},"count":37},{"address":{"type":"absolute","value":5368811875},"count":67},{"address":{"type":"absolute","value":5368811880},"count":33},{"address":{"type":"absolute","value":5368811885},"count":33},{"address":{"type":"absolute","value":5368811890},"count":9},{"address":{"type":"absolute","value":5368811895},"count":35},{"address":{"type":"absolute","value":5368811905},"count":40},{"address":{"type":"absolute","value":5368811910},"count":31},{"address":{"type":"absolute","value":5368811915},"count":8},{"address":{"type":"absolute","value":5368811920},"count":32},{"address":{"type":"absolute","value":5368811925},"count":53},{"address":{"type":"absolute","value":5368811930},"count":31},{"address":{"type":"absolute","value":5368811955},"count":39},{"address":{"type":"absolute","value":5368811960},"count":33},{"address":{"type":"absolute","value":5368811965},"count":48},{"address":{"type":"absolute","value":5368811970},"count":9},{"address":{"type":"absolute","value":5368811975},"count":11},{"address":{"type":"absolute","value":5368811980},"count":31},{"address":{"type":"absolute","value":5368811985},"count":10},{"address":{"type":"absolute","value":5368811990},"count":50},{"address":{"type":"absolute","value":5368812010},"count":41},{"address":{"type":"absolute","value":5368812015},"count":39},{"address":{"type":"absolute","value":5368812020},"count":112},{"address":{"type":"absolute","value":5368812030},"count":37},{"address":{"type":"absolute","value":5368812035},"count":63},{"address":{"type":"absolute","value":5368812040},"count":31},{"address":{"type":"absolute","value":5368812050},"count":38},{"address":{"type":"absolute","value":5368812055},"count":39},{"address":{"type":"absolute","value":5368812065},"count":39},{"address":{"type":"absolute","value":5368812070},"count":31},{"address":{"type":"absolute","value":5368812075},"count":28},{"address":{"type":"absolute","value":5368812080},"count":33},{"address":{"type":"absolute","value":5368812085},"count":30},{"address":{"type":"absolute","value":5368812095},"count":28},{"address":{"type":"absolute","value":5368812100},"count":61},{"address":{"type":"absolute","value":5368812105},"count":38},{"address":{"type":"absolute","value":5368812110},"count":36},{"address":{"type":"absolute","value":5368812115},"count":50},{"address":{"type":"absolute","value":5368812120},"count":82},{"address":{"type":"absolute","value":5368812130},"count":9},{"address":{"type":"absolute","value":5368812140},"count":78},{"address":{"type":"absolute","value":5368812145},"count":31},{"address":{"type":"absolute","value":5368812150},"count":84},{"address":{"type":"absolute","value":5368812155},"count":9},{"address":{"type":"absolute","value":5368812165},"count":30},{"address":{"type":"absolute","value":5368812170},"count":54},{"address":{"type":"absolute","value":5368812175},"count":17},{"address":{"type":"absolute","value":5368812180},"count":47},{"address":{"type":"absolute","value":5368812185},"count":34},{"address":{"type":"absolute","value":5368812190},"count":31},{"address":{"type":"absolute","value":5368812195},"count":32},{"address":{"type":"absolute","value":5368812205},"count":37},{"address":{"type":"absolute","value":5368812210},"count":9},{"address":{"type":"absolute","value":5368812220},"count":21},{"address":{"type":"absolute","value":5368812230},"count":68},{"address":{"type":"absolute","value":5368812235},"count":28},{"address":{"type":"absolute","value":5368812240},"count":31},{"address":{"type":"absolute","value":5368812250},"count":9},{"address":{"type":"absolute","value":5368812255},"count":32},{"address":{"type":"absolute","value":5368812265},"count":10},{"address":{"type":"absolute","value":5368812270},"count":60},{"address":{"type":"absolute","value":5368812275},"count":31},{"address":{"type":"absolute","value":5368812285},"count":70},{"address":{"type":"absolute","value":5368812290},"count":36},{"address":{"type":"absolute","value":5368812295},"count":30},{"address":{"type":"absolute","value":5368812300},"count":38},{"address":{"type":"absolute","value":5368812305},"count":36},{"address":{"type":"absolute","value":5368812310},"count":45},{"address":{"type":"absolute","value":5368812315},"count":29},{"address":{"type":"absolute","value":5368812320},"count":29},{"address":{"type":"absolute","value":5368812325},"count":42},{"address":{"type":"absolute","value":5368812330},"count":36},{"address":{"type":"absolute","value":5368812335},"count":40},{"address":{"type":"absolute","value":5368812340},"count":70},{"address":{"type":"absolute","value":5368812350},"count":26},{"address":{"type":"absolute","value":5368812360},"count":108},{"address":{"type":"absolute","value":5368812380},"count":38},{"address":{"type":"absolute","value":5368812385},"count":36},{"address":{"type":"absolute","value":5368812390},"count":10},{"address":{"type":"absolute","value":5368812395},"count":104},{"address":{"type":"absolute","value":5368812405},"count":28},{"address":{"type":"absolute","value":5368812415},"count":30},{"address":{"type":"absolute","value":5368812425},"count":9},{"address":{"type":"absolute","value":5368812430},"count":43},{"address":{"type":"absolute","value":5368812445},"count":23},{"address":{"type":"absolute","value":5368812455},"count":49},{"address":{"type":"absolute","value":5368812465},"count":32},{"address":{"type":"absolute","value":5368812475},"count":29},{"address":{"type":"absolute","value":5368812480},"count":68},{"address":{"type":"absolute","value":5368812485},"count":36},{"address":{"type":"absolute","value":5368812495},"count":26},{"address":{"type":"absolute","value":5368812500},"count":35},{"address":{"type":"absolute","value":5368812505},"count":30},{"address":{"type":"absolute","value":5368812530},"count":78},{"address":{"type":"absolute","value":5368812550},"count":53},{"address":{"type":"absolute","value":5368812565},"count":30},{"address":{"type":"absolute","value":5368812575},"count":60},{"address":{"type":"absolute","value":5368812580},"count":30},{"address":{"type":"absolute","value":5368812585},"count":32},{"address":{"type":"absolute","value":5368812590},"count":72},{"address":{"type":"absolute","value":5368812600},"count":55},{"address":{"type":"absolute","value":5368812615},"count":36},{"address":{"type":"absolute","value":5368812640},"count":60},{"address":{"type":"absolute","value":5368812645},"count":9},{"address":{"type":"absolute","value":5368812650},"count":30},{"address":{"type":"absolute","value":5368812660},"count":29},{"address":{"type":"absolute","value":5368812665},"count":9},{"address":{"type":"absolute","value":5368812670},"count":57},{"address":{"type":"absolute","value":5368812675},"count":47},{"address":{"type":"absolute","value":5368812680},"count":49},{"address":{"type":"absolute","value":5368812685},"count":61},{"address":{"type":"absolute","value":5368812690},"count":9},{"address":{"type":"absolute","value":5368812695},"count":45},{"address":{"type":"absolute","value":5368812700},"count":39},{"address":{"type":"absolute","value":5368812710},"count":26},{"address":{"type":"absolute","value":5368812715},"count":77},{"address":{"type":"absolute","value":5368812725},"count":35},{"address":{"type":"absolute","value":5368812730},"count":31},{"address":{"type":"absolute","value":5368812735},"count":53},{"address":{"type":"absolute","value":5368812740},"count":8},{"address":{"type":"absolute","value":5368812745},"count":35},{"address":{"type":"absolute","value":5368812750},"count":9},{"address":{"type":"absolute","value":5368812770},"count":11},{"address":{"type":"absolute","value":5368812775},"count":27},{"address":{"type":"absolute","value":5368812780},"count":45},{"address":{"type":"absolute","value":5368812785},"count":36},{"address":{"type":"absolute","value":5368812805},"count":39},{"address":{"type":"absolute","value":5368812810},"count":28},{"address":{"type":"absolute","value":5368812830},"count":28},{"address":{"type":"absolute","value":5368812840},"count":31},{"address":{"type":"absolute","value":5368812845},"count":54},{"address":{"type":"absolute","value":5368812855},"count":31},{"address":{"type":"absolute","value":5368812860},"count":33},{"address":{"type":"absolute","value":5368812865},"count":19},{"address":{"type":"absolute","value":5368812870},"count":8},{"address":{"type":"absolute","value":5368812875},"count":89},{"address":{"type":"absolute","value":5368812880},"count":37},{"address":{"type":"absolute","value":5368812890},"count":31},{"address":{"type":"absolute","value":5368812895},"count":41},{"address":{"type":"absolute","value":5368812900},"count":38},{"address":{"type":"absolute","value":5368812910},"count":81},{"address":{"type":"absolute","value":5368812920},"count":33},{"address":{"type":"absolute","value":5368812925},"count":32},{"address":{"type":"absolute","value":5368812935},"count":36},{"address":{"type":"absolute","value":5368812950},"count":27},{"address":{"type":"absolute","value":5368812955},"count":28},{"address":{"type":"absolute","value":5368812960},"count":39},{"address":{"type":"absolute","value":5368812970},"count":35},{"address":{"type":"absolute","value":5368812975},"count":24},{"address":{"type":"absolute","value":5368812980},"count":35},{"address":{"type":"absolute","value":5368812985},"count":33},{"address":{"type":"absolute","value":5368812990},"count":54},{"address":{"type":"absolute","value":5368812995},"count":26},{"address":{"type":"absolute","value":5368813005},"count":9},{"address":{"type":"absolute","value":5368813020},"count":33},{"address":{"type":"absolute","value":5368813025},"count":10},{"address":{"type":"absolute","value":5368813030},"count":33},{"address":{"type":"absolute","value":5368813035},"count":64},{"address":{"type":"absolute","value":5368813040},"count":36},{"address":{"type":"absolute","value":5368813050},"count":26},{"address":{"type":"absolute","value":5368813055},"count":10},{"address":{"type":"absolute","value":5368813060},"count":32},{"address":{"type":"absolute","value":5368813065},"count":42},{"address":{"type":"absolute","value":5368813070},"count":31},{"address":{"type":"absolute","value":5368813075},"count":38},{"address":{"type":"absolute","value":5368813080},"count":39},{"address":{"type":"absolute","value":5368813085},"count":26},{"address":{"type":"absolute","value":5368813095},"count":29},{"address":{"type":"absolute","value":5368813100},"count":31},{"address":{"type":"absolute","value":5368813105},"count":35},{"address":{"type":"absolute","value":5368813115},"count":33},{"address":{"type":"absolute","value":5368813120},"count":40},{"address":{"type":"absolute","value":5368813125},"count":25},{"address":{"type":"absolute","value":5368813130},"count":12},{"address":{"type":"absolute","value":5368813135},"count":26},{"address":{"type":"absolute","value":5368813145},"count":31},{"address":{"type":"absolute","value":5368813155},"count":60},{"address":{"type":"absolute","value":5368813170},"count":65},{"address":{"type":"absolute","value":5368813175},"count":57},{"address":{"type":"absolute","value":5368813180},"count":42},{"address":{"type":"absolute","value":5368813185},"count":9},{"address":{"type":"absolute","value":5368813190},"count":44},{"address":{"type":"absolute","value":5368813195},"count":70},{"address":{"type":"absolute","value":5368813200},"count":62},{"address":{"type":"absolute","value":5368813205},"count":32},{"address":{"type":"absolute","value":5368813215},"count":28},{"address":{"type":"absolute","value":5368813220},"count":35},{"address":{"type":"absolute","value":5368813225},"count":35},{"address":{"type":"absolute","value":5368813235},"count":52},{"address":{"type":"absolute","value":5368813240},"count":37},{"address":{"type":"absolute","value":5368813245},"count":35},{"address":{"type":"absolute","value":5368813250},"count":9},{"address":{"type":"absolute","value":5368813255},"count":9},{"address":{"type":"absolute","value":5368813260},"count":22},{"address":{"type":"absolute","value":5368813265},"count":31},{"address":{"type":"absolute","value":5368813275},"count":53},{"address":{"type":"absolute","value":5368813280},"count":45},{"address":{"type":"absolute","value":5368813285},"count":38},{"address":{"type":"absolute","value":5368813290},"count":33},{"address":{"type":"absolute","value":5368813305},"count":9},{"address":{"type":"absolute","value":5368813310},"count":31},{"address":{"type":"absolute","value":5368813315},"count":48},{"address":{"type":"absolute","value":5368813335},"count":79},{"address":{"type":"absolute","value":5368813345},"count":28},{"address":{"type":"absolute","value":5368813350},"count":60},{"address":{"type":"absolute","value":5368813355},"count":58},{"address":{"type":"absolute","value":5368813365},"count":10},{"address":{"type":"absolute","value":5368813380},"count":29},{"address":{"type":"absolute","value":5368813390},"count":9},{"address":{"type":"absolute","value":5368813395},"count":66},{"address":{"type":"absolute","value":5368813400},"count":38},{"address":{"type":"absolute","value":5368813405},"count":62},{"address":{"type":"absolute","value":5368813415},"count":31},{"address":{"type":"absolute","value":5368813420},"count":59},{"address":{"type":"absolute","value":5368813435},"count":41},{"address":{"type":"absolute","value":5368813440},"count":51},{"address":{"type":"absolute","value":5368813445},"count":66},{"address":{"type":"absolute","value":5368813460},"count":37},{"address":{"type":"absolute","value":5368813465},"count":54},{"address":{"type":"absolute","value":5368813470},"count":35},{"address":{"type":"absolute","value":5368813475},"count":43},{"address":{"type":"absolute","value":5368813485},"count":27},{"address":{"type":"absolute","value":5368813490},"count":299},{"address":{"type":"absolute","value":5368813500},"count":40},{"address":{"type":"absolute","value":5368813505},"count":36},{"address":{"type":"absolute","value":5368813515},"count":60},{"address":{"type":"absolute","value":5368813525},"count":50},{"address":{"type":"absolute","value":5368813540},"count":60},{"address":{"type":"absolute","value":5368813545},"count":35},{"address":{"type":"absolute","value":5368813550},"count":33},{"address":{"type":"absolute","value":5368813555},"count":32},{"address":{"type":"absolute","value":5368813560},"count":29},{"address":{"type":"absolute","value":5368813565},"count":38},{"address":{"type":"absolute","value":5368813575},"count":9},{"address":{"type":"absolute","value":5368813580},"count":39},{"address":{"type":"absolute","value":5368813585},"count":66},{"address":{"type":"absolute","value":5368813590},"count":57},{"address":{"type":"absolute","value":5368813595},"count":31},{"address":{"type":"absolute","value":5368813600},"count":43},{"address":{"type":"absolute","value":5368813610},"count":28},{"address":{"type":"absolute","value":5368813615},"count":9},{"address":{"type":"absolute","value":5368813620},"count":10},{"address":{"type":"absolute","value":5368813625},"count":31},{"address":{"type":"absolute","value":5368813630},"count":14},{"address":{"type":"absolute","value":5368813635},"count":64},{"address":{"type":"absolute","value":5368813650},"count":27},{"address":{"type":"absolute","value":5368813665},"count":54},{"address":{"type":"absolute","value":5368813670},"count":70},{"address":{"type":"absolute","value":5368813675},"count":31},{"address":{"type":"absolute","value":5368813680},"count":61},{"address":{"type":"absolute","value":5368813685},"count":41},{"address":{"type":"absolute","value":5368813695},"count":36},{"address":{"type":"absolute","value":5368813700},"count":39},{"address":{"type":"absolute","value":5368813705},"count":69},{"address":{"type":"absolute","value":5368813710},"count":52},{"address":{"type":"absolute","value":5368813715},"count":34},{"address":{"type":"absolute","value":5368813720},"count":30},{"address":{"type":"absolute","value":5368813730},"count":26},{"address":{"type":"absolute","value":5368813735},"count":9},{"address":{"type":"absolute","value":5368813745},"count":52},{"address":{"type":"absolute","value":5368813750},"count":107},{"address":{"type":"absolute","value":5368813755},"count":38},{"address":{"type":"absolute","value":5368813760},"count":75},{"address":{"type":"absolute","value":5368813770},"count":61},{"address":{"type":"absolute","value":5368813780},"count":9},{"address":{"type":"absolute","value":5368813785},"count":34},{"address":{"type":"absolute","value":5368813795},"count":9},{"address":{"type":"absolute","value":5368813800},"count":38},{"address":{"type":"absolute","value":5368813805},"count":32},{"address":{"type":"absolute","value":5368813810},"count":30},{"address":{"type":"absolute","value":5368813815},"count":41},{"address":{"type":"absolute","value":5368813820},"count":36},{"address":{"type":"absolute","value":5368813825},"count":17},{"address":{"type":"absolute","value":5368813830},"count":36},{"address":{"type":"absolute","value":5368813835},"count":41},{"address":{"type":"absolute","value":5368813840},"count":61},{"address":{"type":"absolute","value":5368813845},"count":30},{"address":{"type":"absolute","value":5368813860},"count":27},{"address":{"type":"absolute","value":5368813865},"count":31},{"address":{"type":"absolute","value":5368813875},"count":42},{"address":{"type":"absolute","value":5368813890},"count":9},{"address":{"type":"absolute","value":5368813895},"count":64},{"address":{"type":"absolute","value":5368813900},"count":8},{"address":{"type":"absolute","value":5368813910},"count":53},{"address":{"type":"absolute","value":5368813915},"count":8},{"address":{"type":"absolute","value":5368813920},"count":31},{"address":{"type":"absolute","value":5368813925},"count":39},{"address":{"type":"absolute","value":5368813930},"count":60},{"address":{"type":"absolute","value":5368813935},"count":50},{"address":{"type":"absolute","value":5368813950},"count":35},{"address":{"type":"absolute","value":5368813960},"count":42},{"address":{"type":"absolute","value":5368813970},"count":30},{"address":{"type":"absolute","value":5368813975},"count":19},{"address":{"type":"absolute","value":5368813980},"count":17},{"address":{"type":"absolute","value":5368813990},"count":61},{"address":{"type":"absolute","value":5368814000},"count":22},{"address":{"type":"absolute","value":5368814015},"count":28},{"address":{"type":"absolute","value":5368814020},"count":35},{"address":{"type":"absolute","value":5368814025},"count":45},{"address":{"type":"absolute","value":5368814030},"count":27},{"address":{"type":"absolute","value":5368814035},"count":43},{"address":{"type":"absolute","value":5368814040},"count":53},{"address":{"type":"absolute","value":5368814045},"count":34},{"address":{"type":"absolute","value":5368814050},"count":39},{"address":{"type":"absolute","value":5368814055},"count":37},{"address":{"type":"absolute","value":5368814060},"count":33},{"address":{"type":"absolute","value":5368814065},"count":31},{"address":{"type":"absolute","value":5368814075},"count":35},{"address":{"type":"absolute","value":5368814090},"count":41},{"address":{"type":"absolute","value":5368814100},"count":44},{"address":{"type":"absolute","value":5368814110},"count":10},{"address":{"type":"absolute","value":5368814130},"count":63},{"address":{"type":"absolute","value":5368814135},"count":75},{"address":{"type":"absolute","value":5368814145},"count":43},{"address":{"type":"absolute","value":5368814160},"count":35},{"address":{"type":"absolute","value":5368814165},"count":36},{"address":{"type":"absolute","value":5368814175},"count":35},{"address":{"type":"absolute","value":5368814180},"count":54},{"address":{"type":"absolute","value":5368814195},"count":10},{"address":{"type":"absolute","value":5368814200},"count":35},{"address":{"type":"absolute","value":5368814205},"count":65},{"address":{"type":"absolute","value":5368814210},"count":44},{"address":{"type":"absolute","value":5368814215},"count":9},{"address":{"type":"absolute","value":5368814225},"count":31},{"address":{"type":"absolute","value":5368814230},"count":76},{"address":{"type":"absolute","value":5368814235},"count":8},{"address":{"type":"absolute","value":5368814240},"count":68},{"address":{"type":"absolute","value":5368814250},"count":33},{"address":{"type":"absolute","value":5368814255},"count":34},{"address":{"type":"absolute","value":5368814260},"count":9},{"address":{"type":"absolute","value":5368814270},"count":32},{"address":{"type":"absolute","value":5368814275},"count":8},{"address":{"type":"absolute","value":5368814290},"count":49},{"address":{"type":"absolute","value":5368814295},"count":30},{"address":{"type":"absolute","value":5368814300},"count":44},{"address":{"type":"absolute","value":5368814305},"count":41},{"address":{"type":"absolute","value":5368814310},"count":32},{"address":{"type":"absolute","value":5368814315},"count":62},{"address":{"type":"absolute","value":5368814325},"count":33},{"address":{"type":"absolute","value":5368814330},"count":30},{"address":{"type":"absolute","value":5368814335},"count":42},{"address":{"type":"absolute","value":5368814340},"count":28},{"address":{"type":"absolute","value":5368814345},"count":65},{"address":{"type":"absolute","value":5368814355},"count":9},{"address":{"type":"absolute","value":5368814360},"count":37},{"address":{"type":"absolute","value":5368814365},"count":42},{"address":{"type":"absolute","value":5368814375},"count":29},{"address":{"type":"absolute","value":5368814390},"count":35},{"address":{"type":"absolute","value":5368814400},"count":31},{"address":{"type":"absolute","value":5368814405},"count":9},{"address":{"type":"absolute","value":5368814410},"count":31},{"address":{"type":"absolute","value":5368814415},"count":19},{"address":{"type":"absolute","value":5368814425},"count":61},{"address":{"type":"absolute","value":5368814435},"count":36},{"address":{"type":"absolute","value":5368814440},"count":32},{"address":{"type":"absolute","value":5368814445},"count":46},{"address":{"type":"absolute","value":5368814450},"count":61},{"address":{"type":"absolute","value":5368814455},"count":53},{"address":{"type":"absolute","value":5368814460},"count":30},{"address":{"type":"absolute","value":5368814465},"count":33},{"address":{"type":"absolute","value":5368814470},"count":9},{"address":{"type":"absolute","value":5368814485},"count":33},{"address":{"type":"absolute","value":5368814490},"count":42},{"address":{"type":"absolute","value":5368814495},"count":10},{"address":{"type":"absolute","value":5368814500},"count":94},{"address":{"type":"absolute","value":5368814520},"count":9},{"address":{"type":"absolute","value":5368814530},"count":39},{"address":{"type":"absolute","value":5368814540},"count":49},{"address":{"type":"absolute","value":5368814545},"count":33},{"address":{"type":"absolute","value":5368814550},"count":33},{"address":{"type":"absolute","value":5368814555},"count":54},{"address":{"type":"absolute","value":5368814560},"count":27},{"address":{"type":"absolute","value":5368814585},"count":9},{"address":{"type":"absolute","value":5368814590},"count":81},{"address":{"type":"absolute","value":5368814600},"count":41},{"address":{"type":"absolute","value":5368814605},"count":50},{"address":{"type":"absolute","value":5368814615},"count":36},{"address":{"type":"absolute","value":5368814620},"count":45},{"address":{"type":"absolute","value":5368814630},"count":60},{"address":{"type":"absolute","value":5368814640},"count":61},{"address":{"type":"absolute","value":5368814645},"count":31},{"address":{"type":"absolute","value":5368814650},"count":43},{"address":{"type":"absolute","value":5368814665},"count":33},{"address":{"type":"absolute","value":5368814680},"count":28},{"address":{"type":"absolute","value":5368814685},"count":33},{"address":{"type":"absolute","value":5368814690},"count":109},{"address":{"type":"absolute","value":5368814695},"count":27},{"address":{"type":"absolute","value":5368814700},"count":42},{"address":{"type":"absolute","value":5368814705},"count":55},{"address":{"type":"absolute","value":5368814710},"count":39},{"address":{"type":"absolute","value":5368814715},"count":37},{"address":{"type":"absolute","value":5368814720},"count":32},{"address":{"type":"absolute","value":5368814725},"count":31},{"address":{"type":"absolute","value":5368814730},"count":32},{"address":{"type":"absolute","value":5368814735},"count":55},{"address":{"type":"absolute","value":5368814740},"count":30},{"address":{"type":"absolute","value":5368814745},"count":31},{"address":{"type":"absolute","value":5368814750},"count":15},{"address":{"type":"absolute","value":5368814755},"count":33},{"address":{"type":"absolute","value":5368814760},"count":9},{"address":{"type":"absolute","value":5368814765},"count":10},{"address":{"type":"absolute","value":5368814775},"count":56},{"address":{"type":"absolute","value":5368814780},"count":33},{"address":{"type":"absolute","value":5368814790},"count":38},{"address":{"type":"absolute","value":5368814795},"count":24},{"address":{"type":"absolute","value":5368814800},"count":61},{"address":{"type":"absolute","value":5368814810},"count":60},{"address":{"type":"absolute","value":5368814815},"count":30},{"address":{"type":"absolute","value":5368814820},"count":68},{"address":{"type":"absolute","value":5368814830},"count":29},{"address":{"type":"absolute","value":5368814835},"count":31},{"address":{"type":"absolute","value":5368814850},"count":42},{"address":{"type":"absolute","value":5368814855},"count":31},{"address":{"type":"absolute","value":5368814865},"count":118},{"address":{"type":"absolute","value":5368814870},"count":49},{"address":{"type":"absolute","value":5368814875},"count":43},{"address":{"type":"absolute","value":5368814880},"count":62},{"address":{"type":"absolute","value":5368814890},"count":24},{"address":{"type":"absolute","value":5368814895},"count":61},{"address":{"type":"absolute","value":5368814900},"count":22},{"address":{"type":"absolute","value":5368814905},"count":79},{"address":{"type":"absolute","value":5368814910},"count":9},{"address":{"type":"absolute","value":5368814925},"count":35},{"address":{"type":"absolute","value":5368814935},"count":73},{"address":{"type":"absolute","value":5368814940},"count":33},{"address":{"type":"absolute","value":5368814945},"count":41},{"address":{"type":"absolute","value":5368814955},"count":27},{"address":{"type":"absolute","value":5368814960},"count":28},{"address":{"type":"absolute","value":5368814965},"count":33},{"address":{"type":"absolute","value":5368814970},"count":36},{"address":{"type":"absolute","value":5368814980},"count":53},{"address":{"type":"absolute","value":5368814985},"count":31},{"address":{"type":"absolute","value":5368814990},"count":55},{"address":{"type":"absolute","value":5368814995},"count":31},{"address":{"type":"absolute","value":5368815005},"count":54},{"address":{"type":"absolute","value":5368815010},"count":33},{"address":{"type":"absolute","value":5368815025},"count":9},{"address":{"type":"absolute","value":5368815040},"count":84},{"address":{"type":"absolute","value":5368815045},"count":9},{"address":{"type":"absolute","value":5368815050},"count":73},{"address":{"type":"absolute","value":5368815055},"count":37},{"address":{"type":"absolute","value":5368815060},"count":52},{"address":{"type":"absolute","value":5368815070},"count":39},{"address":{"type":"absolute","value":5368815085},"count":39},{"address":{"type":"absolute","value":5368815090},"count":69},{"address":{"type":"absolute","value":5368815100},"count":42},{"address":{"type":"absolute","value":5368815105},"count":30},{"address":{"type":"absolute","value":5368815115},"count":53},{"address":{"type":"absolute","value":5368815125},"count":31},{"address":{"type":"absolute","value":5368815130},"count":13},{"address":{"type":"absolute","value":5368815135},"count":12},{"address":{"type":"absolute","value":5368815140},"count":16},{"address":{"type":"absolute","value":5368815145},"count":33},{"address":{"type":"absolute","value":5368815150},"count":64},{"address":{"type":"absolute","value":5368815160},"count":53},{"address":{"type":"absolute","value":5368815165},"count":62},{"address":{"type":"absolute","value":5368815170},"count":63},{"address":{"type":"absolute","value":5368815175},"count":56},{"address":{"type":"absolute","value":5368815180},"count":35},{"address":{"type":"absolute","value":5368815185},"count":30},{"address":{"type":"absolute","value":5368815190},"count":76},{"address":{"type":"absolute","value":5368815195},"count":30},{"address":{"type":"absolute","value":5368815200},"count":74},{"address":{"type":"absolute","value":5368815205},"count":31},{"address":{"type":"absolute","value":5368815210},"count":84},{"address":{"type":"absolute","value":5368815215},"count":54},{"address":{"type":"absolute","value":5368815225},"count":12},{"address":{"type":"absolute","value":5368815230},"count":87},{"address":{"type":"absolute","value":5368815240},"count":24},{"address":{"type":"absolute","value":5368815245},"count":40},{"address":{"type":"absolute","value":5368815250},"count":34},{"address":{"type":"absolute","value":5368815255},"count":32},{"address":{"type":"absolute","value":5368815260},"count":31},{"address":{"type":"absolute","value":5368815265},"count":60},{"address":{"type":"absolute","value":5368815270},"count":31},{"address":{"type":"absolute","value":5368815280},"count":38},{"address":{"type":"absolute","value":5368815290},"count":33},{"address":{"type":"absolute","value":5368815300},"count":53},{"address":{"type":"absolute","value":5368815305},"count":30},{"address":{"type":"absolute","value":5368815310},"count":33},{"address":{"type":"absolute","value":5368815315},"count":89},{"address":{"type":"absolute","value":5368815320},"count":39},{"address":{"type":"absolute","value":5368815325},"count":45},{"address":{"type":"absolute","value":5368815335},"count":35},{"address":{"type":"absolute","value":5368815340},"count":63},{"address":{"type":"absolute","value":5368815350},"count":78},{"address":{"type":"absolute","value":5368815360},"count":27},{"address":{"type":"absolute","value":5368815365},"count":39},{"address":{"type":"absolute","value":5368815370},"count":40},{"address":{"type":"absolute","value":5368815380},"count":37},{"address":{"type":"absolute","value":5368815385},"count":32},{"address":{"type":"absolute","value":5368815390},"count":36},{"address":{"type":"absolute","value":5368815400},"count":9},{"address":{"type":"absolute","value":5368815415},"count":28},{"address":{"type":"absolute","value":5368815435},"count":81},{"address":{"type":"absolute","value":5368815440},"count":52},{"address":{"type":"absolute","value":5368815450},"count":28},{"address":{"type":"absolute","value":5368815460},"count":31},{"address":{"type":"absolute","value":5368815470},"count":28},{"address":{"type":"absolute","value":5368815475},"count":32},{"address":{"type":"absolute","value":5368815480},"count":61},{"address":{"type":"absolute","value":5368815490},"count":31},{"address":{"type":"absolute","value":5368815495},"count":30},{"address":{"type":"absolute","value":5368815500},"count":43},{"address":{"type":"absolute","value":5368815505},"count":33},{"address":{"type":"absolute","value":5368815510},"count":31},{"address":{"type":"absolute","value":5368815515},"count":16},{"address":{"type":"absolute","value":5368815520},"count":33},{"address":{"type":"absolute","value":5368815525},"count":43},{"address":{"type":"absolute","value":5368815530},"count":30},{"address":{"type":"absolute","value":5368815535},"count":32},{"address":{"type":"absolute","value":5368815550},"count":38},{"address":{"type":"absolute","value":5368815555},"count":35},{"address":{"type":"absolute","value":5368815570},"count":9},{"address":{"type":"absolute","value":5368815575},"count":62},{"address":{"type":"absolute","value":5368815585},"count":44},{"address":{"type":"absolute","value":5368815590},"count":65},{"address":{"type":"absolute","value":5368815595},"count":32},{"address":{"type":"absolute","value":5368815600},"count":35},{"address":{"type":"absolute","value":5368815610},"count":56},{"address":{"type":"absolute","value":5368815615},"count":29},{"address":{"type":"absolute","value":5368815625},"count":41},{"address":{"type":"absolute","value":5368815630},"count":28},{"address":{"type":"absolute","value":5368815635},"count":35},{"address":{"type":"absolute","value":5368815640},"count":40},{"address":{"type":"absolute","value":5368815645},"count":24},{"address":{"type":"absolute","value":5368815655},"count":50},{"address":{"type":"absolute","value":5368815660},"count":29},{"address":{"type":"absolute","value":5368815670},"count":38},{"address":{"type":"absolute","value":5368815675},"count":72},{"address":{"type":"absolute","value":5368815680},"count":43},{"address":{"type":"absolute","value":5368815685},"count":22},{"address":{"type":"absolute","value":5368815690},"count":85},{"address":{"type":"absolute","value":5368815700},"count":30},{"address":{"type":"absolute","value":5368815705},"count":31},{"address":{"type":"absolute","value":5368815715},"count":82},{"address":{"type":"absolute","value":5368815720},"count":31},{"address":{"type":"absolute","value":5368815725},"count":41},{"address":{"type":"absolute","value":5368815735},"count":39},{"address":{"type":"absolute","value":5368815745},"count":31},{"address":{"type":"absolute","value":5368815755},"count":52},{"address":{"type":"absolute","value":5368815765},"count":47},{"address":{"type":"absolute","value":5368815770},"count":60},{"address":{"type":"absolute","value":5368815775},"count":38},{"address":{"type":"absolute","value":5368815780},"count":52},{"address":{"type":"absolute","value":5368815785},"count":19},{"address":{"type":"absolute","value":5368815795},"count":9},{"address":{"type":"absolute","value":5368815805},"count":134},{"address":{"type":"absolute","value":5368815820},"count":25},{"address":{"type":"absolute","value":5368815830},"count":9},{"address":{"type":"absolute","value":5368815835},"count":35},{"address":{"type":"absolute","value":5368815850},"count":28},{"address":{"type":"absolute","value":5368815855},"count":6},{"address":{"type":"absolute","value":5368815865},"count":57},{"address":{"type":"absolute","value":5368815870},"count":36},{"address":{"type":"absolute","value":5368815880},"count":39},{"address":{"type":"absolute","value":5368815890},"count":46},{"address":{"type":"absolute","value":5368815895},"count":33},{"address":{"type":"absolute","value":5368815900},"count":24},{"address":{"type":"absolute","value":5368815905},"count":43},{"address":{"type":"absolute","value":5368815910},"count":48},{"address":{"type":"absolute","value":5368815920},"count":10},{"address":{"type":"absolute","value":5368815925},"count":62},{"address":{"type":"absolute","value":5368815930},"count":40},{"address":{"type":"absolute","value":5368815940},"count":26},{"address":{"type":"absolute","value":5368815945},"count":31},{"address":{"type":"absolute","value":5368815955},"count":34},{"address":{"type":"absolute","value":5368815960},"count":59},{"address":{"type":"absolute","value":5368815965},"count":19},{"address":{"type":"absolute","value":5368815970},"count":57},{"address":{"type":"absolute","value":5368815975},"count":8},{"address":{"type":"absolute","value":5368815980},"count":45},{"address":{"type":"absolute","value":5368815985},"count":32},{"address":{"type":"absolute","value":5368815990},"count":32},{"address":{"type":"absolute","value":5368815995},"count":35},{"address":{"type":"absolute","value":5368816000},"count":39},{"address":{"type":"absolute","value":5368816005},"count":31},{"address":{"type":"absolute","value":5368816010},"count":87},{"address":{"type":"absolute","value":5368816015},"count":26},{"address":{"type":"absolute","value":5368816020},"count":33},{"address":{"type":"absolute","value":5368816025},"count":50},{"address":{"type":"absolute","value":5368816040},"count":38},{"address":{"type":"absolute","value":5368816045},"count":42},{"address":{"type":"absolute","value":5368816055},"count":32},{"address":{"type":"absolute","value":5368816060},"count":84},{"address":{"type":"absolute","value":5368816065},"count":52},{"address":{"type":"absolute","value":5368816070},"count":40},{"address":{"type":"absolute","value":5368816080},"count":43},{"address":{"type":"absolute","value":5368816085},"count":31},{"address":{"type":"absolute","value":5368816095},"count":28},{"address":{"type":"absolute","value":5368816100},"count":60},{"address":{"type":"absolute","value":5368816105},"count":55},{"address":{"type":"absolute","value":5368816110},"count":31},{"address":{"type":"absolute","value":5368816120},"count":40},{"address":{"type":"absolute","value":5368816125},"count":30},{"address":{"type":"absolute","value":5368816135},"count":19},{"address":{"type":"absolute","value":5368816145},"count":33},{"address":{"type":"absolute","value":5368816155},"count":76},{"address":{"type":"absolute","value":5368816160},"count":164},{"address":{"type":"absolute","value":5368816165},"count":107},{"address":{"type":"absolute","value":5368816170},"count":33},{"address":{"type":"absolute","value":5368816180},"count":32},{"address":{"type":"absolute","value":5368816185},"count":16},{"address":{"type":"absolute","value":5368816195},"count":38},{"address":{"type":"absolute","value":5368816205},"count":43},{"address":{"type":"absolute","value":5368816215},"count":69},{"address":{"type":"absolute","value":5368816220},"count":9},{"address":{"type":"absolute","value":5368816225},"count":36},{"address":{"type":"absolute","value":5368816230},"count":74},{"address":{"type":"absolute","value":5368816235},"count":34},{"address":{"type":"absolute","value":5368816240},"count":9},{"address":{"type":"absolute","value":5368816245},"count":114},{"address":{"type":"absolute","value":5368816250},"count":37},{"address":{"type":"absolute","value":5368816265},"count":32},{"address":{"type":"absolute","value":5368816270},"count":27},{"address":{"type":"absolute","value":5368816275},"count":29},{"address":{"type":"absolute","value":5368816280},"count":34},{"address":{"type":"absolute","value":5368816290},"count":8},{"address":{"type":"absolute","value":5368816295},"count":39},{"address":{"type":"absolute","value":5368816310},"count":54},{"address":{"type":"absolute","value":5368816320},"count":65},{"address":{"type":"absolute","value":5368816335},"count":9},{"address":{"type":"absolute","value":5368816340},"count":32},{"address":{"type":"absolute","value":5368816345},"count":31},{"address":{"type":"absolute","value":5368816355},"count":37},{"address":{"type":"absolute","value":5368816360},"count":35},{"address":{"type":"absolute","value":5368816365},"count":18},{"address":{"type":"absolute","value":5368816375},"count":24},{"address":{"type":"absolute","value":5368816380},"count":36},{"address":{"type":"absolute","value":5368816385},"count":43},{"address":{"type":"absolute","value":5368816400},"count":41},{"address":{"type":"absolute","value":5368816405},"count":33},{"address":{"type":"absolute","value":5368816415},"count":32},{"address":{"type":"absolute","value":5368816420},"count":31},{"address":{"type":"absolute","value":5368816425},"count":10},{"address":{"type":"absolute","value":5368816430},"count":9},{"address":{"type":"absolute","value":5368816445},"count":37},{"address":{"type":"absolute","value":5368816450},"count":28},{"address":{"type":"absolute","value":5368816455},"count":28},{"address":{"type":"absolute","value":5368816460},"count":66},{"address":{"type":"absolute","value":5368816465},"count":37},{"address":{"type":"absolute","value":5368816470},"count":31},{"address":{"type":"absolute","value":5368816480},"count":30},{"address":{"type":"absolute","value":5368816485},"count":32},{"address":{"type":"absolute","value":5368816490},"count":39},{"address":{"type":"absolute","value":5368816495},"count":26},{"address":{"type":"absolute","value":5368816500},"count":57},{"address":{"type":"absolute","value":5368816505},"count":29},{"address":{"type":"absolute","value":5368816510},"count":37},{"address":{"type":"absolute","value":5368816515},"count":36},{"address":{"type":"absolute","value":5368816525},"count":10},{"address":{"type":"absolute","value":5368816530},"count":31},{"address":{"type":"absolute","value":5368816540},"count":31},{"address":{"type":"absolute","value":5368816545},"count":37},{"address":{"type":"absolute","value":5368816550},"count":39},{"address":{"type":"absolute","value":5368816555},"count":30},{"address":{"type":"absolute","value":5368821600},"count":25},{"address":{"type":"absolute","value":5368821728},"count":61},{"address":{"type":"absolute","value":5368822176},"count":116},{"address":{"type":"absolute","value":5368824096},"count":61},{"address":{"type":"absolute","value":5368838672},"count":41},{"address":{"type":"absolute","value":5368882832},"count":94},{"address":{"type":"absolute","value":5368891376},"count":61},{"address":{"type":"absolute","value":5368891792},"count":59},{"address":{"type":"absolute","value":5368892096},"count":45},{"address":{"type":"absolute","value":5368892304},"count":43},{"address":{"type":"absolute","value":5368909136},"count":46},{"address":{"type":"absolute","value":5368960864},"count":60},{"address":{"type":"absolute","value":5368963056},"count":38},{"address":{"type":"absolute","value":5368964112},"count":54},{"address":{"type":"absolute","value":5368964496},"count":43},{"address":{"type":"absolute","value":5368971776},"count":30},{"address":{"type":"absolute","value":5368971888},"count":28},{"address":{"type":"absolute","value":5368986896},"count":61},{"address":{"type":"absolute","value":5368987312},"count":59},{"address":{"type":"absolute","value":5368988000},"count":45},{"address":{"type":"absolute","value":5368988208},"count":43},{"address":{"type":"absolute","value":5369037280},"count":21}]},"library_functions":[{"address":{"type":"absolute","value":5369005504},"name":"?find_pe_section@@YAPEAU_IMAGE_SECTION_HEADER@@QEAE_K@Z"},{"address":{"type":"absolute","value":5369005792},"name":"?is_potentially_valid_image_base@@YA_NQEAX@Z"},{"address":{"type":"absolute","value":5369008832},"name":"?"},{"address":{"type":"absolute","value":5369009024},"name":"?"},{"address":{"type":"absolute","value":5369009248},"name":"?pre_c_initialization@@YAHXZ"},{"address":{"type":"absolute","value":5369009472},"name":"mbedtls_des_setkey_enc"},{"address":{"type":"absolute","value":5369009504},"name":"?pre_cpp_initialization@@YAXXZ"},{"address":{"type":"absolute","value":5369009536},"name":"?__scrt_common_main@@YAHXZ"},{"address":{"type":"absolute","value":5369009568},"name":"?__scrt_common_main_seh@@YAHXZ"},{"address":{"type":"absolute","value":5369010096},"name":"?invoke_main@@YAHXZ"},{"address":{"type":"absolute","value":5369010320},"name":"?DebuggerProbe@@YA_NK@Z"},{"address":{"type":"absolute","value":5369010400},"name":"?DebuggerRuntime@@YA_NKHPEAXPEB_W@Z"},{"address":{"type":"absolute","value":5369011536},"name":"?_strlen_priv@@YA_KPEBD@Z"},{"address":{"type":"absolute","value":5369011568},"name":"?failwithmessage@@YAXPEAXHHPEBD@Z"},{"address":{"type":"absolute","value":5369012336},"name":"?notify_debugger@@YAXAEBUtagEXCEPTION_VISUALCPP_DEBUG_INFO@@@Z"},{"address":{"type":"absolute","value":5369016608},"name":"__get_entropy"},{"address":{"type":"absolute","value":5369017584},"name":"?GetPdbDll@@YAPEAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":5369018000},"name":"?GetPdbDllFromInstallPath@@YAPEAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":5369018864},"name":"?GetPdbDllPathFromFilePath@@YAHPEB_WPEA_W_K@Z"}],"apicall_count":1006,"import_count":626}},"rules":{"calculate modulo 256 via x86 assembly":{"meta":{"name":"calculate modulo 256 via x86 assembly","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"instruction"},"attack":[],"mbc":[{"parts":["Data","Modulo"],"objective":"Data","behavior":"Modulo","method":"","id":"C0058"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4049A9"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: calculate modulo 256 via x86 assembly\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: instruction\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Data::Modulo [C0058]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9\n  features:\n    #  and ecx, 800000FFh\n    #  and ecx, 0FFh\n    - and:\n      - mnemonic: and\n      - or:\n        - number: 0x800000FF\n        - number: 0xFF\n","matches":[[{"type":"absolute","value":5368911666},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":5368911666}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483903}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[{"type":"absolute","value":5368911666}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delay execution\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@ramen0x3f\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\n    examples:\n      - al-khaser_x86.exe_:0x449770\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.Sleep\n          - api: kernel32.SleepEx\n          - api: kernel32.WaitForSingleObject\n          - api: kernel32.SignalObjectAndWait\n          - api: kernel32.WaitForSingleObjectEx\n          - api: kernel32.WaitForMultipleObjects\n          - api: kernel32.WaitForMultipleObjectsEx\n          - api: kernel32.RegisterWaitForSingleObject\n          - api: WaitOnAddress\n          - api: user32.MsgWaitForMultipleObjects\n          - api: user32.MsgWaitForMultipleObjectsEx\n          - api: NtDelayExecution\n          - api: KeWaitForSingleObject\n          - api: KeDelayExecutionThread\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - or:\n          - api: sleep\n          - api: usleep\n","matches":[[{"type":"absolute","value":5368924448},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5368924554}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368952779},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368952803}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368844166},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5368844171}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914432},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5368914514}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369002064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":5369002067}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368951296},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368951317}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369000118},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5369000134}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369000497},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5369000506}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368908237},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368908249}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368908692},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368908704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369001893},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5369001903}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955764},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":5368955788}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: open process\n    authors:\n      - 0x534a@mailbox.org\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Open Process [C0065]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - or:\n      - api: kernel32.OpenProcess\n      - api: NtOpenProcess\n      - api: ZwOpenProcess\n","matches":[[{"type":"absolute","value":5368951918},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368951944}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368863684},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368863698}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368953892},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368953943}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368950804},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368950815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368993008},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368993126}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368906656},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368906713}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955014},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368955040}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate memory":{"meta":{"name":"allocate memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate memory\n    authors:\n      - 0x534a@mailbox.org\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA  # ntdll.NtAllocateVirtualMemory\n  features:\n    - or:\n      - api: kernel32.VirtualAlloc\n      - api: kernel32.VirtualAllocEx\n      - api: kernel32.VirtualAllocExNuma\n      - api: NtAllocateVirtualMemory\n      - api: ZwAllocateVirtualMemory\n      - api: NtMapViewOfSection\n      - api: ZwMapViewOfSection\n      - and:\n        - match: link function at runtime on Windows\n        - or:\n          - string: \"VirtualAlloc\"\n          - string: \"VirtualAllocEx\"\n          - string: \"VirtualAllocExNuma\"\n          - string: \"NtAllocateVirtualMemory\"\n          - string: \"ZwAllocateVirtualMemory\"\n          - string: \"NtMapViewOfSection\"\n          - string: \"ZwMapViewOfSection\"\n","matches":[[{"type":"absolute","value":5368952263},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368952388}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368953985},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368954085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368911264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911349}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368911394},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911413}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368839184},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368839314}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368950968},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910688},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910773}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910818},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368838128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368838196}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909660}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909711},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909730}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368841536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368841679}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912405}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912450},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912469}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955356},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368955481}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RW memory":{"meta":{"name":"allocate or change RW memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate or change RW memory\n    authors:\n      - 0x534a@mailbox.org\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - and:\n      - or:\n        - match: allocate memory\n        - match: change memory protection\n      - or:\n        - number: 0x4 = PAGE_READWRITE\n        # lea     r9d, [rcx+4]  ; flProtect\n        # call    cs:VirtualAlloc\n        - instruction:\n          - mnemonic: lea\n          - offset: 0x4 = PAGE_READWRITE\n","matches":[[{"type":"absolute","value":5368952263},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368952388}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368952263}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368952361}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368953985},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368954085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368953985}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368954055}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368911264},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911349}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911264}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368911330}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368950968},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368951069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910688},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910773}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368910688}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368910754}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910818},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368910837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368910818}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368910818}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368838128},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368838196}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368838128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368838177}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909660}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368909568}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368909641}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368909711},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368909730}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368909711}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368909711}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368841536},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368841679}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368841536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368841634},{"type":"absolute","value":5368841663}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368913856},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":5368913965}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368913856}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368913950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912320},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912405}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368912320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368912386}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912450},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368912469}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368912450}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368912450}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368955356},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368955481}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368955356}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368955454}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Program Files directory":{"meta":{"name":"get Program Files directory","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[],"references":[],"examples":["BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get Program Files directory\n    namespace: host-interaction/file-system\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    examples:\n      - BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880\n  features:\n    - and:\n      - or:\n        - number: 0x26 = CSIDL_PROGRAM_FILES\n        - number: 0x2A = CSIDL_PROGRAM_FILESX86\n      - or:\n        - api: shell32.SHGetFolderPath\n        - api: shell32.SHGetFolderLocation\n        - api: shell32.SHGetSpecialFolderPath\n        - api: shell32.SHGetSpecialFolderLocation\n","matches":[[{"type":"absolute","value":5368935773},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":5368935776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368935788}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368945965},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":5368945968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368945980}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open registry key\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Operating System::Registry::Create Registry Key [C0036.004]\n      - Operating System::Registry::Open Registry Key [C0036.003]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\n      - 493167E85E45363D09495D0841C30648:0x404D60\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: advapi32.RegOpenKey\n      - api: advapi32.RegOpenKeyEx\n      - api: advapi32.RegCreateKey\n      - api: advapi32.RegCreateKeyEx\n      - api: advapi32.RegOpenCurrentUser\n      - api: advapi32.RegOpenKeyTransacted\n      - api: advapi32.RegOpenUserClassesRoot\n      - api: advapi32.RegCreateKeyTransacted\n      - api: ZwOpenKey\n      - api: ZwOpenKeyEx\n      - api: ZwCreateKey\n      - api: ZwOpenKeyTransacted\n      - api: ZwOpenKeyTransactedEx\n      - api: ZwCreateKeyTransacted\n      - api: NtOpenKey\n      - api: NtCreateKey\n      - api: SHRegOpenUSKey\n      - api: SHRegCreateUSKey\n      - api: RtlCreateRegistryKey\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\n","matches":[[{"type":"absolute","value":5368984512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":5368984654}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368984784},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":5368984936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process image filename":{"meta":{"name":"get process image filename","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\nrule:\n  meta:\n    name: get process image filename\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.K32GetProcessImageFileName\n          - api: kernel32.GetProcessImageFileName\n      - and:\n        - api: System.Diagnostics.Process::GetCurrentProcess\n        - property/read: System.Diagnostics.Process::MainModule\n        - property/read: System.Diagnostics.ProcessModule::FileName\n","matches":[[{"type":"absolute","value":5368863767},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5368863804}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368881759},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5368881799}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815130},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5368815130}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5369002823},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":5369002823}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open thread":{"meta":{"name":"open thread","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Thread"],"objective":"Process","behavior":"Open Thread","method":"","id":"C0066"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: open thread\n    authors:\n      - 0x534a@mailbox.org\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Open Thread [C0066]\n    examples:\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C\n  features:\n    - or:\n      - api: kernel32.OpenThread\n      - api: NtOpenThread\n      - api: ZwOpenThread\n","matches":[[{"type":"absolute","value":5368954290},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":5368954304}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368978428},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":5368978439}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Explorer PID":{"meta":{"name":"get Explorer PID","namespace":"host-interaction/process/list","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp"],"examples":["al-khaser_x86.exe_:0x425210"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get Explorer PID\n    namespace: host-interaction/process/list\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp\n    examples:\n      - al-khaser_x86.exe_:0x425210\n  features:\n    - and:\n      - api: GetShellWindow\n      - api: GetWindowThreadProcessId\n","matches":[[{"type":"absolute","value":5368857936},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetShellWindow"}},"children":[],"locations":[{"type":"absolute","value":5368858002}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowThreadProcessId"}},"children":[],"locations":[{"type":"absolute","value":5368858015}],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RWX memory":{"meta":{"name":"allocate or change RWX memory","namespace":"host-interaction/process/inject","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate or change RWX memory\n    namespace: host-interaction/process/inject\n    authors:\n      - \"@mr-tz\"\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n      # ntdll\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\n  features:\n    - and:\n      - or:\n        - match: allocate memory\n        - match: change memory protection\n      - or:\n        - number: 0x40 = PAGE_EXECUTE_READWRITE\n        # lea     r9d, [rcx+40h]  ; flProtect\n        # call    cs:VirtualAlloc\n        - instruction:\n          - mnemonic: lea\n          - offset: 0x40 = PAGE_EXECUTE_READWRITE\n","matches":[[{"type":"absolute","value":5368911394},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911413}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368839184},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368839314}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368839184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368839298}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for OutputDebugString error":{"meta":{"name":"check for OutputDebugString error","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","OutputDebugString"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"OutputDebugString","id":"B0001.016"}],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_:0x401020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for OutputDebugString error\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]\n    examples:\n      - Practical Malware Analysis Lab 16-02.exe_:0x401020\n  features:\n    - and:\n      - api: kernel32.SetLastError\n      - api: kernel32.GetLastError\n      - api: kernel32.OutputDebugString\n","matches":[[{"type":"absolute","value":5368844868},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetLastError"}},"children":[],"locations":[{"type":"absolute","value":5368844871}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[{"type":"absolute","value":5368844890}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368844884}],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open file\n    authors:\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Create File [C0016]\n    examples:\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\n  features:\n    - or:\n      - api: CreateFile\n      - api: CreateFileEx\n      - api: IoCreateFile\n      - api: IoCreateFileEx\n      - api: ZwOpenFile\n      - api: ZwCreateFile\n      - api: NtOpenFile\n      - api: NtCreateFile\n      - api: LZCreateFile\n      - api: LZOpenFile\n      - api: fopen\n      - api: fopen64\n      - api: fdopen\n      - api: freopen\n      - api: open\n      - api: openat\n","matches":[[{"type":"absolute","value":5368945480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368945528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368935273},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368935321}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368919549},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368919649}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368919951},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368919997}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368920205},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":5368920251}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"PEB access":{"meta":{"name":"PEB access","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block","id":"B0001.019"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp"],"examples":["al-khaser_x86.exe_:0x420D20"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: PEB access\n    authors:\n      - michael.hunhoff@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp\n    examples:\n      - al-khaser_x86.exe_:0x420D20\n  features:\n    - or:\n      - characteristic: peb access\n      - and:\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41\n        - arch: i386\n        - characteristic: fs access\n        - or:\n          # in 0f5d5d07c6533bc6d991836ce79daaa1\n          # then we have:\n          #\n          #     xor edx, edx\n          #     mov edx, fs:[edx+30h]\n          - offset: 0x30\n          - instruction:\n            # in the case of CallObfuscator, gs:[rax]\n            - mnemonic: add\n            - number: 0x30\n      - and:\n        - arch: amd64\n        - characteristic: gs access\n        - or:\n          - offset: 0x60\n          - instruction:\n            - mnemonic: add\n            - number: 0x60\n      - and:\n        # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45\n        - characteristic: fs access\n        - instruction:\n          - mnemonic: sub\n          - number: 0x2000\n","matches":[[{"type":"absolute","value":5368914304},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858838},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858534},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368840336},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368921024},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368921171}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368921171}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368837568},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file attributes":{"meta":{"name":"get file attributes","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Get File Attributes"],"objective":"File System","behavior":"Get File Attributes","method":"","id":"C0049"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x180019824","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get file attributes\n    namespace: host-interaction/file-system/meta\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Get File Attributes [C0049]\n    examples:\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x180019824\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0\n  features:\n    - or:\n      - api: kernel32.GetFileAttributes\n      - api: ZwQueryDirectoryFile\n      - api: ZwQueryInformationFile\n      - api: NtQueryDirectoryFile\n      - api: NtQueryInformationFile\n      - api: System.IO.File::GetAttributes\n      - api: System.IO.File::GetCreationTime\n      - api: System.IO.File::GetCreationTimeUtc\n      - api: System.IO.File::GetLastAccessTime\n      - api: System.IO.File::GetLastAccessTimeUtc\n      - api: System.IO.File::GetLastWriteTime\n      - api: System.IO.File::GetLastWriteTimeUtc\n      - property/read: System.IO.FileSystemInfo::Attributes\n      - api: stat\n      - api: fstat\n      - api: lstat\n      - api: fstatat\n","matches":[[{"type":"absolute","value":5368997776},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368997936},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997997}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for trap flag exception":{"meta":{"name":"check for trap flag exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp"],"examples":["al-khaser_x86.exe_:0x431680","al-khaser_x64.exe_:0x140030CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for trap flag exception\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp\n    examples:\n      - al-khaser_x86.exe_:0x431680\n      - al-khaser_x64.exe_:0x140030CB0\n  features:\n    - and:\n      - or:\n        - description: read/write EFLAGS register\n        - and:\n          - mnemonic: pushf\n          - mnemonic: popf\n        - and:\n          - mnemonic: pushfd\n          - mnemonic: popfd\n        - and:\n          - mnemonic: pushfq\n          - mnemonic: popfq\n      - or:\n        - description: set trap flag\n        - instruction:\n          - mnemonic: or\n          - number: 0x100\n        - instruction:\n          - mnemonic: bts\n          - number: 0x8\n","matches":[[{"type":"absolute","value":5368908976},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"set trap flag"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for trap flag exception/d10b8f842cb04627a48005aec6f4ab43"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"bts"}},"children":[],"locations":[{"type":"absolute","value":5368909061}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8}},"children":[],"locations":[{"type":"absolute","value":5368909061}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368909061}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"read/write EFLAGS register"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushf"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popf"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfd"}},"children":[],"locations":[{"type":"absolute","value":5368909050}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfd"}},"children":[],"locations":[{"type":"absolute","value":5368909075}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfq"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfq"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"change memory protection":{"meta":{"name":"change memory protection","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Change Memory Protection"],"objective":"Memory","behavior":"Change Memory Protection","method":"","id":"C0008"}],"references":[],"examples":["Practical Malware Analysis Lab 11-02.dll_:0x10001203"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: change memory protection\n    authors:\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Change Memory Protection [C0008]\n    examples:\n      - Practical Malware Analysis Lab 11-02.dll_:0x10001203\n  features:\n    - or:\n      - api: kernel32.VirtualProtect\n      - api: kernel32.VirtualProtectEx\n      - api: NtProtectVirtualMemory\n      - api: ZwProtectVirtualMemory\n      - and:\n        - match: link function at runtime on Windows\n        - or:\n          - string: \"VirtualProtect\"\n          - string: \"VirtualProtectEx\"\n          - string: \"NtProtectVirtualMemory\"\n          - string: \"ZwProtectVirtualMemory\"\n","matches":[[{"type":"absolute","value":5368839341},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":5368839386}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368913856},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":5368913965}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create thread\n    namespace: host-interaction/thread/create\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Create Thread [C0038]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.CreateThread\n          - api: _beginthread\n          - api: _beginthreadex\n          - api: PsCreateSystemThread\n          - api: SHCreateThread\n          - api: SHCreateThreadWithHandle\n          - api: kernel32.CreateRemoteThread\n          - api: kernel32.CreateRemoteThreadEx\n          - api: RtlCreateUserThread\n          - api: ntdll.NtCreateThread\n          - api: ntdll.NtCreateThreadEx\n          - api: ntdll.ZwCreateThread\n          - api: ntdll.ZwCreateThreadEx\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - api: pthread_create\n      - and:\n        - api: System.Threading.Thread::Start\n        - optional:\n          - api: System.Threading.Thread::ctor\n","matches":[[{"type":"absolute","value":5368951220},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":5368951265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368908512},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[{"type":"absolute","value":5368908592}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unexpected memory writes":{"meta":{"name":"check for unexpected memory writes","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Memory Write Watching"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Memory Write Watching","id":"B0001.010"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp"],"examples":["al-khaser_x86.exe_:0x431EBC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for unexpected memory writes\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp\n    examples:\n      - al-khaser_x86.exe_:0x431EBC\n  features:\n    - and:\n      - api: kernel32.GetWriteWatch\n      - number: 0x0\n","matches":[[{"type":"absolute","value":5368910906},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":5368910974}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":5368910911}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368910144},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":5368910180}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":5368910156}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368912538},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":5368912608}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":5368912549}],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap force flags":{"meta":{"name":"get process heap force flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get process heap force flags\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14\n    examples:\n      - al-khaser_x86.exe_:0x425470\n  features:\n    - and:\n      - match: PEB access\n      - or:\n        - and:\n          - arch: i386\n          - number: 0x18 = PEB->ProcessHeap\n          - or:\n            - number: 0x44 = ProcessHeap->ForceFlags >= Vista\n            - number: 0x10 = ProcessHeap->ForceFlags < Vista\n        - and:\n          - arch: amd64\n          - number: 0x30 = PEB->ProcessHeap\n          - or:\n            - number: 0x74 = ProcessHeap->ForceFlags >= Vista\n            - number: 0x18 = ProcessHeap->ForceFlags < Vista\n","matches":[[{"type":"absolute","value":5368858838},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858847}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858838}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858847}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858862}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"access PEB ldr_data":{"meta":{"name":"access PEB ldr_data","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm","https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8"],"examples":["3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: access PEB ldr_data\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    references:\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm\n      - https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8\n    examples:\n      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7\n  features:\n    - or:\n      - and:\n        - arch: i386\n        - description: x32\n\n        - match: PEB access\n\n        # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0\n        # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives\n\n        - offset: 0x0C = PEB.LDR_DATA\n\n        - or:\n          - description: resolve a module list\n          - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList\n          - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList\n          - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList\n\n      - and:\n        - arch: amd64\n        - description: x64\n\n        - match: PEB access\n\n        - offset: 0x18 = PEB.LDR_DATA\n\n        - or:\n          - description: resolve a module list\n          - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList\n          - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList\n          - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList\n","matches":[[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914080},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368914151}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914090}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get kernel32 base address":{"meta":{"name":"get kernel32 base address","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm"],"examples":["67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x406936"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get kernel32 base address\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    references:\n      - https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm\n    examples:\n      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x406936\n  features:\n    - and:\n      # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink\n      - match: access PEB ldr_data\n      # -> current module -> ntdll\n      - count(offset(0)): 2\n      # -> kernel32 -> LDR_DATA_TABLE_ENTRY.DllBase\n      - or:\n        - and:\n          - arch: i386\n          - offset: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase\n        - and:\n          - arch: amd64\n          - offset: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase\n","matches":[[{"type":"absolute","value":5368858872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858872}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":2,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":5368858872},{"type":"absolute","value":5368858893}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368858896}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368858881}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368914080},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914122}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":5368914151}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914090}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914080}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":2,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":5368914241},{"type":"absolute","value":5368914122}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368914151}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":5368914227}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via IOCTL":{"meta":{"name":"interact with driver via IOCTL","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x40108c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: interact with driver via IOCTL\n    namespace: host-interaction/driver\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    examples:\n      - Practical Malware Analysis Lab 10-03.exe_:0x40108c\n  features:\n    - or:\n      - api: DeviceIoControl\n","matches":[[{"type":"absolute","value":5368919737},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368919808}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368920014},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920064}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368920268},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920318}],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap flags":{"meta":{"name":"get process heap flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get process heap flags\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13\n    examples:\n      - al-khaser_x86.exe_:0x425470\n  features:\n    - and:\n      - match: PEB access\n      - or:\n        - and:\n          - arch: i386\n          - number: 0x18 = PEB->ProcessHeap\n          - or:\n            - number: 0x40 = ProcessHeap->HeapFlags >= Vista\n            - number: 0xC = ProcessHeap->HeapFlags < Vista\n        - and:\n          - arch: amd64\n          - number: 0x30 = PEB->ProcessHeap\n          - or:\n            - number: 0x70 = ProcessHeap->HeapFlags >= Vista\n            - number: 0x14 = ProcessHeap->HeapFlags < Vista\n","matches":[[{"type":"absolute","value":5368858534},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858543}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858534}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858543}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858558}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368858568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858577}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368858568}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":5368858577}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":5368858592}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"acquire debug privileges":{"meta":{"name":"acquire debug privileges","namespace":"host-interaction/process/modify","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x401174"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: acquire debug privileges\n    namespace: host-interaction/process/modify\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    att&ck:\n      - Privilege Escalation::Access Token Manipulation [T1134]\n    examples:\n      - Practical Malware Analysis Lab 01-04.exe_:0x401174\n  features:\n    - and:\n      - string: \"SeDebugPrivilege\"\n      - optional:\n        - match: modify access privileges\n","matches":[[{"type":"absolute","value":5368985322},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"SeDebugPrivilege"}},"children":[],"locations":[{"type":"absolute","value":5368985363}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"modify access privileges"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB BeingDebugged flag":{"meta":{"name":"check for PEB BeingDebugged flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block BeingDebugged"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block BeingDebugged","id":"B0001.035"}],"references":["Practical Malware Analysis, Chapter 16, p. 353"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for PEB BeingDebugged flag\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035]\n    references:\n      - Practical Malware Analysis, Chapter 16, p. 353\n    examples:\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\n  features:\n    - and:\n      - match: PEB access\n      - offset: 2 = PEB.BeingDebugged\n","matches":[[{"type":"absolute","value":5368837568},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368837610}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368837568}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":2,"description":"PEB.BeingDebugged"}},"children":[],"locations":[{"type":"absolute","value":5368837627}],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain loop\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    examples:\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - characteristic: loop\n      - characteristic: tight loop\n      - characteristic: recursive call\n","matches":[[{"type":"absolute","value":5368811525},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811525}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811540},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":5369005249}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811565},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811565}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811670}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811675}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811695},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811695}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811765},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811770},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811805},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811805}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811810}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811875}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368811990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812020},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812100},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812100}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812140}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812285},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812285}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812340}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812395}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812670}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812845},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812845}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812875}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812935}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813155},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813155}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813175},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813195}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813200}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813235},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813235}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813275},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813275}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813285},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813285}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813335},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813335}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813395}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813420},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813420}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813445}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813465},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813465}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813600},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813600}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813665},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813665}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813670}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813680}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813700},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813700}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813705}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813710},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813710}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813770},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813895},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813895}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368813990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814135},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814135}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814180},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814180}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814240}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814300},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814455},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814455}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814640}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814735},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814735}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814800},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814820},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814820}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814865},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814865}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814895},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814895}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814935}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815040}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815090},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815090}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815170},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815170}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815190},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815190}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815210},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815210}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815340}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815350},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815350}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815435},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815435}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815440}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815655},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815655}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815675}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815690},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815690}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815715}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815890},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815890}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815960}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368815970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816010},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816010}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816060}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816100},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816100}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816105},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816105}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816165},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816165}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816215},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816215}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816230}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816445}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368816500}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368882832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368882832}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368891376},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368891376}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368891792},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368891792}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368960864},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368960864}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368986896},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368986896}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368987312},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368987312}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: link function at runtime on Windows\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\n  features:\n    - and:\n      - os: windows\n      - or:\n        - api: kernel32.GetProcAddress\n        - api: ntdll.LdrGetProcedureAddress\n      - optional:\n        - characteristic: indirect call\n        - api: kernel32.LoadLibrary\n        - api: kernel32.GetModuleHandle\n        - api: kernel32.GetModuleHandleEx\n        - api: ntdll.LdrLoadDll\n","matches":[[{"type":"absolute","value":5368811525},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368840106}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811715},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368952128},{"type":"absolute","value":5368952218},{"type":"absolute","value":5368952092}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368952738},{"type":"absolute","value":5368952701}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368952036},{"type":"absolute","value":5368951990}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812020},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5369019487}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368953850}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368953782}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813155},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368958816}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":5368958750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813180},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368949789}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368949745}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368950923}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368950861}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816245},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368955221},{"type":"absolute","value":5368955133},{"type":"absolute","value":5368955311}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368955723},{"type":"absolute","value":5368955686}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368955153},{"type":"absolute","value":5368955083}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368956489}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":5368956421}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unmoving mouse cursor":{"meta":{"name":"check for unmoving mouse cursor","namespace":"anti-analysis/anti-vm/vm-detection","authors":["BitsOfBinary"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","User Activity Based Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"User Activity Based Checks","id":"T1497.002"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection","Human User Check"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"Human User Check","id":"B0009.012"}],"references":["https://www.joesecurity.org/blog/5852460122427342172"],"examples":["d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for unmoving mouse cursor\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - BitsOfBinary\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check [B0009.012]\n    references:\n      - https://www.joesecurity.org/blog/5852460122427342172\n    examples:\n      - d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118\n  features:\n    - and:\n      - count(api(user32.GetCursorPos)): 2 or more\n","matches":[[{"type":"absolute","value":5368811655},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetCursorPos"}}},"children":[],"locations":[{"type":"absolute","value":5368924564},{"type":"absolute","value":5368924543}],"captures":{}}],"locations":[],"captures":{}}]]},"reference WMI statements":{"meta":{"name":"reference WMI statements","namespace":"collection/database/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Data from Information Repositories"],"tactic":"Collection","technique":"Data from Information Repositories","subtechnique":"","id":"T1213"}],"mbc":[],"references":[],"examples":["al-khaser_x86.exe_:0x433490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference WMI statements\n    namespace: collection/database/wmi\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Data from Information Repositories [T1213]\n    examples:\n      - al-khaser_x86.exe_:0x433490\n  features:\n    - or:\n      - string: /SELECT\\s+\\*\\s+FROM\\s+CIM_./\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_./\n      - string: /SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./\n","matches":[[{"type":"absolute","value":5368811695},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368941125}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":5368941125}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811755},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915850}],"captures":{"SELECT * FROM CIM_Sensor":[{"type":"absolute","value":5368915850}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368939285}],"captures":{"SELECT * FROM Win32_NetworkAdapterConfiguration":[{"type":"absolute","value":5368939285}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368811875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368922549}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":5368922549}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812110},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368925402}],"captures":{"SELECT * FROM Win32_PerfFormattedData_Counters_ThermalZoneInformation":[{"type":"absolute","value":5368925402}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368936139}],"captures":{"SELECT * FROM Win32_NTEventlogFile":[{"type":"absolute","value":5368936139}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812330},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915738}],"captures":{"SELECT * FROM CIM_PhysicalConnector":[{"type":"absolute","value":5368915738}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812485},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368925626}],"captures":{"SELECT * FROM Win32_PortConnector":[{"type":"absolute","value":5368925626}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812615},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368928522}],"captures":{"SELECT * FROM Win32_SMBIOSMemory":[{"type":"absolute","value":5368928522}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812670},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368926085}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":5368926085}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915626}],"captures":{"SELECT * FROM CIM_NumericSensor":[{"type":"absolute","value":5368915626}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813040},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368914666}],"captures":{"SELECT * FROM Win32_CacheMemory":[{"type":"absolute","value":5368914666}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368940229}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":5368940229}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813395},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368941797}],"captures":{"SELECT * FROM Win32_PnPDevice":[{"type":"absolute","value":5368941797}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813445},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368923813}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":5368923813}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813505},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915514}],"captures":{"SELECT * FROM CIM_Memory":[{"type":"absolute","value":5368915514}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813695},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368923610}],"captures":{"SELECT * FROM Win32_MemoryDevice":[{"type":"absolute","value":5368923610}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368927061}],"captures":{"SELECT * FROM Win32_BIOS":[{"type":"absolute","value":5368927061}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813820},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368925514}],"captures":{"SELECT * FROM Win32_PhysicalMemory":[{"type":"absolute","value":5368925514}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814240},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368918694}],"captures":{"SELECT * FROM Win32_LogicalDisk":[{"type":"absolute","value":5368918694}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814435},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368923498}],"captures":{"SELECT * FROM Win32_MemoryArray":[{"type":"absolute","value":5368923498}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814455},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368916399}],"captures":{"SELECT * FROM Win32_Fan":[{"type":"absolute","value":5368916399}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368915962}],"captures":{"SELECT * FROM CIM_Slot":[{"type":"absolute","value":5368915962}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815090},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368934293}],"captures":{"SELECT * FROM Win32_Bus":[{"type":"absolute","value":5368934293}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815340},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368924837}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":5368924837}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815870},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368916186}],"captures":{"SELECT * FROM CIM_VoltageSensor":[{"type":"absolute","value":5368916186}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816215},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368933334}],"captures":{"SELECT * FROM Win32_BaseBoard":[{"type":"absolute","value":5368933334}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816225},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":5368928810}],"captures":{"SELECT * FROM Win32_VoltageProbe":[{"type":"absolute","value":5368928810}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[{"type":"absolute","value":5368917781}],"captures":{"SELECT * FROM MSAcpi_ThermalZoneTemperature":[{"type":"absolute","value":5368917781}]}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816515},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":5368916074}],"captures":{"SELECT * FROM CIM_TemperatureSensor":[{"type":"absolute","value":5368916074}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write process memory":{"meta":{"name":"write process memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Process Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"","id":"T1055"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: write process memory\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Defense Evasion::Process Injection [T1055]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\n  features:\n    - or:\n      - api: kernel32.WriteProcessMemory\n      - api: ntdll.NtWriteVirtualMemory\n      - api: ntdll.ZwWriteVirtualMemory\n      - api: NtWow64WriteVirtualMemory64\n","matches":[[{"type":"absolute","value":5368811715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368952486}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368954178}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368951194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816245},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368955579}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query environment variable":{"meta":{"name":"query environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com","@_re_fox"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x401880","0761142efbda6c4b1e801223de723578:0x65483490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query environment variable\n    namespace: host-interaction/environment-variable\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@_re_fox\"\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - Practical Malware Analysis Lab 14-02.exe_:0x401880\n      - 0761142efbda6c4b1e801223de723578:0x65483490\n  features:\n    - or:\n      - api: kernel32.GetEnvironmentVariable\n      - api: kernel32.GetEnvironmentStrings\n      - api: kernel32.ExpandEnvironmentStrings\n      - api: msvcr90.getenv\n      - api: msvcrt.getenv\n      - api: System.Environment::GetEnvironmentVariable\n      - api: System.Environment::GetEnvironmentVariables\n      - api: System.Environment::ExpandEnvironmentVariables\n","matches":[[{"type":"absolute","value":5368811740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":5368935765}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":5368909873}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":5368881871}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816310},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":5368945957}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get common file path\n    namespace: host-interaction/file-system\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\n      - 972B219F18379907A045431303F4DA7D:0x404887\n  features:\n    - or:\n      - api: kernel32.GetTempPath\n      - api: kernel32.GetTempFileName\n      - api: kernel32.GetSystemDirectory\n      - api: kernel32.GetWindowsDirectory\n      - api: kernel32.GetSystemWow64Directory\n      - api: GetAllUsersProfileDirectory\n      - api: GetAppContainerFolderPath\n      - api: GetCurrentDirectory\n      - api: GetDefaultUserProfileDirectory\n      - api: GetProfilesDirectory\n      - api: GetUserProfileDirectory\n      - api: SHGetFolderPathAndSubDir\n      - api: shell32.SHGetFolderPath\n      - api: shell32.SHGetFolderLocation\n      - api: shell32.SHGetKnownFolderPath\n      - api: shell32.SHGetSpecialFolderPath\n      - api: shell32.SHGetSpecialFolderLocation\n      - api: System.IO.Directory::GetCurrentDirectory\n      - api: System.Environment::GetFolderPath\n      - property/read: System.Environment::SystemDirectory\n      - property/read: System.Environment::CurrentDirectory\n","matches":[[{"type":"absolute","value":5368811740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368935788}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":5368937556}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[{"type":"absolute","value":5368881771}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":5368946447}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816310},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":5368945980}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"print debug messages":{"meta":{"name":"print debug messages","namespace":"host-interaction/log/debug/write-event","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: print debug messages\n    namespace: host-interaction/log/debug/write-event\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x401000\n  features:\n    - or:\n      - api: DbgPrint\n      - api: kernel32.OutputDebugString\n","matches":[[{"type":"absolute","value":5368811805},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368851717},{"type":"absolute","value":5368851655},{"type":"absolute","value":5368851977},{"type":"absolute","value":5368851692},{"type":"absolute","value":5368851437},{"type":"absolute","value":5368851533},{"type":"absolute","value":5368852050},{"type":"absolute","value":5368851955},{"type":"absolute","value":5368851606},{"type":"absolute","value":5368851511},{"type":"absolute","value":5368851735},{"type":"absolute","value":5368851901}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812430},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368844884}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368908061}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814640},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368908349},{"type":"absolute","value":5368908277},{"type":"absolute","value":5368908316},{"type":"absolute","value":5368908301},{"type":"absolute","value":5368908364},{"type":"absolute","value":5368908221}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814935},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368908610},{"type":"absolute","value":5368908771},{"type":"absolute","value":5368908756},{"type":"absolute","value":5368908676},{"type":"absolute","value":5368908804},{"type":"absolute","value":5368908819},{"type":"absolute","value":5368908732}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368814990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":5368907858},{"type":"absolute","value":5368907903}],"captures":{}}],"locations":[],"captures":{}}]]},"get system information on Windows":{"meta":{"name":"get system information on Windows","namespace":"host-interaction/os/info","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get system information on Windows\n    namespace: host-interaction/os/info\n    authors:\n      - moritz.raabe@mandiant.com\n      - joakim@intezer.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    examples:\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280\n  features:\n    - and:\n      - os: windows\n      - or:\n        - api: kernel32.GetSystemInfo\n        - api: kernel32.GetNativeSystemInfo\n        - api: NtQuerySystemInformation\n        - api: NtQuerySystemInformationEx\n        - api: ntdll.RtlGetNativeSystemInformation\n        - api: ZwQuerySystemInformation\n        - api: ZwQuerySystemInformationEx\n","matches":[[{"type":"absolute","value":5368811805},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368851199}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812035},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368852431}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813635},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368839289}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816160},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":5368978878}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"parse PE header":{"meta":{"name":"parse PE header","namespace":"load-code/pe","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403DD0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: parse PE header\n    namespace: load-code/pe\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic, operand[1].offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0\n  features:\n    - and:\n      - os: windows\n      - and:\n        - mnemonic: cmp\n        - or:\n          - number: 0x4550 = IMAGE_NT_SIGNATURE (PE)\n          - and:\n            - number: 0x50\n            - number: 0x45\n        - or:\n          - number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ)\n          - and:\n            - number: 0x4D\n            - number: 0x5A\n        - optional:\n          - and:\n            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n            - or:\n              - and:\n                - arch: i386\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\n                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n              - and:\n                - arch: amd64\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\n                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase\n          - basic block:\n            - and:\n              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n              - 3 or more:\n                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine\n                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\n                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\n                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics\n                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit\n                - or:\n                  - and:\n                    - arch: i386\n                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\n                  - and:\n                    - arch: amd64\n                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\n","matches":[[{"type":"absolute","value":5368812020},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5369019394},{"type":"absolute","value":5369019331},{"type":"absolute","value":5369019427},{"type":"absolute","value":5369019386},{"type":"absolute","value":5369019813},{"type":"absolute","value":5369019972},{"type":"absolute","value":5369019966},{"type":"absolute","value":5369019402},{"type":"absolute","value":5369019307},{"type":"absolute","value":5369019820},{"type":"absolute","value":5369019979},{"type":"absolute","value":5369019407},{"type":"absolute","value":5369019952},{"type":"absolute","value":5369019572},{"type":"absolute","value":5369019418},{"type":"absolute","value":5369019806}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":5369019331}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":5369019302}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":5369019316}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[{"type":"absolute","value":5369019254}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/303ac304a9954095b738a84377f00288"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815575},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5369016033},{"type":"absolute","value":5369016097},{"type":"absolute","value":5369016161},{"type":"absolute","value":5369016118},{"type":"absolute","value":5369016134},{"type":"absolute","value":5369016056}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":5369016097}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":5369016056}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":5369016072}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/303ac304a9954095b738a84377f00288"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for debugger via API":{"meta":{"name":"check for debugger via API","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","CheckRemoteDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"CheckRemoteDebuggerPresent","id":"B0001.002"},{"parts":["Anti-Behavioral Analysis","Debugger Detection","WudfIsAnyDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"WudfIsAnyDebuggerPresent","id":"B0001.031"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp"],"examples":["al-khaser_x86.exe_:0x420000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for debugger via API\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]\n      - Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp\n    examples:\n      - al-khaser_x86.exe_:0x420000\n  features:\n    - or:\n      # We're not including kernel32.IsDebuggerPresent here because some exception handlers and other compiler-inserted\n      # code may add calls to it, especially in debug builds. So, likely even with pretty good library code detection\n      # this feature could result in many false positives.\n      - api: kernel32.CheckRemoteDebuggerPresent\n      - api: WUDFPlatform.WudfIsAnyDebuggerPresent\n      - api: WUDFPlatform.WudfIsKernelDebuggerPresent\n      - api: WUDFPlatform.WudfIsUserDebuggerPresent\n      - property/read: System.Diagnostics.Debugger::IsAttached\n      - api: System.Diagnostics.Debugger::IsLogging\n","matches":[[{"type":"absolute","value":5368812145},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CheckRemoteDebuggerPresent"}},"children":[],"locations":[{"type":"absolute","value":5368837791}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsAnyDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsKernelDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsUserDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Debugger::IsAttached"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Debugger::IsLogging"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check process job object":{"meta":{"name":"check process job object","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp"],"examples":["al-khaser_x86.exe_:0x426730"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check process job object\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp\n    examples:\n      - al-khaser_x86.exe_:0x426730\n  features:\n    - or:\n      # static\n      - and:\n        - match: contain loop\n        - basic block:\n          - and:\n            - api: kernel32.QueryInformationJobObject\n            - number: 0x3 = JobObjectBasicProcessIdList\n        - basic block:\n          - and:\n            - api: kernel32.OpenProcess\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\n      # dynamic\n      - and:\n        - call:\n          - and:\n            - api: kernel32.QueryInformationJobObject\n            - number: 0x3 = JobObjectBasicProcessIdList\n        - call:\n          - and:\n            - api: kernel32.OpenProcess\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\n","matches":[[{"type":"absolute","value":5368812150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/ef039a5cc5fe470ab1c126effdb7381f"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/8d7f5c8766744f6eaad05594c6d5193c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368812150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368812150}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryInformationJobObject"}},"children":[],"locations":[{"type":"absolute","value":5368863567}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"JobObjectBasicProcessIdList"}},"children":[],"locations":[{"type":"absolute","value":5368863560}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368863518}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368863698}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1024,"description":"PROCESS_QUERY_INFORMATION"}},"children":[],"locations":[{"type":"absolute","value":5368863693}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368863684}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute anti-debugging instructions":{"meta":{"name":"execute anti-debugging instructions","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Anti-debugging Instructions"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Anti-debugging Instructions","id":"B0001.034"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x401300"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: execute anti-debugging instructions\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]\n    examples:\n      - Practical Malware Analysis Lab 16-03.exe_:0x401300\n  features:\n    - or:\n      - count(mnemonic(rdtsc)): 2 or more\n      - mnemonic: icebp\n","matches":[[{"type":"absolute","value":5368812230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":5368999657},{"type":"absolute","value":5368999623}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815890},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":5368999336},{"type":"absolute","value":5368999355},{"type":"absolute","value":5368999376}],"captures":{}}],"locations":[],"captures":{}}]]},"terminate process":{"meta":{"name":"terminate process","namespace":"host-interaction/process/terminate","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Terminate Process"],"objective":"Process","behavior":"Terminate Process","method":"","id":"C0018"}],"references":[],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x401A77","9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: terminate process\n    namespace: host-interaction/process/terminate\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Process::Terminate Process [C0018]\n    examples:\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\n  features:\n    - or:\n      - api: System.Diagnostics.Process::Kill\n      - api: System.Diagnostics.Process::WaitForExit\n      - api: System.Diagnostics.Process::WaitForExitAsync\n      - api: System.Environment::Exit\n      - api: System.Windows.Forms.Application::Exit\n      - api: exit\n      - api: Exit\n      - and:\n        - optional:\n          - match: open process\n        - or:\n          - api: kernel32.TerminateProcess\n          - api: ntdll.NtTerminateProcess\n          - api: kernel32.ExitProcess\n","matches":[[{"type":"absolute","value":5368812350},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[{"type":"absolute","value":5369007930}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368812690},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":5368812690},{"type":"absolute","value":5369020774}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815590},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":5368971169},{"type":"absolute","value":5368971223}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject APC":{"meta":{"name":"inject APC","namespace":"host-interaction/process/inject","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Asynchronous Procedure Call"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Asynchronous Procedure Call","id":"T1055.004"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x140019348"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: inject APC\n    namespace: host-interaction/process/inject\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Asynchronous Procedure Call [T1055.004]\n    examples:\n      - al-khaser_x64.exe_:0x140019348\n  features:\n    - and:\n      - or:\n        - match: write process memory\n        - match: create or open section object\n        - api: kernel32.MapViewOfFile\n      - or:\n        - api: kernel32.QueueUserAPC\n        - api: ntdll.NtQueueApcThread\n      - optional:\n        - or:\n          - number: 0x1fffff = THREAD_ALL_ACCESS\n          - api: kernel32.CreateProcess\n          - api: kernel32.OpenProcess\n","matches":[[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueueUserAPC"}},"children":[],"locations":[{"type":"absolute","value":5368954348}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueueApcThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368954178}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368812360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open section object"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MapViewOfFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2097151,"description":"THREAD_ALL_ACCESS"}},"children":[],"locations":[{"type":"absolute","value":5368953938},{"type":"absolute","value":5368954299}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368953943}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate threads":{"meta":{"name":"enumerate threads","namespace":"host-interaction/thread/list","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[{"parts":["Process","Enumerate Threads"],"objective":"Process","behavior":"Enumerate Threads","method":"","id":"C0064"}],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x10006BD5"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate threads\n    namespace: host-interaction/thread/list\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    mbc:\n      - Process::Enumerate Threads [C0064]\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x10006BD5\n  features:\n    - and:\n      - api: kernel32.Thread32First\n      - api: kernel32.Thread32Next\n      - optional:\n        - basic block:\n          - and:\n            - or:\n              - number: 0x4 = TH32CS_SNAPTHREAD\n              # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot\n            - api: kernel32.CreateToolhelp32Snapshot\n        - call:\n          - and:\n            - or:\n              - number: 0x4 = TH32CS_SNAPTHREAD\n            - api: kernel32.CreateToolhelp32Snapshot\n","matches":[[{"type":"absolute","value":5368812360},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":5368954263}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":5368954437}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368954212}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":5368954207}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368954205}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/aab34e81695e4e75b3f06168d3a9f0c7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813035},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":5368978399}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":5368978503}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368978364}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":5368978359}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368978288}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/aab34e81695e4e75b3f06168d3a9f0c7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute shellcode via indirect call":{"meta":{"name":"execute shellcode via indirect call","namespace":"load-code/shellcode","authors":["ronnie.salomonsen@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: execute shellcode via indirect call\n    namespace: load-code/shellcode\n    authors:\n      - ronnie.salomonsen@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    mbc:\n      - Memory::Allocate Memory [C0007]\n  features:\n    - and:\n      - match: allocate or change RWX memory\n      - or:\n        - characteristic: indirect call\n        - characteristic: cross section flow\n","matches":[[{"type":"absolute","value":5368812395},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368911413}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368911394}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368911866}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368813635},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":5368839314}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368839184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368839298}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368839184}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":5368839400}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send ICMP echo request":{"meta":{"name":"send ICMP echo request","namespace":"communication/icmp","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","ICMP Communication","Echo Request"],"objective":"Communication","behavior":"ICMP Communication","method":"Echo Request","id":"C0014.002"}],"references":["https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/"],"examples":["al-khaser_x86.exe_:0x449510"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send ICMP echo request\n    namespace: communication/icmp\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::ICMP Communication::Echo Request [C0014.002]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/\n    examples:\n      - al-khaser_x86.exe_:0x449510\n  features:\n    - and:\n      - or:\n        - api: IcmpSendEcho\n        - api: IcmpSendEcho2\n        - api: IcmpSendEcho2Ex\n        - api: Icmp6SendEcho2\n      - optional:\n        - or:\n          - api: IcmpCreateFile\n          - api: Icmp6CreateFile\n        - api: IcmpCloseHandle\n","matches":[[{"type":"absolute","value":5368812530},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho"}},"children":[],"locations":[{"type":"absolute","value":5369001023}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2Ex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6SendEcho2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCreateFile"}},"children":[],"locations":[{"type":"absolute","value":5369000837}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6CreateFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5369001033},{"type":"absolute","value":5369000941}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processors":{"meta":{"name":"get number of processors","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361"],"examples":["al-khaser_x86.exe_:0x432CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get number of processors\n    namespace: host-interaction/hardware/cpu\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires property features\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361\n    examples:\n      - al-khaser_x86.exe_:0x432CB0\n  features:\n    - or:\n      - and:\n        - match: PEB access\n        - or:\n          - and:\n            - arch: i386\n            - number: 0x64 = PEB->NumberOfProcessors\n          - and:\n            - arch: amd64\n            - number: 0xB8 = PEB->NumberOfProcessors\n      - property/read: System.Environment::ProcessorCount\n","matches":[[{"type":"absolute","value":5368812675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::ProcessorCount"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368914346}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914304}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":100,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":184,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[{"type":"absolute","value":5368914355}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if file exists":{"meta":{"name":"check if file exists","namespace":"host-interaction/file-system/exists","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["31600AD0D1A7EA615690DF111AE36C73:0x401284"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check if file exists\n    namespace: host-interaction/file-system/exists\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\n  features:\n    - or:\n      - basic block:\n        - and:\n          - api: kernel32.GetFileAttributes\n          - instruction:\n            - mnemonic: cmp\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\n      - basic block:\n        - and:\n          - api: kernel32.GetLastError\n          - instruction:\n            - mnemonic: cmp\n            - number: 2 = ERROR_FILE_NOT_FOUND\n      - api: shlwapi.PathFileExists\n      - api: System.IO.File::Exists\n      - property/read: System.IO.FileSystemInfo::Exists\n","matches":[[{"type":"absolute","value":5368812680},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997837}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368997846}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":5368997846}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368997846}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368997776}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/af5a8a8f525441788ddd714f50ef21c1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368816025},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":5368997997}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368998006}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":5368998006}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368998006}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368997936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/af5a8a8f525441788ddd714f50ef21c1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"connect to WMI namespace via WbemLocator":{"meta":{"name":"connect to WMI namespace via WbemLocator","namespace":"host-interaction/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Windows Management Instrumentation"],"tactic":"Execution","technique":"Windows Management Instrumentation","subtechnique":"","id":"T1047"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x14001956e","al-khaser_x86.exe_:0x00445270"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\nrule:\n  meta:\n    name: connect to WMI namespace via WbemLocator\n    namespace: host-interaction/wmi\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires offset, bytes features\n    att&ck:\n      - Execution::Windows Management Instrumentation [T1047]\n    examples:\n      - al-khaser_x64.exe_:0x14001956e\n      - al-khaser_x86.exe_:0x00445270\n  features:\n    - and:\n      - basic block:\n        - and:\n          - api: ole32.CoCreateInstance\n          - com/class: WbemLocator  # 11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24 = CLSID_WbemLocator\n          - com/interface: IWbemLocator  # 87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24 = IID_IWbemLocator\n      - or:\n        - and:\n          - arch: i386\n          - offset: 0xC = ppv->ConnectServer\n        - and:\n          - arch: amd64\n          - offset: 0x18 = ppv->ConnectServer\n      - optional:\n        - string: /ROOT\\\\CIMV2/i\n        - string: /ROOT\\\\DEFAULT/i\n","matches":[[{"type":"absolute","value":5368812910},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CoCreateInstance"}},"children":[],"locations":[{"type":"absolute","value":5368983484}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"4590f811-1d3a-11d0-891f-00aa004b2e24","description":"CLSID_WbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"11f890453a1dd011891f00aa004b2e24","description":"CLSID_WbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":5368983477}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"dc12a687-737f-11cf-884d-00aa004b2e24","description":"IID_IWbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"87a612dc7f73cf11884d00aa004b2e24","description":"IID_IWbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":5368983462}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368983445}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"ppv->ConnectServer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"ppv->ConnectServer"}},"children":[],"locations":[{"type":"absolute","value":5368983248},{"type":"absolute","value":5368983632}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\CIMV2/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\DEFAULT/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if process is running under wine":{"meta":{"name":"check if process is running under wine","namespace":"anti-analysis/anti-emulation/wine","authors":["@_re_fox"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Emulator Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Emulator Detection","method":"","id":"B0004"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp"],"examples":["ccbf7cba35bab56563c0fbe4237fdc41:0x40d750"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check if process is running under wine\n    namespace: anti-analysis/anti-emulation/wine\n    authors:\n      - \"@_re_fox\"\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Emulator Detection [B0004]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp\n    examples:\n      - ccbf7cba35bab56563c0fbe4237fdc41:0x40d750\n  features:\n    - or:\n      - string: /SOFTWARE\\\\Wine/i\n      - and:\n        - api: GetModuleHandle\n        - api: GetProcAddress\n        - string: \"wine_get_unix_file_name\"\n        - or:\n          - string: \"kernel32.dll\"\n          - string: \"ntdll.dll\"\n","matches":[[{"type":"absolute","value":5368813180},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368949745}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":5368949789}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[{"type":"absolute","value":5368949778}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[{"type":"absolute","value":5368949738}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[{"type":"absolute","value":5368949915}],"captures":{"SOFTWARE\\Wine":[{"type":"absolute","value":5368949915}]}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate processes":{"meta":{"name":"enumerate processes","namespace":"host-interaction/process/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"},{"parts":["Discovery","Software Discovery"],"tactic":"Discovery","technique":"Software Discovery","subtechnique":"","id":"T1518"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403DAB","35d04ecd797041eee796f4ddaa96cae8:0x10004F34"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate processes\n    namespace: host-interaction/process/list\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n      - Discovery::Software Discovery [T1518]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403DAB\n      - 35d04ecd797041eee796f4ddaa96cae8:0x10004F34\n  features:\n    - or:\n      - api: System.Diagnostics.Process::GetProcesses\n      - and:\n        - api: kernel32.Process32First\n        - api: kernel32.Process32Next\n        - optional:\n          - basic block:\n            - and:\n              - or:\n                - number: 0xF = TH32CS_SNAPALL\n                - number: 0x2 = TH32CS_SNAPPROCESS\n              - api: kernel32.CreateToolhelp32Snapshot\n          - call:\n            - and:\n              - or:\n                - number: 0xF = TH32CS_SNAPALL\n                - number: 0x2 = TH32CS_SNAPPROCESS\n              - api: kernel32.CreateToolhelp32Snapshot\n","matches":[[{"type":"absolute","value":5368813355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetProcesses"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32First"}},"children":[],"locations":[{"type":"absolute","value":5368982946}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32Next"}},"children":[],"locations":[{"type":"absolute","value":5368983034}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368982887}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"TH32CS_SNAPALL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"TH32CS_SNAPPROCESS"}},"children":[],"locations":[{"type":"absolute","value":5368982882}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368982784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate processes/e1aa00e9084c4c62ae782367bb762cd8"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get OS version":{"meta":{"name":"get OS version","authors":["@mr-tz"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000","5f66b82558ca92e54e77f216ef4c066c:0x44580A"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get OS version\n    authors:\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: function\n      dynamic: call\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x401000\n      - 5f66b82558ca92e54e77f216ef4c066c:0x44580A\n  features:\n    - or:\n      - api: RtlGetVersion\n      - api: ntoskrnl.PsGetVersion\n      - api: GetVersion\n      - api: GetVersionEx\n      - api: VerifyVersionInfo\n      - api: VerSetConditionMask\n      - api: RtlGetNtVersionNumbers\n      - api: GetProductInfo\n      - and:\n        - match: PEB access\n        - or:\n          - and:\n            - arch: i386\n            - or:\n              - offset: 0xA4 = PEB->OSMajorVersion\n              - offset: 0xA8 = PEB->OSMinorVersion\n              - offset: 0xAC = PEB->OSBuildNumber\n          - and:\n            - arch: amd64\n            - or:\n              - offset: 0x118 = PEB->OSMajorVersion\n              - offset: 0x11C = PEB->OSMinorVersion\n              - offset: 0x120 = PEB->OSBuildNumber\n","matches":[[{"type":"absolute","value":5368813515},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":5368844532}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":5368844452},{"type":"absolute","value":5368844469}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815925},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":5368843269}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":5368843172},{"type":"absolute","value":5368843189},{"type":"absolute","value":5368843206}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for time delay via GetTickCount":{"meta":{"name":"check for time delay via GetTickCount","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Timing/Delay Check GetTickCount"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Timing/Delay Check GetTickCount","id":"B0001.032"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x4013d0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for time delay via GetTickCount\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]\n    examples:\n      - Practical Malware Analysis Lab 16-03.exe_:0x4013d0\n  features:\n    - and:\n      - count(api(kernel32.GetTickCount)): 2 or more\n      - basic block:\n        - and:\n          - mnemonic: sub\n          - mnemonic: cmp\n","matches":[[{"type":"absolute","value":5368813565},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"sub"}},"children":[],"locations":[{"type":"absolute","value":5368914545},{"type":"absolute","value":5368914435},{"type":"absolute","value":5368914535}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368914550}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368914432}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetTickCount"}}},"children":[],"locations":[{"type":"absolute","value":5368914520},{"type":"absolute","value":5368914502}],"captures":{}}],"locations":[],"captures":{}}]]},"inject thread":{"meta":{"name":"inject thread","namespace":"host-interaction/process/inject","authors":["anamaria.martinezgom@mandiant.com","0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Thread Execution Hijacking"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Thread Execution Hijacking","id":"T1055.003"},{"parts":["Defense Evasion","Reflective Code Loading"],"tactic":"Defense Evasion","technique":"Reflective Code Loading","subtechnique":"","id":"T1620"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-01.exe_:0x4010D0","2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: inject thread\n    namespace: host-interaction/process/inject\n    authors:\n      - anamaria.martinezgom@mandiant.com\n      - 0x534a@mailbox.org\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003]\n      - Defense Evasion::Reflective Code Loading [T1620]\n    examples:\n      - Practical Malware Analysis Lab 12-01.exe_:0x4010D0\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\n  features:\n    - and:\n      - or:\n        - match: allocate or change RWX memory\n        - match: allocate or change RW memory\n      - match: write process memory\n      - match: create thread\n      - optional:\n        - or:\n          - match: host-interaction/process/create\n          - match: open process\n          - number: 0x3000 = MEM_COMMIT or MEM_RESERVE\n","matches":[[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368951194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368813750}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":5368951265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368951220}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368951069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368950815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950804}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12288,"description":"MEM_COMMIT or MEM_RESERVE"}},"children":[],"locations":[{"type":"absolute","value":5368951077}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject dll":{"meta":{"name":"inject dll","namespace":"host-interaction/process/inject","authors":["0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Dynamic-link Library Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Dynamic-link Library Injection","id":"T1055.001"}],"mbc":[],"references":["Practical Malware Analysis, p. 676","https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis","https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf","https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf","https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/","https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf","https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: inject dll\n    namespace: host-interaction/process/inject\n    authors:\n      - 0x534a@mailbox.org\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001]\n    references:\n      - Practical Malware Analysis, p. 676\n      - https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis\n      - https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf\n      - https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf\n      - https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/\n      - https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf\n      - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - and:\n      - optional:\n        - or:\n          - match: open process\n          - match: host-interaction/process/create\n      - match: allocate or change RW memory\n      - match: write process memory\n      - and:\n        - or:\n          - api: kernel32.GetModuleHandle\n          - api: kernel32.GetModuleHandleEx\n        - string: \"/LoadLibrary[AW]/\"\n      - match: create thread\n","matches":[[{"type":"absolute","value":5368813750},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":5368951096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":5368951069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950968}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":5368951194}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368813750}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":5368951265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368951220}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":5368950815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368950804}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":5368950861}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LoadLibrary[AW]/"}},"children":[],"locations":[{"type":"absolute","value":5368950912}],"captures":{"LoadLibraryW":[{"type":"absolute","value":5368950912}]}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get memory capacity":{"meta":{"name":"get memory capacity","namespace":"host-interaction/hardware/memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get memory capacity\n    namespace: host-interaction/hardware/memory\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n  features:\n    - or:\n      - api: kernel32.GlobalMemoryStatus\n      - api: kernel32.GlobalMemoryStatusEx\n        # TODO kernel32.GetSystemInfo with offset\n","matches":[[{"type":"absolute","value":5368813815},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatusEx"}},"children":[],"locations":[{"type":"absolute","value":5368923310}],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate process modules":{"meta":{"name":"enumerate process modules","namespace":"host-interaction/process/modules/list","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":[],"examples":["6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8","9B2FD471274C41626B75DDBB5C897877:0x100046B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate process modules\n    namespace: host-interaction/process/modules/list\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    examples:\n      - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8\n      - 9B2FD471274C41626B75DDBB5C897877:0x100046B0\n  features:\n    - or:\n      - and:\n        - optional:\n          - or:\n            - api: kernel32.OpenProcess\n            - api: kernel32.CloseHandle\n        - or:\n          - api: kernel32.K32EnumProcessModules\n          - api: kernel32.K32EnumProcessModulesEx\n          - api: kernel32.K32EnumProcesses\n          # depending on OS version in kernel32 or psapi\n          - api: EnumProcessModules\n          - api: EnumProcessModulesEx\n          - api: EnumProcesses\n      - and:\n        - api: kernel32.Module32First\n        - api: kernel32.Module32Next\n        - optional:\n          - basic block:\n            - and:\n              - or:\n                - number: 0x8 = TH32CS_SNAPMODULE\n                - number: 0x10 = TH32CS_SNAPMODULE32\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\n              - api: kernel32.CreateToolhelp32Snapshot\n          - call:\n            - and:\n              - or:\n                - number: 0x8 = TH32CS_SNAPMODULE\n                - number: 0x10 = TH32CS_SNAPMODULE32\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\n              - api: kernel32.CreateToolhelp32Snapshot\n      - and:\n        - property/read: System.Diagnostics.Process::Modules\n        - property/read: System.Diagnostics.ProcessModuleCollection::Item\n","matches":[[{"type":"absolute","value":5368813990},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":5368890180}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":5368890266}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368890108}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[{"type":"absolute","value":5368890103}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368890032}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5368890301}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":5368953371}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":5368953421}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":5368953340}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[{"type":"absolute","value":5368953335}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368953248}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5368953434}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for software breakpoints":{"meta":{"name":"check for software breakpoints","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Software Breakpoints"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Software Breakpoints","id":"B0001.025"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp","https://anti-debug.checkpoint.com/techniques/assembly.html"],"examples":["al-khaser_x86.exe_:0x431020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for software breakpoints\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp\n      - https://anti-debug.checkpoint.com/techniques/assembly.html\n    examples:\n      - al-khaser_x86.exe_:0x431020\n  features:\n    - and:\n      - or:\n        - instruction:\n          - mnemonic: cmp\n          - number: 0xCC = INT3\n        - and:\n          - description: INT3 (long form)\n          - instruction:\n            - mnemonic: cmp\n            - number: 0xCD = INT3 (long form byte 1)\n          - instruction:\n            - mnemonic: cmp\n            - number: 0x03 = INT3 (long form byte 2)\n      - match: contain loop\n","matches":[[{"type":"absolute","value":5368814035},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":5368814035}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368814035}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":5368907642}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":204,"description":"INT3"}},"children":[],"locations":[{"type":"absolute","value":5368907642}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368907642}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"INT3 (long form)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/36afe6517a0548cd84a535955598a159"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/2fb43672c6814815bcabc8701648aeae"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set console window title":{"meta":{"name":"set console window title","namespace":"host-interaction/gui/console","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Console"],"objective":"Operating System","behavior":"Console","method":"","id":"C0033"}],"references":[],"examples":["mimikatz.exe_:0x44570F"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set console window title\n    namespace: host-interaction/gui/console\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Operating System::Console [C0033]\n    examples:\n      - mimikatz.exe_:0x44570F\n  features:\n    - or:\n      - api: kernel32.SetConsoleTitle\n","matches":[[{"type":"absolute","value":5368814050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetConsoleTitle"}},"children":[],"locations":[{"type":"absolute","value":5368969441}],"captures":{}}],"locations":[],"captures":{}}]]},"get disk size":{"meta":{"name":"get disk size","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347"],"examples":["al-khaser_x86.exe_:0x4343D0","al-khaser_x86.exe_:0x434010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get disk size\n    namespace: host-interaction/hardware/storage\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347\n    examples:\n      - al-khaser_x86.exe_:0x4343D0\n      - al-khaser_x86.exe_:0x434010\n  features:\n    - or:\n      - api: kernel32.GetDiskFreeSpace\n      - api: kernel32.GetDiskFreeSpaceEx\n      - property/read: System.IO.DriveInfo::TotalSize\n      - property/read: System.IO.DriveInfo::TotalFreeSpace\n      - property/read: System.IO.DriveInfo::AvailableFreeSpace\n      - basic block:\n        - and:\n          - match: interact with driver via IOCTL\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\n      - call:\n        - and:\n          - match: interact with driver via IOCTL\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\n      - and:\n        - or:\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i\n        - string: \"Size\"\n","matches":[[{"type":"absolute","value":5368814865},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920318}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368920268}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":5368920309}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":5368920064}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368920014}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":5368920055}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368920268},{"type":"absolute","value":5368920014}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/c9a9ddfc47144dc59ab2f22c9a32b9f8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368815525},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[{"type":"absolute","value":5368918405}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/84a496d0950b4028a26a7ef5f2193505"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/c9a9ddfc47144dc59ab2f22c9a32b9f8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate services":{"meta":{"name":"enumerate services","namespace":"host-interaction/service/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Service Discovery"],"tactic":"Discovery","technique":"System Service Discovery","subtechnique":"","id":"T1007"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x1000B823"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate services\n    namespace: host-interaction/service/list\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Service Discovery [T1007]\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x1000B823\n  features:\n    - or:\n      - api: advapi32.EnumServicesStatus\n      - api: advapi32.EnumServicesStatusEx\n      - api: advapi32.EnumDependentServices\n","matches":[[{"type":"absolute","value":5368814905},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatusEx"}},"children":[],"locations":[{"type":"absolute","value":5368932939},{"type":"absolute","value":5368932726}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumDependentServices"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate disk properties":{"meta":{"name":"enumerate disk properties","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518"],"examples":["al-khaser_x86.exe_:0x4369B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate disk properties\n    namespace: host-interaction/hardware/storage\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires bytes features\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518\n    examples:\n      - al-khaser_x86.exe_:0x4369B0\n  features:\n    - and:\n      - basic block:\n        - and:\n          - api: setupapi.SetupDiGetClassDevs\n          - bytes: 67 E9 36 4D 25 E3 CE 11 BF C1 08 00 2B E1 03 18 = GUID_DEVCLASS_DISKDRIVE\n      - api: setupapi.SetupDiEnumDeviceInfo\n      - api: setupapi.SetupDiGetDeviceRegistryProperty\n      - optional:\n        - api: setupapi.SetupDiDestroyDeviceInfoList\n","matches":[[{"type":"absolute","value":5368815040},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetClassDevs"}},"children":[],"locations":[{"type":"absolute","value":5368927847}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e9364d25e3ce11bfc108002be10318","description":"GUID_DEVCLASS_DISKDRIVE"}},"children":[],"locations":[{"type":"absolute","value":5368927840}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368927760}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiEnumDeviceInfo"}},"children":[],"locations":[{"type":"absolute","value":5368927927}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetDeviceRegistryProperty"}},"children":[],"locations":[{"type":"absolute","value":5368927996}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiDestroyDeviceInfoList"}},"children":[],"locations":[{"type":"absolute","value":5368928245}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get disk information":{"meta":{"name":"get disk information","namespace":"host-interaction/hardware/storage","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0","972B219F18379907A045431303F4DA7D:0x41064E"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get disk information\n    namespace: host-interaction/hardware/storage\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n      - 972B219F18379907A045431303F4DA7D:0x41064E\n  features:\n    - or:\n      - api: kernel32.GetDriveType\n      - api: kernel32.GetLogicalDrives\n      - api: kernel32.GetVolumeInformation\n      - api: kernel32.GetVolumeNameForVolumeMountPoint\n      - api: kernel32.GetVolumePathNamesForVolumeName\n      - api: kernel32.GetLogicalDriveStrings\n      - api: kernel32.QueryDosDevice\n      - property/read: System.IO.DriveInfo::VolumeLabel\n      - property/read: System.IO.DriveInfo::DriveType\n      - property/read: System.IO.DriveInfo::DriveFormat\n      - property/read: System.IO.DriveInfo::Name\n","matches":[[{"type":"absolute","value":5368815050},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":5368881902}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":5368882832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":5368883201}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB NtGlobalFlag flag":{"meta":{"name":"check for PEB NtGlobalFlag flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block NtGlobalFlag"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block NtGlobalFlag","id":"B0001.036"}],"references":["Practical Malware Analysis, Chapter 16, p. 355","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for PEB NtGlobalFlag flag\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires offset, mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]\n    references:\n      - Practical Malware Analysis, Chapter 16, p. 355\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm\n    examples:\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\n  features:\n    - and:\n      - basic block:\n        - and:\n          - match: PEB access\n          - or:\n            - and:\n              - arch: i386\n              - offset: 0x68 = PEB.NtGlobalFlag\n            - and:\n              - arch: amd64\n              - offset: 0xBC = PEB.NtGlobalFlag\n            - instruction:\n              - arch: i386\n              - mnemonic: add\n              - offset: 0x68 = PEB.NtGlobalFlag\n            - instruction:\n              - arch: amd64\n              - mnemonic: add\n              - offset: 0xBC = PEB.NtGlobalFlag\n      - number: 0x70 = (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)\n","matches":[[{"type":"absolute","value":5368815115},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[{"type":"absolute","value":5368840394}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368840336}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":104,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":188,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":5368840403}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for PEB NtGlobalFlag flag/a93ba2f42ad947438b9d02b75f92d9df/91b52a8a420345369cdeb64a14a0d6b7"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":5368840403}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":188,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":5368840403}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368840403}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368840336}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"(FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)"}},"children":[],"locations":[{"type":"absolute","value":5368840426},{"type":"absolute","value":5368840477}],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query or enumerate registry value\n    namespace: host-interaction/registry\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Value [C0036.006]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegGetValue\n        - api: advapi32.RegEnumValue\n        - api: advapi32.RegQueryValue\n        - api: advapi32.RegQueryValueEx\n        - api: advapi32.RegQueryMultipleValues\n        - api: ZwQueryValueKey\n        - api: ZwEnumerateValueKey\n        - api: NtQueryValueKey\n        - api: NtEnumerateValueKey\n        - api: RtlQueryRegistryValues\n        - api: SHGetValue\n        - api: SHEnumValue\n        - api: SHRegGetInt\n        - api: SHRegGetPath\n        - api: SHRegGetValue\n        - api: SHQueryValueEx\n        - api: SHRegGetUSValue\n        - api: SHOpenRegStream\n        - api: SHRegEnumUSValue\n        - api: SHOpenRegStream2\n        - api: SHRegQueryUSValue\n        - api: SHRegGetBoolUSValue\n        - api: SHRegGetValueFromHKCUHKLM\n        - api: SHRegGetBoolValueFromHKCUHKLM\n        - api: Microsoft.Win32.RegistryKey::GetValue\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\n        - api: Microsoft.Win32.Registry::GetValue\n","matches":[[{"type":"absolute","value":5368815165},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":5368984936}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368984784}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":5368984984}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"modify access privileges":{"meta":{"name":"modify access privileges","namespace":"host-interaction/process/modify","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403BE0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: modify access privileges\n    namespace: host-interaction/process/modify\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Privilege Escalation::Access Token Manipulation [T1134]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403BE0\n  features:\n    - and:\n      - api: advapi32.AdjustTokenPrivileges\n      - optional:\n        - or:\n          - api: advapi32.LookupPrivilegeValue\n","matches":[[{"type":"absolute","value":5368815200},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"AdjustTokenPrivileges"}},"children":[],"locations":[{"type":"absolute","value":5368985413}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LookupPrivilegeValue"}},"children":[],"locations":[{"type":"absolute","value":5368985372}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"find graphical window":{"meta":{"name":"find graphical window","namespace":"host-interaction/gui/window/find","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","Application Window Discovery"],"tactic":"Discovery","technique":"Application Window Discovery","subtechnique":"","id":"T1010"}],"mbc":[],"references":[],"examples":["7C843E75D4F02087B932FE280DF9C90C:0x41B180"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: find graphical window\n    namespace: host-interaction/gui/window/find\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::Application Window Discovery [T1010]\n    examples:\n      - 7C843E75D4F02087B932FE280DF9C90C:0x41B180\n  features:\n    - or:\n      - api: user32.FindWindow\n      - api: user32.FindWindowEx\n","matches":[[{"type":"absolute","value":5368815245},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"FindWindow"}},"children":[],"locations":[{"type":"absolute","value":5368944355},{"type":"absolute","value":5368944374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"FindWindowEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processor cores":{"meta":{"name":"get number of processor cores","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207"],"examples":["al-khaser_x86.exe_:0x435BA0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get number of processor cores\n    namespace: host-interaction/hardware/cpu\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207\n    examples:\n      - al-khaser_x86.exe_:0x435BA0\n  features:\n    - and:\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/\n      - string: \"NumberOfCores\"\n","matches":[[{"type":"absolute","value":5368815340},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"NumberOfCores"}},"children":[],"locations":[{"type":"absolute","value":5368925008}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/"}},"children":[],"locations":[{"type":"absolute","value":5368924837}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":5368924837}]}}],"locations":[],"captures":{}}]]},"create mutex":{"meta":{"name":"create mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Mutex"],"objective":"Process","behavior":"Create Mutex","method":"","id":"C0042"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create mutex\n    namespace: host-interaction/mutex\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Process::Create Mutex [C0042]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - api: kernel32.CreateMutex\n      - api: kernel32.CreateMutexEx\n      - api: System.Threading.Mutex::ctor\n","matches":[[{"type":"absolute","value":5368815500},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutex"}},"children":[],"locations":[{"type":"absolute","value":5368906981}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutexEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for protected handle exception":{"meta":{"name":"check for protected handle exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","SetHandleInformation"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"SetHandleInformation","id":"B0001.024"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp"],"examples":["al-khaser_x86.exe_:0x430D20"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for protected handle exception\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp\n    examples:\n      - al-khaser_x86.exe_:0x430D20\n  features:\n    - and:\n      - or:\n        - description: SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);\n        - basic block:\n          - and:\n            - count(number(2)): 2 or more\n            - api: SetHandleInformation\n        - call:\n          - and:\n            - count(number(2)): 2 or more\n            - api: SetHandleInformation\n      - api: CloseHandle\n","matches":[[{"type":"absolute","value":5368815500},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":5368907024}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetHandleInformation"}},"children":[],"locations":[{"type":"absolute","value":5368907013}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"number","number":2}}},"children":[],"locations":[{"type":"absolute","value":5368907004},{"type":"absolute","value":5368906998}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368906998}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for protected handle exception/9e03e0d6682f4b48900d086faa1fddf2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get MAC address on Windows":{"meta":{"name":"get MAC address on Windows","namespace":"collection/network","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","echernofsky@google.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128","https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific"],"examples":["al-khaser_x64.exe_:0x14001A1BC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get MAC address on Windows\n    namespace: collection/network\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - echernofsky@google.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128\n      - https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific\n    examples:\n      - al-khaser_x64.exe_:0x14001A1BC\n  features:\n    - and:\n      - os: windows\n      - or:\n        - and:\n          - api: iphlpapi.GetAdaptersInfo\n          - or:\n            - offset: 0x194 = IP_ADAPTER_INFO.Address\n            - offset: 0x195 = IP_ADAPTER_INFO.Address+1\n            - offset: 0x196 = IP_ADAPTER_INFO.Address+2\n            - offset: 0x197 = IP_ADAPTER_INFO.Address+3\n            - offset: 0x198 = IP_ADAPTER_INFO.Address+4\n            - offset: 0x199 = IP_ADAPTER_INFO.Address+5\n          - optional:\n            - string: \"%02X-%02X-%02X-%02X-%02X-%02X\"\n        - and:\n          - api: iphlpapi.GetAdaptersAddresses\n          - offset: 0x2C = PhysicalAddress\n","matches":[[{"type":"absolute","value":5368816060},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersInfo"}},"children":[],"locations":[{"type":"absolute","value":5368994669},{"type":"absolute","value":5368994549}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":404,"description":"IP_ADAPTER_INFO.Address"}},"children":[],"locations":[{"type":"absolute","value":5368994782}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":405,"description":"IP_ADAPTER_INFO.Address+1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":406,"description":"IP_ADAPTER_INFO.Address+2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":407,"description":"IP_ADAPTER_INFO.Address+3"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":408,"description":"IP_ADAPTER_INFO.Address+4"}},"children":[],"locations":[{"type":"absolute","value":5368994795}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":409,"description":"IP_ADAPTER_INFO.Address+5"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"%02X-%02X-%02X-%02X-%02X-%02X"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersAddresses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":44,"description":"PhysicalAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set application hook":{"meta":{"name":"set application hook","namespace":"host-interaction/gui","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set application hook\n    namespace: host-interaction/gui\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    examples:\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\n  features:\n    - and:\n      - or:\n        - api: user32.SetWindowsHookEx\n        - api: user32.UnhookWindowsHookEx\n","matches":[[{"type":"absolute","value":5368816460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":5368956573}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"log keystrokes via application hook":{"meta":{"name":"log keystrokes via application hook","namespace":"collection/keylog","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Collection","Input Capture","Keylogging"],"tactic":"Collection","technique":"Input Capture","subtechnique":"Keylogging","id":"T1056.001"}],"mbc":[{"parts":["Collection","Keylogging","Application Hook"],"objective":"Collection","behavior":"Keylogging","method":"Application Hook","id":"F0002.001"}],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: log keystrokes via application hook\n    namespace: collection/keylog\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Collection::Input Capture::Keylogging [T1056.001]\n    mbc:\n      - Collection::Keylogging::Application Hook [F0002.001]\n    examples:\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\n  features:\n    - and:\n      - match: set application hook\n      - or:\n        - number: 13 = WH_KEYBOARD_LL\n        - number: 2  = WH_KEYBOARD\n","matches":[[{"type":"absolute","value":5368816460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"set application hook"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":5368956573}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":5368816460}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"WH_KEYBOARD_LL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"WH_KEYBOARD"}},"children":[],"locations":[{"type":"absolute","value":5368956568}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings":{"meta":{"name":"reference anti-VM strings","namespace":"anti-analysis/anti-vm/vm-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp"],"examples":["Practical Malware Analysis Lab 17-02.dll_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_\n  features:\n    - or:\n      - string: /HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i\n      - string: /HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i\n      - string: /A M I/i\n      - string: /Hyper-V/i\n      - string: /Kernel-VMDetection-Private/i\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L699\n      - string: /KVMKVMKVM/i\n        description: KVM\n      - string: /Microsoft Hv/i\n        description: Microsoft Hyper-V or Windows Virtual PC\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L8\n      - string: /avghookx.dll/i\n        description: AVG\n      - string: /avghooka.dll/i\n        description: AVG\n      - string: /snxhk.dll/i\n        description: Avast\n      - string: /pstorec.dll/i\n        description: SunBelt Sandbox\n      - string: /vmcheck.dll/i\n        description: Virtual PC\n      - string: /wpespy.dll/i\n        description: WPE Pro\n      - string: /cmdvrt64.dll/i\n        description: Comodo Container\n      - string: /cmdvrt32.dll/i\n        description: Comodo Container\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L46\n      - string: /sample.exe/i\n      - string: /bot.exe/i\n      - string: /sandbox.exe/i\n      - string: /malware.exe/i\n      - string: /test.exe/i\n      - string: /klavme.exe/i\n      - string: /myapp.exe/i\n      - string: /testapp.exe/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i"}},"children":[],"locations":[{"type":"file","value":285328}],"captures":{"HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0":[{"type":"file","value":285328}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/A M I/i"}},"children":[],"locations":[{"type":"file","value":282272}],"captures":{"A M I":[{"type":"file","value":282272}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Hyper-V/i"}},"children":[],"locations":[{"type":"file","value":282928}],"captures":{"Hyper-V":[{"type":"file","value":282928}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Kernel-VMDetection-Private/i"}},"children":[],"locations":[{"type":"file","value":242672},{"type":"file","value":282952}],"captures":{"Checking NtQueryLicenseValue with Kernel-VMDetection-Private ":[{"type":"file","value":242672}],"Kernel-VMDetection-Private":[{"type":"file","value":282952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/KVMKVMKVM/i","description":"KVM"}},"children":[],"locations":[{"type":"file","value":281920}],"captures":{"KVMKVMKVM":[{"type":"file","value":281920}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Microsoft Hv/i","description":"Microsoft Hyper-V or Windows Virtual PC"}},"children":[],"locations":[{"type":"file","value":281952}],"captures":{"Microsoft Hv":[{"type":"file","value":281952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghookx.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":280496}],"captures":{"avghookx.dll":[{"type":"file","value":280496}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghooka.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":280528}],"captures":{"avghooka.dll":[{"type":"file","value":280528}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/snxhk.dll/i","description":"Avast"}},"children":[],"locations":[{"type":"file","value":280560}],"captures":{"snxhk.dll":[{"type":"file","value":280560}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/pstorec.dll/i","description":"SunBelt Sandbox"}},"children":[],"locations":[{"type":"file","value":280720}],"captures":{"pstorec.dll":[{"type":"file","value":280720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmcheck.dll/i","description":"Virtual PC"}},"children":[],"locations":[{"type":"file","value":280752}],"captures":{"vmcheck.dll":[{"type":"file","value":280752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/wpespy.dll/i","description":"WPE Pro"}},"children":[],"locations":[{"type":"file","value":280784}],"captures":{"wpespy.dll":[{"type":"file","value":280784}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt64.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":280816}],"captures":{"cmdvrt64.dll":[{"type":"file","value":280816}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt32.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":280848}],"captures":{"cmdvrt32.dll":[{"type":"file","value":280848}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sample.exe/i"}},"children":[],"locations":[{"type":"file","value":281000}],"captures":{"sample.exe":[{"type":"file","value":281000}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/bot.exe/i"}},"children":[],"locations":[{"type":"file","value":281032}],"captures":{"bot.exe":[{"type":"file","value":281032}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sandbox.exe/i"}},"children":[],"locations":[{"type":"file","value":281056}],"captures":{"sandbox.exe":[{"type":"file","value":281056}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/malware.exe/i"}},"children":[],"locations":[{"type":"file","value":281088}],"captures":{"malware.exe":[{"type":"file","value":281088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/test.exe/i"}},"children":[],"locations":[{"type":"file","value":281120}],"captures":{"test.exe":[{"type":"file","value":281120}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/klavme.exe/i"}},"children":[],"locations":[{"type":"file","value":281144}],"captures":{"klavme.exe":[{"type":"file","value":281144}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/myapp.exe/i"}},"children":[],"locations":[{"type":"file","value":281176}],"captures":{"myapp.exe":[{"type":"file","value":281176}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/testapp.exe/i"}},"children":[],"locations":[{"type":"file","value":281200}],"captures":{"testapp.exe":[{"type":"file","value":281200}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Parallels":{"meta":{"name":"reference anti-VM strings targeting Parallels","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting Parallels\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /Parallels/i\n      - string: /prl_cc.exe/i\n      - string: /prl_tools.exe/i\n      - string: /prl hyperv/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Parallels/i"}},"children":[],"locations":[{"type":"file","value":284592}],"captures":{"Checking Parallels processes: %s":[{"type":"file","value":284592}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_cc.exe/i"}},"children":[],"locations":[{"type":"file","value":284512}],"captures":{"prl_cc.exe":[{"type":"file","value":284512}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_tools.exe/i"}},"children":[],"locations":[{"type":"file","value":284544}],"captures":{"prl_tools.exe":[{"type":"file","value":284544}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl hyperv/i"}},"children":[],"locations":[{"type":"file","value":282048}],"captures":{"prl hyperv  ":[{"type":"file","value":282048}]}}],"locations":[],"captures":{}}]]},"contain a thread local storage (.tls) section":{"meta":{"name":"contain a thread local storage (.tls) section","namespace":"executable/pe/section/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain a thread local storage (.tls) section\n    namespace: executable/pe/section/tls\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - Practical Malware Analysis Lab 16-02.exe_\n  features:\n    - section: .tls\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"section","section":".tls"}},"children":[],"locations":[{"type":"absolute","value":5369344000}],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference analysis tools strings\n    namespace: anti-analysis\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    mbc:\n      - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /ollydbg(\\.exe)?/i\n      - string: /ProcessHacker(\\.exe)?/i\n      - string: /tcpview(\\.exe)?/i\n      - string: /autoruns(\\.exe)?/i\n      - string: /autorunsc(\\.exe)?/i\n      - string: /filemon(\\.exe)?/i\n      - string: /procmon(\\.exe)?/i\n      - string: /regmon(\\.exe)?/i\n      - string: /procexp(\\.exe)?/i\n      - string: /(?<!\\w)ida[gqtuw]?(\\.exe)?$/i\n      - string: /ida[gqtuw]?64(\\.exe)?$/i\n      - string: /ImmunityDebugger(\\.exe)?/i\n      - string: /Wireshark(\\.exe)?/i\n      - string: /dumpcap(\\.exe)?/i\n      - string: /HookExplorer(\\.exe)?/i\n      - string: /ImportREC(\\.exe)?/i\n      - string: /PETools(\\.exe)?/i\n      - string: /LordPE(\\.exe)?/i\n      - string: /SysInspector(\\.exe)?/i\n      - string: /proc_analyzer(\\.exe)?/i\n      - string: /sysAnalyzer(\\.exe)?/i\n      - string: /sniff_hit(\\.exe)?/i\n      - string: /windbg(\\.exe)?/i\n      - string: /joeboxcontrol(\\.exe)?/i\n      - string: /joeboxserver(\\.exe)?/i\n      - string: /ResourceHacker(\\.exe)?/i\n      - string: /x32dbg(\\.exe)?/i\n      - string: /x64dbg(\\.exe)?/i\n      - string: /Fiddler(\\.exe)?/i\n      - string: /httpdebugger(\\.exe)?/i\n      - string: /fakenet(\\.exe)?/i\n      - string: /netmon(\\.exe)?/i\n      - string: /WPE PRO(\\.exe)?/i\n      - string: /decompile(\\.exe)?/i\n      - string: /scylla/i\n      - string: /megadumper/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248760}],"captures":{"ollydbg.exe":[{"type":"file","value":248760}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248792}],"captures":{"ProcessHacker.exe":[{"type":"file","value":248792}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248840}],"captures":{"tcpview.exe":[{"type":"file","value":248840}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248872},{"type":"file","value":248904}],"captures":{"autoruns.exe":[{"type":"file","value":248872}],"autorunsc.exe":[{"type":"file","value":248904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248904}],"captures":{"autorunsc.exe":[{"type":"file","value":248904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248944}],"captures":{"filemon.exe":[{"type":"file","value":248944}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":248976}],"captures":{"procmon.exe":[{"type":"file","value":248976}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249008}],"captures":{"regmon.exe":[{"type":"file","value":249008}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249040}],"captures":{"procexp.exe":[{"type":"file","value":249040}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/(?<!\\w)ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":249072}],"captures":{"idaq.exe":[{"type":"file","value":249072}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?64(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":249096}],"captures":{"idaq64.exe":[{"type":"file","value":249096}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249128}],"captures":{"ImmunityDebugger.exe":[{"type":"file","value":249128}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249184}],"captures":{"Wireshark.exe":[{"type":"file","value":249184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249224}],"captures":{"dumpcap.exe":[{"type":"file","value":249224}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249256}],"captures":{"HookExplorer.exe":[{"type":"file","value":249256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249296}],"captures":{"ImportREC.exe":[{"type":"file","value":249296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249336}],"captures":{"PETools.exe":[{"type":"file","value":249336}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249368}],"captures":{"LordPE.exe":[{"type":"file","value":249368}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249400}],"captures":{"SysInspector.exe":[{"type":"file","value":249400}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249440}],"captures":{"proc_analyzer.exe":[{"type":"file","value":249440}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249488}],"captures":{"sysAnalyzer.exe":[{"type":"file","value":249488}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249528}],"captures":{"sniff_hit.exe":[{"type":"file","value":249528}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249568}],"captures":{"windbg.exe":[{"type":"file","value":249568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249600}],"captures":{"joeboxcontrol.exe":[{"type":"file","value":249600}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249648}],"captures":{"joeboxserver.exe":[{"type":"file","value":249648}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249688}],"captures":{"ResourceHacker.exe":[{"type":"file","value":249688}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249736}],"captures":{"x32dbg.exe":[{"type":"file","value":249736}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249768}],"captures":{"x64dbg.exe":[{"type":"file","value":249768}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249800}],"captures":{"Fiddler.exe":[{"type":"file","value":249800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":249832}],"captures":{"httpdebugger.exe":[{"type":"file","value":249832}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualPC":{"meta":{"name":"reference anti-VM strings targeting VirtualPC","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting VirtualPC\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /VirtualPC/i\n      - string: /VMSrvc.exe/i\n      - string: /VMUSrvc.exe/i\n      - string: /SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualPC/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":297920}],"captures":{"VMSrvc.exe":[{"type":"file","value":297920}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMUSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":297952}],"captures":{"VMUSrvc.exe":[{"type":"file","value":297952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i"}},"children":[],"locations":[{"type":"file","value":298080}],"captures":{"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters":[{"type":"file","value":298080}]}}],"locations":[],"captures":{}}]]},"contains PDB path":{"meta":{"name":"contains PDB path","namespace":"executable/pe/pdb","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["464EF2CA59782CE697BC329713698CCC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contains PDB path\n    namespace: executable/pe/pdb\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - 464EF2CA59782CE697BC329713698CCC  # level32.exe\n  features:\n    - string: /:\\\\.*\\.pdb/\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/:\\\\.*\\.pdb/"}},"children":[],"locations":[{"type":"file","value":335856}],"captures":{"C:\\Users\\spring\\Desktop\\al-khaser-master\\x64\\Debug\\al-khaser.pdb":[{"type":"file","value":335856}]}}]]},"reference anti-VM strings targeting Xen":{"meta":{"name":"reference anti-VM strings targeting Xen","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting Xen\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /^Xen/i\n      - string: /XenVMMXenVMM/i\n      - string: /xenservice.exe/i\n      - string: /XenVMMXenVMM/i\n      - string: /HVM domU/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^Xen/i"}},"children":[],"locations":[{"type":"file","value":246112},{"type":"file","value":302960},{"type":"file","value":282016}],"captures":{"Xen Detection":[{"type":"file","value":246112}],"XenVMMXenVMM":[{"type":"file","value":282016}],"xenservice.exe":[{"type":"file","value":302960}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":282016}],"captures":{"XenVMMXenVMM":[{"type":"file","value":282016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/xenservice.exe/i"}},"children":[],"locations":[{"type":"file","value":302960}],"captures":{"xenservice.exe":[{"type":"file","value":302960}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":282016}],"captures":{"XenVMMXenVMM":[{"type":"file","value":282016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HVM domU/i"}},"children":[],"locations":[{"type":"file","value":282424}],"captures":{"HVM domU":[{"type":"file","value":282424}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualBox":{"meta":{"name":"reference anti-VM strings targeting VirtualBox","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting VirtualBox\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /VBOX/i\n      - string: /VEN_VBOX/i\n      - string: /VirtualBox/i\n      - string: /06/23/99/i\n      - string: /HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i\n      - string: /HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i\n      - string: /HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i\n      - string: /SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i\n      - string: /VBoxMouse\\.sys/i\n      - string: /VBoxGuest\\.sys/i\n      - string: /VBoxSF\\.sys/i\n      - string: /VBoxVideo\\.sys/i\n      - string: /vboxdisp\\.dll/i\n      - string: /vboxhook\\.dll/i\n      - string: /vboxmrxnp\\.dll/i\n      - string: /vboxogl\\.dll/i\n      - string: /vboxoglarrayspu\\.dll/i\n      - string: /vboxoglcrutil\\.dll/i\n      - string: /vboxoglerrorspu\\.dll/i\n      - string: /vboxoglfeedbackspu\\.dll/i\n      - string: /vboxoglpackspu\\.dll/i\n      - string: /vboxoglpassthroughspu\\.dll/i\n      - string: /vboxservice\\.exe/i\n      - string: /vboxtray\\.exe/i\n      - string: /VBoxControl\\.exe/i\n      - string: /oracle\\\\virtualbox guest additions\\\\/i\n      - string: /\\\\\\\\.\\\\VBoxMiniRdrDN/i\n      - string: /\\\\\\\\.\\\\VBoxGuest/i\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i\n      - string: /\\\\\\\\.\\\\VBoxTrayIPC/i\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i\n      - string: /VBoxTrayToolWndClass/i\n      - string: /VBoxTrayToolWnd/i\n      - string: /vboxservice\\.exe/i\n      - string: /vboxtray.exe/i\n      - string: /vboxvideo/i\n      - string: /VBoxVideoW8/i\n      - string: /VBoxWddm/i\n      - string: /PCI\\\\VEN_80EE&DEV_CAFE/i\n      - string: /82801FB/i\n      - string: /82441FX/i\n      - string: /82371SB/i\n      - string: /OpenHCD/i\n      - string: /ACPIBus_BUS_0/i\n      - string: /PCI_BUS_0/i\n      - string: /PNP_BUS_0/i\n      - string: /Oracle Corporation/i\n      - string: /VBoxWdd/i\n      - string: /VBoxS/i\n        description: VirtualBox Shared Folders\n      - string: /VBoxMouse/i\n        description: VirtualBox Guest Mouse\n      - string: /VBoxGuest/i\n        description: VirtualBox Guest Driver\n      - string: /VBoxVBoxVBox/i\n      - string: /innotek GmbH/i\n      - string: /drivers\\\\vboxdrv/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBOX/i"}},"children":[],"locations":[{"type":"file","value":296832},{"type":"file","value":245248},{"type":"file","value":294912},{"type":"file","value":295040},{"type":"file","value":295552},{"type":"file","value":295808},{"type":"file","value":286472},{"type":"file","value":294664},{"type":"file","value":295432},{"type":"file","value":294032},{"type":"file","value":294800},{"type":"file","value":295184},{"type":"file","value":295952},{"type":"file","value":296824},{"type":"file","value":296592},{"type":"file","value":289184},{"type":"file","value":294432},{"type":"file","value":296096},{"type":"file","value":297504},{"type":"file","value":296616},{"type":"file","value":244656},{"type":"file","value":244912},{"type":"file","value":293624},{"type":"file","value":293936},{"type":"file","value":293752},{"type":"file","value":295344},{"type":"file","value":295856},{"type":"file","value":294968},{"type":"file","value":293688},{"type":"file","value":295992},{"type":"file","value":293312},{"type":"file","value":294336},{"type":"file","value":294592},{"type":"file","value":295104},{"type":"file","value":296256},{"type":"file","value":286408},{"type":"file","value":294856},{"type":"file","value":295496},{"type":"file","value":245072},{"type":"file","value":294744},{"type":"file","value":295896},{"type":"file","value":296152},{"type":"file","value":282080},{"type":"file","value":286432},{"type":"file","value":294240},{"type":"file","value":295264},{"type":"file","value":296296},{"type":"file","value":286448},{"type":"file","value":294128},{"type":"file","value":294512},{"type":"file","value":281848}],"captures":{"szVBoxSources":[{"type":"file","value":289184}],"vbox":[{"type":"file","value":296824},{"type":"file","value":281848}],"VBOX":[{"type":"file","value":296832},{"type":"file","value":293312}],"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":244656}],"Checking Win32_PnPDevice DeviceId from WMI for VBox PCI device ":[{"type":"file","value":244912}],"Checking Win32_PnPDevice Name from WMI for VBox controller hardware ":[{"type":"file","value":245072}],"Checking Win32_PnPDevice Name from WMI for VBOX names ":[{"type":"file","value":245248}],"VBoxVBoxVBox":[{"type":"file","value":282080}],"VBoxWddm":[{"type":"file","value":286408}],"VBoxSF":[{"type":"file","value":286432}],"VBoxMouse":[{"type":"file","value":286448}],"VBoxGuest":[{"type":"file","value":286472}],"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":293624}],"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":293688}],"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":293752}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":293936}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":294032}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":294128}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":294240}],"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":294336}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":294432}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":294512}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":294592}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":294664}],"System32\\vboxdisp.dll":[{"type":"file","value":294744}],"System32\\vboxhook.dll":[{"type":"file","value":294800}],"System32\\vboxmrxnp.dll":[{"type":"file","value":294856}],"System32\\vboxogl.dll":[{"type":"file","value":294912}],"System32\\vboxoglarrayspu.dll":[{"type":"file","value":294968}],"System32\\vboxoglcrutil.dll":[{"type":"file","value":295040}],"System32\\vboxoglerrorspu.dll":[{"type":"file","value":295104}],"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":295184}],"System32\\vboxoglpackspu.dll":[{"type":"file","value":295264}],"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":295344}],"System32\\vboxservice.exe":[{"type":"file","value":295432}],"System32\\vboxtray.exe":[{"type":"file","value":295496}],"System32\\VBoxControl.exe":[{"type":"file","value":295552}],"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":295808}],"\\\\.\\VBoxGuest":[{"type":"file","value":295856}],"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":295896}],"\\\\.\\VBoxTrayIPC":[{"type":"file","value":295952}],"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":295992}],"VBoxTrayToolWndClass":[{"type":"file","value":296096}],"VBoxTrayToolWnd":[{"type":"file","value":296152}],"vboxservice.exe":[{"type":"file","value":296256}],"vboxtray.exe":[{"type":"file","value":296296}],"vboxvideo":[{"type":"file","value":296592}],"VBoxVideoW8":[{"type":"file","value":296616}],"VEN_VBOX":[{"type":"file","value":297504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VEN_VBOX/i"}},"children":[],"locations":[{"type":"file","value":297504}],"captures":{"VEN_VBOX":[{"type":"file","value":297504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualBox/i"}},"children":[],"locations":[{"type":"file","value":293824},{"type":"file","value":296192},{"type":"file","value":293368},{"type":"file","value":296808},{"type":"file","value":244272},{"type":"file","value":244336},{"type":"file","value":244784},{"type":"file","value":295664},{"type":"file","value":296336},{"type":"file","value":282392}],"captures":{"VirtualBox":[{"type":"file","value":296808},{"type":"file","value":282392}],"VirtualBox Detection":[{"type":"file","value":244272}],"Checking VirtualBox Guest Additions directory ":[{"type":"file","value":244336}],"Checking VirtualBox Shared Folders network provider ":[{"type":"file","value":244784}],"VIRTUALBOX":[{"type":"file","value":293368}],"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":293824}],"oracle\\virtualbox guest additions\\":[{"type":"file","value":295664}],"VirtualBox Shared Folders":[{"type":"file","value":296192}],"Checking VirtualBox process %s ":[{"type":"file","value":296336}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/06/23/99/i"}},"children":[],"locations":[{"type":"file","value":293440}],"captures":{"06/23/99":[{"type":"file","value":293440}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":293624}],"captures":{"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":293624}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":293688}],"captures":{"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":293688}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":293752}],"captures":{"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":293752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i"}},"children":[],"locations":[{"type":"file","value":293824}],"captures":{"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":293824}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":293936}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":293936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i"}},"children":[],"locations":[{"type":"file","value":294032}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":294032}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i"}},"children":[],"locations":[{"type":"file","value":294128}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":294128}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i"}},"children":[],"locations":[{"type":"file","value":294240}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":294240}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i"}},"children":[],"locations":[{"type":"file","value":294336}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":294336}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294432}],"captures":{"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":294432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294512}],"captures":{"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":294512}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxSF\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294592}],"captures":{"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":294592}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideo\\.sys/i"}},"children":[],"locations":[{"type":"file","value":294664}],"captures":{"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":294664}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxdisp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294744}],"captures":{"System32\\vboxdisp.dll":[{"type":"file","value":294744}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxhook\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294800}],"captures":{"System32\\vboxhook.dll":[{"type":"file","value":294800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxmrxnp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294856}],"captures":{"System32\\vboxmrxnp.dll":[{"type":"file","value":294856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxogl\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294912}],"captures":{"System32\\vboxogl.dll":[{"type":"file","value":294912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglarrayspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":294968}],"captures":{"System32\\vboxoglarrayspu.dll":[{"type":"file","value":294968}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglcrutil\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295040}],"captures":{"System32\\vboxoglcrutil.dll":[{"type":"file","value":295040}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglerrorspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295104}],"captures":{"System32\\vboxoglerrorspu.dll":[{"type":"file","value":295104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglfeedbackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295184}],"captures":{"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":295184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295264}],"captures":{"System32\\vboxoglpackspu.dll":[{"type":"file","value":295264}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpassthroughspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":295344}],"captures":{"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":295344}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295432},{"type":"file","value":296256}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":295432}],"vboxservice.exe":[{"type":"file","value":296256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295496},{"type":"file","value":296296}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":295496}],"vboxtray.exe":[{"type":"file","value":296296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxControl\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295552}],"captures":{"System32\\VBoxControl.exe":[{"type":"file","value":295552}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/oracle\\\\virtualbox guest additions\\\\/i"}},"children":[],"locations":[{"type":"file","value":295664}],"captures":{"oracle\\virtualbox guest additions\\":[{"type":"file","value":295664}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxMiniRdrDN/i"}},"children":[],"locations":[{"type":"file","value":295808}],"captures":{"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":295808}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":295856}],"captures":{"\\\\.\\VBoxGuest":[{"type":"file","value":295856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i"}},"children":[],"locations":[{"type":"file","value":295896}],"captures":{"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":295896}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":295952}],"captures":{"\\\\.\\VBoxTrayIPC":[{"type":"file","value":295952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":295992}],"captures":{"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":295992}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWndClass/i"}},"children":[],"locations":[{"type":"file","value":244656},{"type":"file","value":296096}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":244656}],"VBoxTrayToolWndClass":[{"type":"file","value":296096}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWnd/i"}},"children":[],"locations":[{"type":"file","value":244656},{"type":"file","value":296096},{"type":"file","value":296152}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":244656}],"VBoxTrayToolWndClass":[{"type":"file","value":296096}],"VBoxTrayToolWnd":[{"type":"file","value":296152}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":295432},{"type":"file","value":296256}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":295432}],"vboxservice.exe":[{"type":"file","value":296256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray.exe/i"}},"children":[],"locations":[{"type":"file","value":295496},{"type":"file","value":296296}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":295496}],"vboxtray.exe":[{"type":"file","value":296296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxvideo/i"}},"children":[],"locations":[{"type":"file","value":294336},{"type":"file","value":294664},{"type":"file","value":296592},{"type":"file","value":296616}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":294336}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":294664}],"vboxvideo":[{"type":"file","value":296592}],"VBoxVideoW8":[{"type":"file","value":296616}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideoW8/i"}},"children":[],"locations":[{"type":"file","value":296616}],"captures":{"VBoxVideoW8":[{"type":"file","value":296616}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWddm/i"}},"children":[],"locations":[{"type":"file","value":286408}],"captures":{"VBoxWddm":[{"type":"file","value":286408}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI\\\\VEN_80EE&DEV_CAFE/i"}},"children":[],"locations":[{"type":"file","value":296936}],"captures":{"PCI\\VEN_80EE&DEV_CAFE":[{"type":"file","value":296936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82801FB/i"}},"children":[],"locations":[{"type":"file","value":297008}],"captures":{"82801FB":[{"type":"file","value":297008}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82441FX/i"}},"children":[],"locations":[{"type":"file","value":297032}],"captures":{"82441FX":[{"type":"file","value":297032}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82371SB/i"}},"children":[],"locations":[{"type":"file","value":297056}],"captures":{"82371SB":[{"type":"file","value":297056}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/OpenHCD/i"}},"children":[],"locations":[{"type":"file","value":297080}],"captures":{"OpenHCD":[{"type":"file","value":297080}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ACPIBus_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":297168}],"captures":{"ACPIBus_BUS_0":[{"type":"file","value":297168}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":297208}],"captures":{"PCI_BUS_0":[{"type":"file","value":297208}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PNP_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":297232}],"captures":{"PNP_BUS_0":[{"type":"file","value":297232}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Oracle Corporation/i"}},"children":[],"locations":[{"type":"file","value":297352}],"captures":{"Oracle Corporation":[{"type":"file","value":297352}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWdd/i"}},"children":[],"locations":[{"type":"file","value":286408}],"captures":{"VBoxWddm":[{"type":"file","value":286408}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxS/i","description":"VirtualBox Shared Folders"}},"children":[],"locations":[{"type":"file","value":289184},{"type":"file","value":286432},{"type":"file","value":294240},{"type":"file","value":294128},{"type":"file","value":294592},{"type":"file","value":296256},{"type":"file","value":295432}],"captures":{"szVBoxSources":[{"type":"file","value":289184}],"VBoxSF":[{"type":"file","value":286432}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":294128}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":294240}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":294592}],"System32\\vboxservice.exe":[{"type":"file","value":295432}],"vboxservice.exe":[{"type":"file","value":296256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse/i","description":"VirtualBox Guest Mouse"}},"children":[],"locations":[{"type":"file","value":286448},{"type":"file","value":294432},{"type":"file","value":294032}],"captures":{"VBoxMouse":[{"type":"file","value":286448}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":294032}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":294432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest/i","description":"VirtualBox Guest Driver"}},"children":[],"locations":[{"type":"file","value":286472},{"type":"file","value":293936},{"type":"file","value":294512},{"type":"file","value":295856}],"captures":{"VBoxGuest":[{"type":"file","value":286472}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":293936}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":294512}],"\\\\.\\VBoxGuest":[{"type":"file","value":295856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVBoxVBox/i"}},"children":[],"locations":[{"type":"file","value":282080}],"captures":{"VBoxVBoxVBox":[{"type":"file","value":282080}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/innotek GmbH/i"}},"children":[],"locations":[{"type":"file","value":282480}],"captures":{"innotek GmbH":[{"type":"file","value":282480}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/drivers\\\\vboxdrv/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Qemu":{"meta":{"name":"reference anti-VM strings targeting Qemu","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting Qemu\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /Qemu/i\n      - string: /qemu-ga.exe/i\n      - string: /BOCHS/i\n      - string: /^BXPC/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Qemu/i"}},"children":[],"locations":[{"type":"file","value":282512},{"type":"file","value":246072},{"type":"file","value":285828},{"type":"file","value":281880},{"type":"file","value":285720},{"type":"file","value":285752},{"type":"file","value":285820}],"captures":{"qemu":[{"type":"file","value":281880},{"type":"file","value":285820}],"QEMU":[{"type":"file","value":282512},{"type":"file","value":285828}],"QEMU Detection":[{"type":"file","value":246072}],"qemu-ga.exe":[{"type":"file","value":285720}],"Checking qemu processes %s ":[{"type":"file","value":285752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/qemu-ga.exe/i"}},"children":[],"locations":[{"type":"file","value":285720}],"captures":{"qemu-ga.exe":[{"type":"file","value":285720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/BOCHS/i"}},"children":[],"locations":[{"type":"file","value":285836}],"captures":{"BOCHS":[{"type":"file","value":285836}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^BXPC/i"}},"children":[],"locations":[{"type":"file","value":285844}],"captures":{"BXPC":[{"type":"file","value":285844}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VMWare":{"meta":{"name":"reference anti-VM strings targeting VMWare","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com","@johnk3r"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp"],"examples":["al-khaser_x86.exe_","b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting VMWare\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@johnk3r\"\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp\n    examples:\n      - al-khaser_x86.exe_\n      - b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80\n  features:\n    - or:\n      - string: /VMWare/i\n      - string: /VMTools/i\n      - string: /SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i\n      - string: /vmnet\\.sys/i\n      - string: /vmmouse\\.sys/i\n      - string: /vmusb\\.sys/i\n      - string: /vm3dmp\\.sys/i\n      - string: /vmci\\.sys/i\n      - string: /vmhgfs\\.sys/i\n      - string: /vmmemctl\\.sys/i\n      - string: /vmx86\\.sys/i\n      - string: /vmrawdsk\\.sys/i\n      - string: /vmusbmouse\\.sys/i\n      - string: /vmkdb\\.sys/i\n      - string: /vmnetuserif\\.sys/i\n      - string: /vmnetadapter\\.sys/i\n      - string: /\\\\\\\\.\\\\HGFS/i\n      - string: /\\\\\\\\.\\\\vmci/i\n      - string: /vmtoolsd\\.exe/i\n      - string: /vmwaretray\\.exe/i\n      - string: /vmwareuser\\.exe/i\n      - string: /VGAuthService\\.exe/i\n      - string: /vmacthlp\\.exe/i\n      - string: /vmci/i\n        description: VMWare VMCI Bus Driver\n      - string: /vmhgfs/i\n        description: VMWare Host Guest Control Redirector\n      - string: /vmmouse/i\n      - string: /vmmemctl/i\n        description: VMWare Guest Memory Controller Driver\n      - string: /vmusb/i\n      - string: /vmusbmouse/i\n      - string: /vmx_svga/i\n      - string: /vmxnet/i\n      - string: /vmx86/i\n      - string: /VMwareVMware/i\n      - string: /vmGuestLib\\.dll/i\n      - string: /vmGuestLib\\.dll/i\n      - string: /Applications\\\\VMwareHostOpen\\.exe/i\n      - string: /vm3dgl\\.dll/i\n      - string: /vmdum\\.dll/i\n      - string: /vm3dver\\.dll/i\n      - string: /vmtray\\.dll/i\n      - string: /VMToolsHook\\.dll/i\n      - string: /vmmousever\\.dll/i\n      - string: /VmGuestLibJava\\.dll/i\n      - string: /vmscsi\\.sys/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMWare/i"}},"children":[],"locations":[{"type":"file","value":245856},{"type":"file","value":245952},{"type":"file","value":281984},{"type":"file","value":282208},{"type":"file","value":300864},{"type":"file","value":281864},{"type":"file","value":300200},{"type":"file","value":302216},{"type":"file","value":302444},{"type":"file","value":302256},{"type":"file","value":301880},{"type":"file","value":302452},{"type":"file","value":245816}],"captures":{"VMware":[{"type":"file","value":302444}],"VMWARE":[{"type":"file","value":300200},{"type":"file","value":302452}],"VMWare Detection":[{"type":"file","value":245816}],"Checking VMWare network adapter name ":[{"type":"file","value":245856}],"Checking VMWare directory ":[{"type":"file","value":245952}],"vmware":[{"type":"file","value":281864}],"VMwareVMware":[{"type":"file","value":281984}],"VMWare":[{"type":"file","value":282208}],"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":300864}],"VMWare\\":[{"type":"file","value":301880}],"vmwaretray.exe":[{"type":"file","value":302216}],"vmwareuser.exe":[{"type":"file","value":302256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMTools/i"}},"children":[],"locations":[{"type":"file","value":302184}],"captures":{"vmtoolsd.exe":[{"type":"file","value":302184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i"}},"children":[],"locations":[{"type":"file","value":300864}],"captures":{"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":300864}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnet\\.sys/i"}},"children":[],"locations":[{"type":"file","value":300952}],"captures":{"System32\\drivers\\vmnet.sys":[{"type":"file","value":300952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301016}],"captures":{"System32\\drivers\\vmmouse.sys":[{"type":"file","value":301016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301088}],"captures":{"System32\\drivers\\vmusb.sys":[{"type":"file","value":301088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dmp\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301152}],"captures":{"System32\\drivers\\vm3dmp.sys":[{"type":"file","value":301152}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301224}],"captures":{"System32\\drivers\\vmci.sys":[{"type":"file","value":301224}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301288}],"captures":{"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":301288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301360}],"captures":{"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":301360}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301432}],"captures":{"System32\\drivers\\vmx86.sys":[{"type":"file","value":301432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmrawdsk\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301496}],"captures":{"System32\\drivers\\vmrawdsk.sys":[{"type":"file","value":301496}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301568}],"captures":{"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":301568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmkdb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301648}],"captures":{"System32\\drivers\\vmkdb.sys":[{"type":"file","value":301648}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetuserif\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301712}],"captures":{"System32\\drivers\\vmnetuserif.sys":[{"type":"file","value":301712}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetadapter\\.sys/i"}},"children":[],"locations":[{"type":"file","value":301792}],"captures":{"System32\\drivers\\vmnetadapter.sys":[{"type":"file","value":301792}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\HGFS/i"}},"children":[],"locations":[{"type":"file","value":302136}],"captures":{"\\\\.\\HGFS":[{"type":"file","value":302136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\vmci/i"}},"children":[],"locations":[{"type":"file","value":302160}],"captures":{"\\\\.\\vmci":[{"type":"file","value":302160}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtoolsd\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302184}],"captures":{"vmtoolsd.exe":[{"type":"file","value":302184}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwaretray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302216}],"captures":{"vmwaretray.exe":[{"type":"file","value":302216}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwareuser\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302256}],"captures":{"vmwareuser.exe":[{"type":"file","value":302256}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VGAuthService\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302296}],"captures":{"VGAuthService.exe":[{"type":"file","value":302296}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmacthlp\\.exe/i"}},"children":[],"locations":[{"type":"file","value":302344}],"captures":{"vmacthlp.exe":[{"type":"file","value":302344}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci/i","description":"VMWare VMCI Bus Driver"}},"children":[],"locations":[{"type":"file","value":286496},{"type":"file","value":302160},{"type":"file","value":301224}],"captures":{"vmci":[{"type":"file","value":286496}],"System32\\drivers\\vmci.sys":[{"type":"file","value":301224}],"\\\\.\\vmci":[{"type":"file","value":302160}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs/i","description":"VMWare Host Guest Control Redirector"}},"children":[],"locations":[{"type":"file","value":286512},{"type":"file","value":301288}],"captures":{"vmhgfs":[{"type":"file","value":286512}],"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":301288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse/i"}},"children":[],"locations":[{"type":"file","value":286528},{"type":"file","value":301016}],"captures":{"vmmouse":[{"type":"file","value":286528}],"System32\\drivers\\vmmouse.sys":[{"type":"file","value":301016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl/i","description":"VMWare Guest Memory Controller Driver"}},"children":[],"locations":[{"type":"file","value":286552},{"type":"file","value":301360}],"captures":{"vmmemctl":[{"type":"file","value":286552}],"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":301360}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb/i"}},"children":[],"locations":[{"type":"file","value":286576},{"type":"file","value":301568},{"type":"file","value":301088},{"type":"file","value":286592}],"captures":{"vmusb":[{"type":"file","value":286576}],"vmusbmouse":[{"type":"file","value":286592}],"System32\\drivers\\vmusb.sys":[{"type":"file","value":301088}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":301568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse/i"}},"children":[],"locations":[{"type":"file","value":286592},{"type":"file","value":301568}],"captures":{"vmusbmouse":[{"type":"file","value":286592}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":301568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx_svga/i"}},"children":[],"locations":[{"type":"file","value":286624}],"captures":{"vmx_svga":[{"type":"file","value":286624}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmxnet/i"}},"children":[],"locations":[{"type":"file","value":286648}],"captures":{"vmxnet":[{"type":"file","value":286648}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86/i"}},"children":[],"locations":[{"type":"file","value":286664},{"type":"file","value":301432}],"captures":{"vmx86":[{"type":"file","value":286664}],"System32\\drivers\\vmx86.sys":[{"type":"file","value":301432}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMwareVMware/i"}},"children":[],"locations":[{"type":"file","value":281984}],"captures":{"VMwareVMware":[{"type":"file","value":281984}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Applications\\\\VMwareHostOpen\\.exe/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dgl\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmdum\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dver\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtray\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMToolsHook\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmousever\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VmGuestLibJava\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmscsi\\.sys/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read raw disk data":{"meta":{"name":"read raw disk data","namespace":"host-interaction/file-system","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read raw disk data\n    namespace: host-interaction/file-system\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n  features:\n    - or:\n      - string: \"\\\\\\\\.\\\\PhysicalDrive0\"\n      - string: \"\\\\\\\\.\\\\C:\"\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\PhysicalDrive0"}},"children":[],"locations":[{"type":"file","value":281800}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\C:"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
diff --git a/rd/al-khaser_x86.exe_.json b/rd/al-khaser_x86.exe_.json
index d05eb31..894f662 100644
--- a/rd/al-khaser_x86.exe_.json
+++ b/rd/al-khaser_x86.exe_.json
@@ -1 +1 @@
-{"meta":{"timestamp":"2024-03-02T04:12:07.225950","version":"7.0.1","argv":["./tests/data/al-khaser_x86.exe_","-j"],"sample":{"md5":"db648cd247281954344f1d810c6fd590","sha1":"a457931874ba395917da2ab060c02159f2c418ec","sha256":"faf351db4072395ca1e2855a379b120cdbccdb09131c48463e30dccf4245f4bb","path":"C:/Users/HP/Documents/GitHub/capa/tests/data/al-khaser_x86.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"i386","os":"windows","extractor":"VivisectFeatureExtractor","rules":["C:/Users/HP/Documents/GitHub/capa/rules"],"base_address":{"type":"absolute","value":4194304},"layout":{"functions":[{"address":{"type":"absolute","value":4300815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337168}}]},{"address":{"type":"absolute","value":4300820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483968}}]},{"address":{"type":"absolute","value":4300825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335440}}]},{"address":{"type":"absolute","value":4300835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344432}}]},{"address":{"type":"absolute","value":4300840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4454624}},{"address":{"type":"absolute","value":4454700}},{"address":{"type":"absolute","value":4454776}},{"address":{"type":"absolute","value":4454793}},{"address":{"type":"absolute","value":4454883}},{"address":{"type":"absolute","value":4454986}},{"address":{"type":"absolute","value":4455003}},{"address":{"type":"absolute","value":4455048}}]},{"address":{"type":"absolute","value":4300850},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360720}},{"address":{"type":"absolute","value":4360883}},{"address":{"type":"absolute","value":4361222}}]},{"address":{"type":"absolute","value":4300855},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390032}}]},{"address":{"type":"absolute","value":4300865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4478304}},{"address":{"type":"absolute","value":4478482}}]},{"address":{"type":"absolute","value":4300870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358080}}]},{"address":{"type":"absolute","value":4300875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348000}},{"address":{"type":"absolute","value":4348102}}]},{"address":{"type":"absolute","value":4300880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467136}}]},{"address":{"type":"absolute","value":4300885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389600}}]},{"address":{"type":"absolute","value":4300890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325600}},{"address":{"type":"absolute","value":4325779}}]},{"address":{"type":"absolute","value":4300895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4380400}},{"address":{"type":"absolute","value":4380517}},{"address":{"type":"absolute","value":4380558}},{"address":{"type":"absolute","value":4380571}},{"address":{"type":"absolute","value":4380632}},{"address":{"type":"absolute","value":4380677}},{"address":{"type":"absolute","value":4380748}},{"address":{"type":"absolute","value":4380879}}]},{"address":{"type":"absolute","value":4300900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342752}}]},{"address":{"type":"absolute","value":4300905},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506683}},{"address":{"type":"absolute","value":4507003}},{"address":{"type":"absolute","value":4507056}},{"address":{"type":"absolute","value":4507122}},{"address":{"type":"absolute","value":4507159}},{"address":{"type":"absolute","value":4507263}}]},{"address":{"type":"absolute","value":4300910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333856}}]},{"address":{"type":"absolute","value":4300915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461504}},{"address":{"type":"absolute","value":4461599}},{"address":{"type":"absolute","value":4461623}}]},{"address":{"type":"absolute","value":4300925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345920}}]},{"address":{"type":"absolute","value":4300945},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486000}}]},{"address":{"type":"absolute","value":4300950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335136}}]},{"address":{"type":"absolute","value":4300960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4414048}},{"address":{"type":"absolute","value":4414199}}]},{"address":{"type":"absolute","value":4300975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4434576}},{"address":{"type":"absolute","value":4434658}},{"address":{"type":"absolute","value":4434680}},{"address":{"type":"absolute","value":4434768}},{"address":{"type":"absolute","value":4434787}},{"address":{"type":"absolute","value":4434809}}]},{"address":{"type":"absolute","value":4300980},"matched_basic_blocks":[{"address":{"type":"absolute","value":4421904}},{"address":{"type":"absolute","value":4422014}},{"address":{"type":"absolute","value":4422036}},{"address":{"type":"absolute","value":4422192}},{"address":{"type":"absolute","value":4422211}},{"address":{"type":"absolute","value":4422233}}]},{"address":{"type":"absolute","value":4300985},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390832}}]},{"address":{"type":"absolute","value":4300990},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469680}}]},{"address":{"type":"absolute","value":4301005},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432688}},{"address":{"type":"absolute","value":4432807}},{"address":{"type":"absolute","value":4432974}},{"address":{"type":"absolute","value":4433141}}]},{"address":{"type":"absolute","value":4301010},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344832}}]},{"address":{"type":"absolute","value":4301025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4446336}},{"address":{"type":"absolute","value":4446487}},{"address":{"type":"absolute","value":4446539}},{"address":{"type":"absolute","value":4446591}},{"address":{"type":"absolute","value":4446649}},{"address":{"type":"absolute","value":4446672}},{"address":{"type":"absolute","value":4446754}},{"address":{"type":"absolute","value":4446777}},{"address":{"type":"absolute","value":4446852}},{"address":{"type":"absolute","value":4446875}},{"address":{"type":"absolute","value":4447044}},{"address":{"type":"absolute","value":4447067}},{"address":{"type":"absolute","value":4447133}},{"address":{"type":"absolute","value":4447156}},{"address":{"type":"absolute","value":4447388}},{"address":{"type":"absolute","value":4447403}},{"address":{"type":"absolute","value":4447545}}]},{"address":{"type":"absolute","value":4301035},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506064}}]},{"address":{"type":"absolute","value":4301050},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363728}}]},{"address":{"type":"absolute","value":4301055},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470192}}]},{"address":{"type":"absolute","value":4301060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426480}},{"address":{"type":"absolute","value":4426650}},{"address":{"type":"absolute","value":4426678}}]},{"address":{"type":"absolute","value":4301070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371024}}]},{"address":{"type":"absolute","value":4301075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4499898}},{"address":{"type":"absolute","value":4499919}}]},{"address":{"type":"absolute","value":4301080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390320}}]},{"address":{"type":"absolute","value":4301085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404112}},{"address":{"type":"absolute","value":4404183}}]},{"address":{"type":"absolute","value":4301090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485552}}]},{"address":{"type":"absolute","value":4301095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342352}},{"address":{"type":"absolute","value":4342446}},{"address":{"type":"absolute","value":4342501}}]},{"address":{"type":"absolute","value":4301110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442779}},{"address":{"type":"absolute","value":4442801}},{"address":{"type":"absolute","value":4442889}},{"address":{"type":"absolute","value":4442908}},{"address":{"type":"absolute","value":4442930}}]},{"address":{"type":"absolute","value":4301115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383824}}]},{"address":{"type":"absolute","value":4301120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4448064}},{"address":{"type":"absolute","value":4448249}}]},{"address":{"type":"absolute","value":4301125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369232}},{"address":{"type":"absolute","value":4369312}},{"address":{"type":"absolute","value":4369433}},{"address":{"type":"absolute","value":4370126}}]},{"address":{"type":"absolute","value":4301135},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349120}}]},{"address":{"type":"absolute","value":4301140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339648}},{"address":{"type":"absolute","value":4339840}},{"address":{"type":"absolute","value":4339870}},{"address":{"type":"absolute","value":4340285}},{"address":{"type":"absolute","value":4340318}},{"address":{"type":"absolute","value":4340564}}]},{"address":{"type":"absolute","value":4301150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4430528}},{"address":{"type":"absolute","value":4430647}},{"address":{"type":"absolute","value":4430823}},{"address":{"type":"absolute","value":4430990}}]},{"address":{"type":"absolute","value":4301155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356416}}]},{"address":{"type":"absolute","value":4301160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4405952}},{"address":{"type":"absolute","value":4406073}}]},{"address":{"type":"absolute","value":4301165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4323856}}]},{"address":{"type":"absolute","value":4301190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470320}}]},{"address":{"type":"absolute","value":4301195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391104}}]},{"address":{"type":"absolute","value":4301200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460272}},{"address":{"type":"absolute","value":4460360}},{"address":{"type":"absolute","value":4460389}},{"address":{"type":"absolute","value":4460412}},{"address":{"type":"absolute","value":4460460}},{"address":{"type":"absolute","value":4460528}}]},{"address":{"type":"absolute","value":4301205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4381680}},{"address":{"type":"absolute","value":4381761}},{"address":{"type":"absolute","value":4381788}}]},{"address":{"type":"absolute","value":4301210},"matched_basic_blocks":[{"address":{"type":"absolute","value":4465728}},{"address":{"type":"absolute","value":4465885}},{"address":{"type":"absolute","value":4465915}},{"address":{"type":"absolute","value":4465955}},{"address":{"type":"absolute","value":4465985}},{"address":{"type":"absolute","value":4466033}},{"address":{"type":"absolute","value":4466106}},{"address":{"type":"absolute","value":4466151}}]},{"address":{"type":"absolute","value":4301215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384688}}]},{"address":{"type":"absolute","value":4301220},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365024}},{"address":{"type":"absolute","value":4365097}},{"address":{"type":"absolute","value":4365120}},{"address":{"type":"absolute","value":4365150}}]},{"address":{"type":"absolute","value":4301230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368947}},{"address":{"type":"absolute","value":4368961}}]},{"address":{"type":"absolute","value":4301240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4386512}},{"address":{"type":"absolute","value":4386637}},{"address":{"type":"absolute","value":4386719}}]},{"address":{"type":"absolute","value":4301245},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391888}}]},{"address":{"type":"absolute","value":4301255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471120}}]},{"address":{"type":"absolute","value":4301265},"matched_basic_blocks":[{"address":{"type":"absolute","value":4489136}},{"address":{"type":"absolute","value":4489289}},{"address":{"type":"absolute","value":4489406}},{"address":{"type":"absolute","value":4489435}}]},{"address":{"type":"absolute","value":4301270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347472}},{"address":{"type":"absolute","value":4347546}}]},{"address":{"type":"absolute","value":4301275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484400}},{"address":{"type":"absolute","value":4484521}},{"address":{"type":"absolute","value":4484560}}]},{"address":{"type":"absolute","value":4301280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4411616}},{"address":{"type":"absolute","value":4411735}},{"address":{"type":"absolute","value":4412204}}]},{"address":{"type":"absolute","value":4301300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365648}}]},{"address":{"type":"absolute","value":4301305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461216}},{"address":{"type":"absolute","value":4461284}}]},{"address":{"type":"absolute","value":4301310},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365792}}]},{"address":{"type":"absolute","value":4301315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387728}}]},{"address":{"type":"absolute","value":4301320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334640}}]},{"address":{"type":"absolute","value":4301335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385408}}]},{"address":{"type":"absolute","value":4301355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464976}},{"address":{"type":"absolute","value":4465042}},{"address":{"type":"absolute","value":4465079}},{"address":{"type":"absolute","value":4465145}},{"address":{"type":"absolute","value":4465202}},{"address":{"type":"absolute","value":4465236}},{"address":{"type":"absolute","value":4465270}},{"address":{"type":"absolute","value":4465311}},{"address":{"type":"absolute","value":4465355}},{"address":{"type":"absolute","value":4465399}},{"address":{"type":"absolute","value":4465433}},{"address":{"type":"absolute","value":4465499}}]},{"address":{"type":"absolute","value":4301370},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483136}},{"address":{"type":"absolute","value":4483230}},{"address":{"type":"absolute","value":4483285}}]},{"address":{"type":"absolute","value":4301380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468800}},{"address":{"type":"absolute","value":4468963}},{"address":{"type":"absolute","value":4469302}}]},{"address":{"type":"absolute","value":4301385},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344304}}]},{"address":{"type":"absolute","value":4301390},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365360}}]},{"address":{"type":"absolute","value":4301395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4475968}},{"address":{"type":"absolute","value":4476043}},{"address":{"type":"absolute","value":4476131}}]},{"address":{"type":"absolute","value":4301405},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357104}}]},{"address":{"type":"absolute","value":4301410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470448}},{"address":{"type":"absolute","value":4470521}},{"address":{"type":"absolute","value":4470544}},{"address":{"type":"absolute","value":4470574}}]},{"address":{"type":"absolute","value":4301420},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332752}},{"address":{"type":"absolute","value":4332821}},{"address":{"type":"absolute","value":4332836}},{"address":{"type":"absolute","value":4332872}},{"address":{"type":"absolute","value":4332900}}]},{"address":{"type":"absolute","value":4301425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366224}}]},{"address":{"type":"absolute","value":4301435},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469520}}]},{"address":{"type":"absolute","value":4301440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327968}},{"address":{"type":"absolute","value":4328049}},{"address":{"type":"absolute","value":4328090}},{"address":{"type":"absolute","value":4328192}}]},{"address":{"type":"absolute","value":4301445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383152}}]},{"address":{"type":"absolute","value":4301455},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350336}}]},{"address":{"type":"absolute","value":4301460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4341008}},{"address":{"type":"absolute","value":4341200}},{"address":{"type":"absolute","value":4341226}},{"address":{"type":"absolute","value":4341299}},{"address":{"type":"absolute","value":4341339}}]},{"address":{"type":"absolute","value":4301480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392320}}]},{"address":{"type":"absolute","value":4301485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390944}}]},{"address":{"type":"absolute","value":4301505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503584}},{"address":{"type":"absolute","value":4503636}},{"address":{"type":"absolute","value":4503669}}]},{"address":{"type":"absolute","value":4301510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415136}},{"address":{"type":"absolute","value":4415207}}]},{"address":{"type":"absolute","value":4301515},"matched_basic_blocks":[{"address":{"type":"absolute","value":4430096}},{"address":{"type":"absolute","value":4430192}},{"address":{"type":"absolute","value":4430262}},{"address":{"type":"absolute","value":4430290}},{"address":{"type":"absolute","value":4430325}},{"address":{"type":"absolute","value":4430347}}]},{"address":{"type":"absolute","value":4301520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426944}},{"address":{"type":"absolute","value":4427093}},{"address":{"type":"absolute","value":4427461}},{"address":{"type":"absolute","value":4427556}},{"address":{"type":"absolute","value":4427637}},{"address":{"type":"absolute","value":4427664}},{"address":{"type":"absolute","value":4427884}}]},{"address":{"type":"absolute","value":4301525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483680}}]},{"address":{"type":"absolute","value":4301535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360048}}]},{"address":{"type":"absolute","value":4301545},"matched_basic_blocks":[{"address":{"type":"absolute","value":4428512}},{"address":{"type":"absolute","value":4428840}},{"address":{"type":"absolute","value":4428871}},{"address":{"type":"absolute","value":4428997}},{"address":{"type":"absolute","value":4429016}},{"address":{"type":"absolute","value":4429069}}]},{"address":{"type":"absolute","value":4301550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325376}}]},{"address":{"type":"absolute","value":4301555},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351792}},{"address":{"type":"absolute","value":4351915}},{"address":{"type":"absolute","value":4351994}},{"address":{"type":"absolute","value":4352050}},{"address":{"type":"absolute","value":4352064}},{"address":{"type":"absolute","value":4352103}},{"address":{"type":"absolute","value":4352146}},{"address":{"type":"absolute","value":4352314}},{"address":{"type":"absolute","value":4352341}},{"address":{"type":"absolute","value":4352428}},{"address":{"type":"absolute","value":4352450}}]},{"address":{"type":"absolute","value":4301570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332192}},{"address":{"type":"absolute","value":4332556}}]},{"address":{"type":"absolute","value":4301575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339200}}]},{"address":{"type":"absolute","value":4301580},"matched_basic_blocks":[{"address":{"type":"absolute","value":4505984}}]},{"address":{"type":"absolute","value":4301585},"matched_basic_blocks":[{"address":{"type":"absolute","value":4409840}},{"address":{"type":"absolute","value":4409912}}]},{"address":{"type":"absolute","value":4301590},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346064}}]},{"address":{"type":"absolute","value":4301595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466416}}]},{"address":{"type":"absolute","value":4301600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4463168}},{"address":{"type":"absolute","value":4463284}},{"address":{"type":"absolute","value":4463357}},{"address":{"type":"absolute","value":4463458}}]},{"address":{"type":"absolute","value":4301605},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389168}}]},{"address":{"type":"absolute","value":4301615},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379152}},{"address":{"type":"absolute","value":4379270}}]},{"address":{"type":"absolute","value":4301625},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493425}},{"address":{"type":"absolute","value":4493440}},{"address":{"type":"absolute","value":4493576}}]},{"address":{"type":"absolute","value":4301630},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351632}}]},{"address":{"type":"absolute","value":4301635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485040}}]},{"address":{"type":"absolute","value":4301650},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351488}}]},{"address":{"type":"absolute","value":4301655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350720}}]},{"address":{"type":"absolute","value":4301665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363552}}]},{"address":{"type":"absolute","value":4301690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436256}}]},{"address":{"type":"absolute","value":4301695},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353232}}]},{"address":{"type":"absolute","value":4301710},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385120}}]},{"address":{"type":"absolute","value":4301725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482512}},{"address":{"type":"absolute","value":4482593}},{"address":{"type":"absolute","value":4482620}}]},{"address":{"type":"absolute","value":4301730},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452864}}]},{"address":{"type":"absolute","value":4301740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4403984}},{"address":{"type":"absolute","value":4404055}}]},{"address":{"type":"absolute","value":4301755},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470640}},{"address":{"type":"absolute","value":4470713}},{"address":{"type":"absolute","value":4470736}},{"address":{"type":"absolute","value":4470766}}]},{"address":{"type":"absolute","value":4301760},"matched_basic_blocks":[{"address":{"type":"absolute","value":4476992}},{"address":{"type":"absolute","value":4477096}},{"address":{"type":"absolute","value":4477149}},{"address":{"type":"absolute","value":4477360}}]},{"address":{"type":"absolute","value":4301765},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363152}}]},{"address":{"type":"absolute","value":4301770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500896}}]},{"address":{"type":"absolute","value":4301785},"matched_basic_blocks":[{"address":{"type":"absolute","value":4448400}},{"address":{"type":"absolute","value":4448564}},{"address":{"type":"absolute","value":4448592}},{"address":{"type":"absolute","value":4448647}},{"address":{"type":"absolute","value":4448667}},{"address":{"type":"absolute","value":4448722}},{"address":{"type":"absolute","value":4448742}},{"address":{"type":"absolute","value":4448826}},{"address":{"type":"absolute","value":4448846}},{"address":{"type":"absolute","value":4448998}},{"address":{"type":"absolute","value":4449016}},{"address":{"type":"absolute","value":4449085}},{"address":{"type":"absolute","value":4449103}},{"address":{"type":"absolute","value":4449187}},{"address":{"type":"absolute","value":4449271}},{"address":{"type":"absolute","value":4449335}},{"address":{"type":"absolute","value":4449489}}]},{"address":{"type":"absolute","value":4301790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344560}}]},{"address":{"type":"absolute","value":4301810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388240}}]},{"address":{"type":"absolute","value":4301815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346384}}]},{"address":{"type":"absolute","value":4301820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342080}}]},{"address":{"type":"absolute","value":4301825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367360}}]},{"address":{"type":"absolute","value":4301835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4399152}},{"address":{"type":"absolute","value":4399247}},{"address":{"type":"absolute","value":4399284}},{"address":{"type":"absolute","value":4399322}},{"address":{"type":"absolute","value":4399385}},{"address":{"type":"absolute","value":4399452}},{"address":{"type":"absolute","value":4399467}},{"address":{"type":"absolute","value":4399508}},{"address":{"type":"absolute","value":4399631}},{"address":{"type":"absolute","value":4399680}},{"address":{"type":"absolute","value":4399810}}]},{"address":{"type":"absolute","value":4301860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333602}},{"address":{"type":"absolute","value":4333668}}]},{"address":{"type":"absolute","value":4301865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345072}}]},{"address":{"type":"absolute","value":4301870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319424}},{"address":{"type":"absolute","value":4319504}},{"address":{"type":"absolute","value":4319520}}]},{"address":{"type":"absolute","value":4301875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358416}}]},{"address":{"type":"absolute","value":4301880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394944}}]},{"address":{"type":"absolute","value":4301885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353952}}]},{"address":{"type":"absolute","value":4301895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452576}}]},{"address":{"type":"absolute","value":4301900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339504}}]},{"address":{"type":"absolute","value":4301905},"matched_basic_blocks":[{"address":{"type":"absolute","value":4411256}},{"address":{"type":"absolute","value":4411278}},{"address":{"type":"absolute","value":4411378}},{"address":{"type":"absolute","value":4411397}},{"address":{"type":"absolute","value":4411419}}]},{"address":{"type":"absolute","value":4301910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415392}},{"address":{"type":"absolute","value":4415463}}]},{"address":{"type":"absolute","value":4301915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4444272}},{"address":{"type":"absolute","value":4444419}},{"address":{"type":"absolute","value":4444470}},{"address":{"type":"absolute","value":4444488}},{"address":{"type":"absolute","value":4444542}},{"address":{"type":"absolute","value":4444605}},{"address":{"type":"absolute","value":4444623}},{"address":{"type":"absolute","value":4444724}},{"address":{"type":"absolute","value":4444827}},{"address":{"type":"absolute","value":4444850}},{"address":{"type":"absolute","value":4444950}},{"address":{"type":"absolute","value":4445082}},{"address":{"type":"absolute","value":4445146}},{"address":{"type":"absolute","value":4445229}},{"address":{"type":"absolute","value":4445262}},{"address":{"type":"absolute","value":4445368}},{"address":{"type":"absolute","value":4445726}}]},{"address":{"type":"absolute","value":4301925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492560}}]},{"address":{"type":"absolute","value":4301940},"matched_basic_blocks":[{"address":{"type":"absolute","value":4423184}},{"address":{"type":"absolute","value":4423291}},{"address":{"type":"absolute","value":4423423}},{"address":{"type":"absolute","value":4423467}},{"address":{"type":"absolute","value":4423557}},{"address":{"type":"absolute","value":4423574}},{"address":{"type":"absolute","value":4423598}}]},{"address":{"type":"absolute","value":4301950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4324016}}]},{"address":{"type":"absolute","value":4301960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4494608}},{"address":{"type":"absolute","value":4494774}},{"address":{"type":"absolute","value":4494826}},{"address":{"type":"absolute","value":4494864}},{"address":{"type":"absolute","value":4494903}},{"address":{"type":"absolute","value":4494989}}]},{"address":{"type":"absolute","value":4301970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353808}}]},{"address":{"type":"absolute","value":4301985},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338000}}]},{"address":{"type":"absolute","value":4301995},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391440}}]},{"address":{"type":"absolute","value":4302000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393840}}]},{"address":{"type":"absolute","value":4302015},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394112}},{"address":{"type":"absolute","value":4394169}},{"address":{"type":"absolute","value":4394198}},{"address":{"type":"absolute","value":4394211}}]},{"address":{"type":"absolute","value":4302020},"matched_basic_blocks":[{"address":{"type":"absolute","value":4437312}},{"address":{"type":"absolute","value":4437394}},{"address":{"type":"absolute","value":4437416}},{"address":{"type":"absolute","value":4437534}},{"address":{"type":"absolute","value":4437572}},{"address":{"type":"absolute","value":4437594}}]},{"address":{"type":"absolute","value":4302035},"matched_basic_blocks":[{"address":{"type":"absolute","value":4418816}},{"address":{"type":"absolute","value":4418887}}]},{"address":{"type":"absolute","value":4302040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382480}},{"address":{"type":"absolute","value":4382574}},{"address":{"type":"absolute","value":4382629}}]},{"address":{"type":"absolute","value":4302060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338432}}]},{"address":{"type":"absolute","value":4302070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496742}}]},{"address":{"type":"absolute","value":4302075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326576}}]},{"address":{"type":"absolute","value":4302085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415792}},{"address":{"type":"absolute","value":4415911}},{"address":{"type":"absolute","value":4416218}}]},{"address":{"type":"absolute","value":4302100},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402352}},{"address":{"type":"absolute","value":4402423}}]},{"address":{"type":"absolute","value":4302105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431328}},{"address":{"type":"absolute","value":4431497}}]},{"address":{"type":"absolute","value":4302110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4419312}},{"address":{"type":"absolute","value":4419431}},{"address":{"type":"absolute","value":4419534}},{"address":{"type":"absolute","value":4419725}}]},{"address":{"type":"absolute","value":4302115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456336}}]},{"address":{"type":"absolute","value":4302120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371984}}]},{"address":{"type":"absolute","value":4302125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382752}},{"address":{"type":"absolute","value":4382906}}]},{"address":{"type":"absolute","value":4302130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456976}}]},{"address":{"type":"absolute","value":4302140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384256}}]},{"address":{"type":"absolute","value":4302150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345168}}]},{"address":{"type":"absolute","value":4302155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345664}}]},{"address":{"type":"absolute","value":4302160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357658}},{"address":{"type":"absolute","value":4357682}},{"address":{"type":"absolute","value":4357705}}]},{"address":{"type":"absolute","value":4302165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334320}},{"address":{"type":"absolute","value":4334384}},{"address":{"type":"absolute","value":4334407}},{"address":{"type":"absolute","value":4334452}},{"address":{"type":"absolute","value":4334497}}]},{"address":{"type":"absolute","value":4302170},"matched_basic_blocks":[{"address":{"type":"absolute","value":4477552}},{"address":{"type":"absolute","value":4477620}},{"address":{"type":"absolute","value":4477682}},{"address":{"type":"absolute","value":4477717}},{"address":{"type":"absolute","value":4477768}},{"address":{"type":"absolute","value":4477894}},{"address":{"type":"absolute","value":4478038}},{"address":{"type":"absolute","value":4478129}}]},{"address":{"type":"absolute","value":4302175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4403856}},{"address":{"type":"absolute","value":4403927}}]},{"address":{"type":"absolute","value":4302180},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455424}}]},{"address":{"type":"absolute","value":4302190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453585}},{"address":{"type":"absolute","value":4453660}},{"address":{"type":"absolute","value":4453700}}]},{"address":{"type":"absolute","value":4302200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471264}}]},{"address":{"type":"absolute","value":4302205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4512199}}]},{"address":{"type":"absolute","value":4302215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496208}},{"address":{"type":"absolute","value":4496475}}]},{"address":{"type":"absolute","value":4302225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4488864}}]},{"address":{"type":"absolute","value":4302230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384400}}]},{"address":{"type":"absolute","value":4302235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344000}},{"address":{"type":"absolute","value":4344125}},{"address":{"type":"absolute","value":4344207}}]},{"address":{"type":"absolute","value":4302245},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394816}}]},{"address":{"type":"absolute","value":4302250},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363392}}]},{"address":{"type":"absolute","value":4302255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389024}}]},{"address":{"type":"absolute","value":4302260},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348800}},{"address":{"type":"absolute","value":4348879}},{"address":{"type":"absolute","value":4348936}},{"address":{"type":"absolute","value":4348945}},{"address":{"type":"absolute","value":4348984}},{"address":{"type":"absolute","value":4349020}}]},{"address":{"type":"absolute","value":4302270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4425888}}]},{"address":{"type":"absolute","value":4302275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4400848}},{"address":{"type":"absolute","value":4400905}},{"address":{"type":"absolute","value":4400968}}]},{"address":{"type":"absolute","value":4302280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492912}}]},{"address":{"type":"absolute","value":4302285},"matched_basic_blocks":[{"address":{"type":"absolute","value":4495504}},{"address":{"type":"absolute","value":4495725}}]},{"address":{"type":"absolute","value":4302290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358672}}]},{"address":{"type":"absolute","value":4302295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369059}},{"address":{"type":"absolute","value":4369073}}]},{"address":{"type":"absolute","value":4302300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491536}},{"address":{"type":"absolute","value":4491634}}]},{"address":{"type":"absolute","value":4302305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472528}},{"address":{"type":"absolute","value":4472638}},{"address":{"type":"absolute","value":4472673}},{"address":{"type":"absolute","value":4472767}},{"address":{"type":"absolute","value":4472782}}]},{"address":{"type":"absolute","value":4302320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402704}},{"address":{"type":"absolute","value":4402775}}]},{"address":{"type":"absolute","value":4302325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452288}}]},{"address":{"type":"absolute","value":4302335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364560}}]},{"address":{"type":"absolute","value":4302340},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388496}}]},{"address":{"type":"absolute","value":4302345},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506592}}]},{"address":{"type":"absolute","value":4302350},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467216}}]},{"address":{"type":"absolute","value":4302355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357802}},{"address":{"type":"absolute","value":4357835}},{"address":{"type":"absolute","value":4357851}},{"address":{"type":"absolute","value":4357901}}]},{"address":{"type":"absolute","value":4302360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4396672}}]},{"address":{"type":"absolute","value":4302365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355984}}]},{"address":{"type":"absolute","value":4302370},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356800}}]},{"address":{"type":"absolute","value":4302375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4502156}}]},{"address":{"type":"absolute","value":4302380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333440}}]},{"address":{"type":"absolute","value":4302395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4372080}}]},{"address":{"type":"absolute","value":4302410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364832}},{"address":{"type":"absolute","value":4364905}},{"address":{"type":"absolute","value":4364928}},{"address":{"type":"absolute","value":4364958}}]},{"address":{"type":"absolute","value":4302420},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453825}},{"address":{"type":"absolute","value":4453844}},{"address":{"type":"absolute","value":4454055}}]},{"address":{"type":"absolute","value":4302425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326500}},{"address":{"type":"absolute","value":4326526}}]},{"address":{"type":"absolute","value":4302430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4499793}}]},{"address":{"type":"absolute","value":4302435},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363904}}]},{"address":{"type":"absolute","value":4302440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363472}}]},{"address":{"type":"absolute","value":4302445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338576}}]},{"address":{"type":"absolute","value":4302450},"matched_basic_blocks":[{"address":{"type":"absolute","value":4454209}},{"address":{"type":"absolute","value":4454261}},{"address":{"type":"absolute","value":4454301}}]},{"address":{"type":"absolute","value":4302460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389312}}]},{"address":{"type":"absolute","value":4302465},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442000}},{"address":{"type":"absolute","value":4442069}},{"address":{"type":"absolute","value":4442125}}]},{"address":{"type":"absolute","value":4302470},"matched_basic_blocks":[{"address":{"type":"absolute","value":4386816}},{"address":{"type":"absolute","value":4386941}},{"address":{"type":"absolute","value":4387023}}]},{"address":{"type":"absolute","value":4302475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459424}},{"address":{"type":"absolute","value":4459650}}]},{"address":{"type":"absolute","value":4302480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431680}},{"address":{"type":"absolute","value":4431799}},{"address":{"type":"absolute","value":4432007}},{"address":{"type":"absolute","value":4432028}},{"address":{"type":"absolute","value":4432045}},{"address":{"type":"absolute","value":4432066}},{"address":{"type":"absolute","value":4432083}},{"address":{"type":"absolute","value":4432104}},{"address":{"type":"absolute","value":4432121}},{"address":{"type":"absolute","value":4432142}},{"address":{"type":"absolute","value":4432304}}]},{"address":{"type":"absolute","value":4302495},"matched_basic_blocks":[{"address":{"type":"absolute","value":4439168}},{"address":{"type":"absolute","value":4439264}},{"address":{"type":"absolute","value":4439319}},{"address":{"type":"absolute","value":4439361}},{"address":{"type":"absolute","value":4439378}},{"address":{"type":"absolute","value":4439421}},{"address":{"type":"absolute","value":4439470}},{"address":{"type":"absolute","value":4439497}},{"address":{"type":"absolute","value":4439522}}]},{"address":{"type":"absolute","value":4302510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366368}}]},{"address":{"type":"absolute","value":4302525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485296}}]},{"address":{"type":"absolute","value":4302530},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485168}}]},{"address":{"type":"absolute","value":4302535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436843}},{"address":{"type":"absolute","value":4436865}},{"address":{"type":"absolute","value":4436958}},{"address":{"type":"absolute","value":4436977}},{"address":{"type":"absolute","value":4436999}}]},{"address":{"type":"absolute","value":4302560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359104}}]},{"address":{"type":"absolute","value":4302565},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346608}},{"address":{"type":"absolute","value":4346748}}]},{"address":{"type":"absolute","value":4302570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367568}}]},{"address":{"type":"absolute","value":4302585},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347856}}]},{"address":{"type":"absolute","value":4302595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4352928}},{"address":{"type":"absolute","value":4353024}},{"address":{"type":"absolute","value":4353044}},{"address":{"type":"absolute","value":4353079}}]},{"address":{"type":"absolute","value":4302610},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481104}},{"address":{"type":"absolute","value":4481214}}]},{"address":{"type":"absolute","value":4302615},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335664}},{"address":{"type":"absolute","value":4335827}},{"address":{"type":"absolute","value":4336166}}]},{"address":{"type":"absolute","value":4302620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462496}}]},{"address":{"type":"absolute","value":4302635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435144}},{"address":{"type":"absolute","value":4435166}},{"address":{"type":"absolute","value":4435341}},{"address":{"type":"absolute","value":4435360}},{"address":{"type":"absolute","value":4435382}}]},{"address":{"type":"absolute","value":4302640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346272}}]},{"address":{"type":"absolute","value":4302645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350192}}]},{"address":{"type":"absolute","value":4302655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4478944}},{"address":{"type":"absolute","value":4479099}}]},{"address":{"type":"absolute","value":4302665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487024}}]},{"address":{"type":"absolute","value":4302670},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349200}}]},{"address":{"type":"absolute","value":4302675},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509392}}]},{"address":{"type":"absolute","value":4302685},"matched_basic_blocks":[{"address":{"type":"absolute","value":4433488}},{"address":{"type":"absolute","value":4433607}},{"address":{"type":"absolute","value":4433783}},{"address":{"type":"absolute","value":4433895}},{"address":{"type":"absolute","value":4434007}},{"address":{"type":"absolute","value":4434174}}]},{"address":{"type":"absolute","value":4302690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389456}}]},{"address":{"type":"absolute","value":4302700},"matched_basic_blocks":[{"address":{"type":"absolute","value":4329360}},{"address":{"type":"absolute","value":4329614}}]},{"address":{"type":"absolute","value":4302705},"matched_basic_blocks":[{"address":{"type":"absolute","value":4413120}},{"address":{"type":"absolute","value":4413239}},{"address":{"type":"absolute","value":4413680}}]},{"address":{"type":"absolute","value":4302710},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462128}}]},{"address":{"type":"absolute","value":4302715},"matched_basic_blocks":[{"address":{"type":"absolute","value":4420128}},{"address":{"type":"absolute","value":4420210}},{"address":{"type":"absolute","value":4420232}},{"address":{"type":"absolute","value":4420320}},{"address":{"type":"absolute","value":4420339}},{"address":{"type":"absolute","value":4420361}}]},{"address":{"type":"absolute","value":4302740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457584}},{"address":{"type":"absolute","value":4457747}}]},{"address":{"type":"absolute","value":4302745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4403728}},{"address":{"type":"absolute","value":4403799}}]},{"address":{"type":"absolute","value":4302750},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385872}},{"address":{"type":"absolute","value":4385993}},{"address":{"type":"absolute","value":4386032}}]},{"address":{"type":"absolute","value":4302770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466880}}]},{"address":{"type":"absolute","value":4302775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460736}}]},{"address":{"type":"absolute","value":4302780},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384544}}]},{"address":{"type":"absolute","value":4302785},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332976}},{"address":{"type":"absolute","value":4333263}}]},{"address":{"type":"absolute","value":4302790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368835}},{"address":{"type":"absolute","value":4368849}}]},{"address":{"type":"absolute","value":4302795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368176}}]},{"address":{"type":"absolute","value":4302810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385552}},{"address":{"type":"absolute","value":4385673}},{"address":{"type":"absolute","value":4385712}}]},{"address":{"type":"absolute","value":4302815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483824}}]},{"address":{"type":"absolute","value":4302830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4488144}},{"address":{"type":"absolute","value":4488255}},{"address":{"type":"absolute","value":4488395}},{"address":{"type":"absolute","value":4488459}},{"address":{"type":"absolute","value":4488516}},{"address":{"type":"absolute","value":4488602}}]},{"address":{"type":"absolute","value":4302835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4505408}}]},{"address":{"type":"absolute","value":4302840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383680}}]},{"address":{"type":"absolute","value":4302845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484112}}]},{"address":{"type":"absolute","value":4302860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457152}}]},{"address":{"type":"absolute","value":4302865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346880}},{"address":{"type":"absolute","value":4346949}}]},{"address":{"type":"absolute","value":4302870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345552}}]},{"address":{"type":"absolute","value":4302875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402480}},{"address":{"type":"absolute","value":4402636}}]},{"address":{"type":"absolute","value":4302880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383536}}]},{"address":{"type":"absolute","value":4302885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506263}}]},{"address":{"type":"absolute","value":4302890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390416}}]},{"address":{"type":"absolute","value":4302895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4410992}},{"address":{"type":"absolute","value":4411060}}]},{"address":{"type":"absolute","value":4302900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355024}}]},{"address":{"type":"absolute","value":4302910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389888}}]},{"address":{"type":"absolute","value":4302915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327280}},{"address":{"type":"absolute","value":4327478}},{"address":{"type":"absolute","value":4327714}}]},{"address":{"type":"absolute","value":4302920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379344}},{"address":{"type":"absolute","value":4379465}},{"address":{"type":"absolute","value":4379486}}]},{"address":{"type":"absolute","value":4302925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382208}},{"address":{"type":"absolute","value":4382302}},{"address":{"type":"absolute","value":4382357}}]},{"address":{"type":"absolute","value":4302930},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319600}}]},{"address":{"type":"absolute","value":4302935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486608}},{"address":{"type":"absolute","value":4486823}},{"address":{"type":"absolute","value":4486854}}]},{"address":{"type":"absolute","value":4302940},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332096}}]},{"address":{"type":"absolute","value":4302950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436352}},{"address":{"type":"absolute","value":4436434}},{"address":{"type":"absolute","value":4436456}},{"address":{"type":"absolute","value":4436544}},{"address":{"type":"absolute","value":4436563}},{"address":{"type":"absolute","value":4436585}}]},{"address":{"type":"absolute","value":4302955},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391776}}]},{"address":{"type":"absolute","value":4302960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412992}},{"address":{"type":"absolute","value":4413063}}]},{"address":{"type":"absolute","value":4302965},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496112}},{"address":{"type":"absolute","value":4496130}},{"address":{"type":"absolute","value":4496151}}]},{"address":{"type":"absolute","value":4302970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4416960}},{"address":{"type":"absolute","value":4417079}},{"address":{"type":"absolute","value":4417282}},{"address":{"type":"absolute","value":4417579}}]},{"address":{"type":"absolute","value":4302975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4441659}},{"address":{"type":"absolute","value":4441681}},{"address":{"type":"absolute","value":4441774}},{"address":{"type":"absolute","value":4441793}},{"address":{"type":"absolute","value":4441815}}]},{"address":{"type":"absolute","value":4302980},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484256}}]},{"address":{"type":"absolute","value":4302995},"matched_basic_blocks":[{"address":{"type":"absolute","value":4443120}},{"address":{"type":"absolute","value":4443245}},{"address":{"type":"absolute","value":4443309}},{"address":{"type":"absolute","value":4443344}},{"address":{"type":"absolute","value":4443396}},{"address":{"type":"absolute","value":4443419}},{"address":{"type":"absolute","value":4443465}},{"address":{"type":"absolute","value":4443488}},{"address":{"type":"absolute","value":4443648}},{"address":{"type":"absolute","value":4443671}},{"address":{"type":"absolute","value":4443731}},{"address":{"type":"absolute","value":4443748}},{"address":{"type":"absolute","value":4443792}},{"address":{"type":"absolute","value":4443807}},{"address":{"type":"absolute","value":4443937}}]},{"address":{"type":"absolute","value":4303000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468080}},{"address":{"type":"absolute","value":4468243}},{"address":{"type":"absolute","value":4468582}}]},{"address":{"type":"absolute","value":4303015},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336560}},{"address":{"type":"absolute","value":4336663}}]},{"address":{"type":"absolute","value":4303020},"matched_basic_blocks":[{"address":{"type":"absolute","value":4381856}},{"address":{"type":"absolute","value":4381937}},{"address":{"type":"absolute","value":4381964}}]},{"address":{"type":"absolute","value":4303025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4398480}},{"address":{"type":"absolute","value":4398575}},{"address":{"type":"absolute","value":4398612}},{"address":{"type":"absolute","value":4398650}},{"address":{"type":"absolute","value":4398713}},{"address":{"type":"absolute","value":4398780}},{"address":{"type":"absolute","value":4398910}}]},{"address":{"type":"absolute","value":4303030},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460640}}]},{"address":{"type":"absolute","value":4303035},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498528}}]},{"address":{"type":"absolute","value":4303040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491856}}]},{"address":{"type":"absolute","value":4303050},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338144}}]},{"address":{"type":"absolute","value":4303055},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412576}},{"address":{"type":"absolute","value":4412722}}]},{"address":{"type":"absolute","value":4303060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415264}},{"address":{"type":"absolute","value":4415335}}]},{"address":{"type":"absolute","value":4303065},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353664}}]},{"address":{"type":"absolute","value":4303075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367152}}]},{"address":{"type":"absolute","value":4303095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503984}},{"address":{"type":"absolute","value":4504028}},{"address":{"type":"absolute","value":4504047}},{"address":{"type":"absolute","value":4504125}}]},{"address":{"type":"absolute","value":4303100},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338928}}]},{"address":{"type":"absolute","value":4303105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4362896}},{"address":{"type":"absolute","value":4362997}}]},{"address":{"type":"absolute","value":4303110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342896}}]},{"address":{"type":"absolute","value":4303115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470016}}]},{"address":{"type":"absolute","value":4303130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4429408}},{"address":{"type":"absolute","value":4429504}},{"address":{"type":"absolute","value":4429559}},{"address":{"type":"absolute","value":4429601}},{"address":{"type":"absolute","value":4429622}},{"address":{"type":"absolute","value":4429669}},{"address":{"type":"absolute","value":4429748}},{"address":{"type":"absolute","value":4429779}},{"address":{"type":"absolute","value":4429820}},{"address":{"type":"absolute","value":4429847}},{"address":{"type":"absolute","value":4429872}}]},{"address":{"type":"absolute","value":4303155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339024}}]},{"address":{"type":"absolute","value":4303160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347051}},{"address":{"type":"absolute","value":4347076}},{"address":{"type":"absolute","value":4347099}}]},{"address":{"type":"absolute","value":4303165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467856}}]},{"address":{"type":"absolute","value":4303170},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506391}}]},{"address":{"type":"absolute","value":4303175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4370864}},{"address":{"type":"absolute","value":4370959}}]},{"address":{"type":"absolute","value":4303180},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349696}}]},{"address":{"type":"absolute","value":4303195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354512}}]},{"address":{"type":"absolute","value":4303200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319696}}]},{"address":{"type":"absolute","value":4303205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354224}},{"address":{"type":"absolute","value":4354293}},{"address":{"type":"absolute","value":4354311}}]},{"address":{"type":"absolute","value":4303210},"matched_basic_blocks":[{"address":{"type":"absolute","value":4416544}},{"address":{"type":"absolute","value":4416739}}]},{"address":{"type":"absolute","value":4303220},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392528}}]},{"address":{"type":"absolute","value":4303225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337088}}]},{"address":{"type":"absolute","value":4303230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365936}}]},{"address":{"type":"absolute","value":4303235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492000}}]},{"address":{"type":"absolute","value":4303265},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345392}}]},{"address":{"type":"absolute","value":4303270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4378352}},{"address":{"type":"absolute","value":4378438}},{"address":{"type":"absolute","value":4378472}},{"address":{"type":"absolute","value":4378524}},{"address":{"type":"absolute","value":4378558}},{"address":{"type":"absolute","value":4378578}},{"address":{"type":"absolute","value":4378616}},{"address":{"type":"absolute","value":4378694}}]},{"address":{"type":"absolute","value":4303275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365504}}]},{"address":{"type":"absolute","value":4303280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469600}}]},{"address":{"type":"absolute","value":4303290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471696}}]},{"address":{"type":"absolute","value":4303295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486416}},{"address":{"type":"absolute","value":4486532}}]},{"address":{"type":"absolute","value":4303305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4439712}},{"address":{"type":"absolute","value":4439811}},{"address":{"type":"absolute","value":4439860}},{"address":{"type":"absolute","value":4439882}}]},{"address":{"type":"absolute","value":4303310},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363312}}]},{"address":{"type":"absolute","value":4303320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395109}},{"address":{"type":"absolute","value":4395126}},{"address":{"type":"absolute","value":4395154}}]},{"address":{"type":"absolute","value":4303325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455520}}]},{"address":{"type":"absolute","value":4303330},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500112}},{"address":{"type":"absolute","value":4500221}}]},{"address":{"type":"absolute","value":4303335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464336}}]},{"address":{"type":"absolute","value":4303340},"matched_basic_blocks":[{"address":{"type":"absolute","value":4478688}},{"address":{"type":"absolute","value":4478762}},{"address":{"type":"absolute","value":4478807}}]},{"address":{"type":"absolute","value":4303355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392944}},{"address":{"type":"absolute","value":4393019}},{"address":{"type":"absolute","value":4393067}},{"address":{"type":"absolute","value":4393115}}]},{"address":{"type":"absolute","value":4303365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466768}}]},{"address":{"type":"absolute","value":4303375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496682}}]},{"address":{"type":"absolute","value":4303380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466992}}]},{"address":{"type":"absolute","value":4303385},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355728}},{"address":{"type":"absolute","value":4355795}},{"address":{"type":"absolute","value":4355906}}]},{"address":{"type":"absolute","value":4303400},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471408}}]},{"address":{"type":"absolute","value":4303410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4508112}},{"address":{"type":"absolute","value":4508157}}]},{"address":{"type":"absolute","value":4303415},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326128}},{"address":{"type":"absolute","value":4326217}},{"address":{"type":"absolute","value":4326351}}]},{"address":{"type":"absolute","value":4303420},"matched_basic_blocks":[{"address":{"type":"absolute","value":4502041}}]},{"address":{"type":"absolute","value":4303425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350816}}]},{"address":{"type":"absolute","value":4303430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426087}},{"address":{"type":"absolute","value":4426109}},{"address":{"type":"absolute","value":4426227}},{"address":{"type":"absolute","value":4426265}},{"address":{"type":"absolute","value":4426287}}]},{"address":{"type":"absolute","value":4303450},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469840}}]},{"address":{"type":"absolute","value":4303455},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360496}}]},{"address":{"type":"absolute","value":4303460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460912}},{"address":{"type":"absolute","value":4460960}},{"address":{"type":"absolute","value":4461024}},{"address":{"type":"absolute","value":4461072}},{"address":{"type":"absolute","value":4461120}}]},{"address":{"type":"absolute","value":4303470},"matched_basic_blocks":[{"address":{"type":"absolute","value":4454424}},{"address":{"type":"absolute","value":4454473}},{"address":{"type":"absolute","value":4454529}},{"address":{"type":"absolute","value":4454542}}]},{"address":{"type":"absolute","value":4303475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354368}},{"address":{"type":"absolute","value":4354437}},{"address":{"type":"absolute","value":4354455}}]},{"address":{"type":"absolute","value":4303480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455664}}]},{"address":{"type":"absolute","value":4303485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334976}}]},{"address":{"type":"absolute","value":4303490},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493744}},{"address":{"type":"absolute","value":4493940}},{"address":{"type":"absolute","value":4494023}}]},{"address":{"type":"absolute","value":4303495},"matched_basic_blocks":[{"address":{"type":"absolute","value":4495216}},{"address":{"type":"absolute","value":4495325}},{"address":{"type":"absolute","value":4495358}}]},{"address":{"type":"absolute","value":4303505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4372176}},{"address":{"type":"absolute","value":4372261}},{"address":{"type":"absolute","value":4372285}},{"address":{"type":"absolute","value":4372302}},{"address":{"type":"absolute","value":4372317}},{"address":{"type":"absolute","value":4372330}},{"address":{"type":"absolute","value":4372432}},{"address":{"type":"absolute","value":4372549}},{"address":{"type":"absolute","value":4372570}},{"address":{"type":"absolute","value":4372661}},{"address":{"type":"absolute","value":4372700}},{"address":{"type":"absolute","value":4372720}},{"address":{"type":"absolute","value":4372741}},{"address":{"type":"absolute","value":4372799}}]},{"address":{"type":"absolute","value":4303510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4407312}},{"address":{"type":"absolute","value":4407445}},{"address":{"type":"absolute","value":4407626}},{"address":{"type":"absolute","value":4407894}}]},{"address":{"type":"absolute","value":4303520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355344}}]},{"address":{"type":"absolute","value":4303525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471904}}]},{"address":{"type":"absolute","value":4303530},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388880}}]},{"address":{"type":"absolute","value":4303535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392736}}]},{"address":{"type":"absolute","value":4303540},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394672}},{"address":{"type":"absolute","value":4394740}}]},{"address":{"type":"absolute","value":4303550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4501044}},{"address":{"type":"absolute","value":4501051}}]},{"address":{"type":"absolute","value":4303555},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435731}},{"address":{"type":"absolute","value":4435753}},{"address":{"type":"absolute","value":4435846}},{"address":{"type":"absolute","value":4435865}},{"address":{"type":"absolute","value":4435887}}]},{"address":{"type":"absolute","value":4303575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490480}}]},{"address":{"type":"absolute","value":4303580},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343184}}]},{"address":{"type":"absolute","value":4303585},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452768}}]},{"address":{"type":"absolute","value":4303595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342176}},{"address":{"type":"absolute","value":4342257}},{"address":{"type":"absolute","value":4342284}}]},{"address":{"type":"absolute","value":4303615},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388752}}]},{"address":{"type":"absolute","value":4303620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347355}},{"address":{"type":"absolute","value":4347380}},{"address":{"type":"absolute","value":4347403}}]},{"address":{"type":"absolute","value":4303635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384976}}]},{"address":{"type":"absolute","value":4303640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335312}}]},{"address":{"type":"absolute","value":4303645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4437184}},{"address":{"type":"absolute","value":4437258}}]},{"address":{"type":"absolute","value":4303655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388368}}]},{"address":{"type":"absolute","value":4303660},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364080}}]},{"address":{"type":"absolute","value":4303665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483536}}]},{"address":{"type":"absolute","value":4303675},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456672}}]},{"address":{"type":"absolute","value":4303680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336736}}]},{"address":{"type":"absolute","value":4303690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349840}}]},{"address":{"type":"absolute","value":4303700},"matched_basic_blocks":[{"address":{"type":"absolute","value":4378880}},{"address":{"type":"absolute","value":4379005}}]},{"address":{"type":"absolute","value":4303710},"matched_basic_blocks":[{"address":{"type":"absolute","value":4494208}},{"address":{"type":"absolute","value":4494371}},{"address":{"type":"absolute","value":4494444}}]},{"address":{"type":"absolute","value":4303720},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412864}},{"address":{"type":"absolute","value":4412935}}]},{"address":{"type":"absolute","value":4303725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452176}}]},{"address":{"type":"absolute","value":4303735},"matched_basic_blocks":[{"address":{"type":"absolute","value":4330784}},{"address":{"type":"absolute","value":4330984}},{"address":{"type":"absolute","value":4331085}}]},{"address":{"type":"absolute","value":4303745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404624}},{"address":{"type":"absolute","value":4404750}},{"address":{"type":"absolute","value":4404856}},{"address":{"type":"absolute","value":4404987}}]},{"address":{"type":"absolute","value":4303755},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469760}}]},{"address":{"type":"absolute","value":4303765},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343040}}]},{"address":{"type":"absolute","value":4303770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350896}},{"address":{"type":"absolute","value":4350980}},{"address":{"type":"absolute","value":4351001}}]},{"address":{"type":"absolute","value":4303775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415520}},{"address":{"type":"absolute","value":4415594}},{"address":{"type":"absolute","value":4415657}}]},{"address":{"type":"absolute","value":4303780},"matched_basic_blocks":[{"address":{"type":"absolute","value":4397280}},{"address":{"type":"absolute","value":4397382}},{"address":{"type":"absolute","value":4397419}},{"address":{"type":"absolute","value":4397457}},{"address":{"type":"absolute","value":4397547}},{"address":{"type":"absolute","value":4397607}},{"address":{"type":"absolute","value":4397662}},{"address":{"type":"absolute","value":4397723}},{"address":{"type":"absolute","value":4397787}},{"address":{"type":"absolute","value":4397839}},{"address":{"type":"absolute","value":4397866}},{"address":{"type":"absolute","value":4397902}},{"address":{"type":"absolute","value":4397935}},{"address":{"type":"absolute","value":4397984}},{"address":{"type":"absolute","value":4398061}},{"address":{"type":"absolute","value":4398129}}]},{"address":{"type":"absolute","value":4303790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470976}}]},{"address":{"type":"absolute","value":4303795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382032}},{"address":{"type":"absolute","value":4382113}},{"address":{"type":"absolute","value":4382140}}]},{"address":{"type":"absolute","value":4303800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453344}}]},{"address":{"type":"absolute","value":4303805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345280}}]},{"address":{"type":"absolute","value":4303815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338720}}]},{"address":{"type":"absolute","value":4303820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358528}}]},{"address":{"type":"absolute","value":4303825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4331328}},{"address":{"type":"absolute","value":4331454}}]},{"address":{"type":"absolute","value":4303830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500928}}]},{"address":{"type":"absolute","value":4303835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319840}}]},{"address":{"type":"absolute","value":4303840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355456}}]},{"address":{"type":"absolute","value":4303845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498832}}]},{"address":{"type":"absolute","value":4303860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359248}}]},{"address":{"type":"absolute","value":4303865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487296}}]},{"address":{"type":"absolute","value":4303875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496693}}]},{"address":{"type":"absolute","value":4303880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4422432}},{"address":{"type":"absolute","value":4422617}},{"address":{"type":"absolute","value":4422677}},{"address":{"type":"absolute","value":4422715}},{"address":{"type":"absolute","value":4422793}},{"address":{"type":"absolute","value":4422848}},{"address":{"type":"absolute","value":4422882}},{"address":{"type":"absolute","value":4422900}}]},{"address":{"type":"absolute","value":4303890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490832}}]},{"address":{"type":"absolute","value":4303895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389744}}]},{"address":{"type":"absolute","value":4303905},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500832}}]},{"address":{"type":"absolute","value":4303910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368480}}]},{"address":{"type":"absolute","value":4303915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456784}}]},{"address":{"type":"absolute","value":4303920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343328}},{"address":{"type":"absolute","value":4343415}},{"address":{"type":"absolute","value":4343512}}]},{"address":{"type":"absolute","value":4303925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395711}},{"address":{"type":"absolute","value":4395785}},{"address":{"type":"absolute","value":4396000}}]},{"address":{"type":"absolute","value":4303930},"matched_basic_blocks":[{"address":{"type":"absolute","value":4324896}},{"address":{"type":"absolute","value":4325016}}]},{"address":{"type":"absolute","value":4303935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363232}}]},{"address":{"type":"absolute","value":4303950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4341616}},{"address":{"type":"absolute","value":4341716}},{"address":{"type":"absolute","value":4341768}},{"address":{"type":"absolute","value":4341852}},{"address":{"type":"absolute","value":4341904}},{"address":{"type":"absolute","value":4341956}}]},{"address":{"type":"absolute","value":4303955},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369171}},{"address":{"type":"absolute","value":4369185}}]},{"address":{"type":"absolute","value":4303960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387856}}]},{"address":{"type":"absolute","value":4303965},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385264}}]},{"address":{"type":"absolute","value":4303970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353520}}]},{"address":{"type":"absolute","value":4303985},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347712}}]},{"address":{"type":"absolute","value":4303990},"matched_basic_blocks":[{"address":{"type":"absolute","value":4362160}},{"address":{"type":"absolute","value":4362335}},{"address":{"type":"absolute","value":4362672}}]},{"address":{"type":"absolute","value":4304000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452480}}]},{"address":{"type":"absolute","value":4304020},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455280}}]},{"address":{"type":"absolute","value":4304030},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500624}},{"address":{"type":"absolute","value":4500644}},{"address":{"type":"absolute","value":4500682}}]},{"address":{"type":"absolute","value":4304045},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393728}}]},{"address":{"type":"absolute","value":4304060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359920}}]},{"address":{"type":"absolute","value":4304070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498240}},{"address":{"type":"absolute","value":4498261}},{"address":{"type":"absolute","value":4498290}},{"address":{"type":"absolute","value":4498308}},{"address":{"type":"absolute","value":4498324}}]},{"address":{"type":"absolute","value":4304075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366656}}]},{"address":{"type":"absolute","value":4304080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390128}}]},{"address":{"type":"absolute","value":4304085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4420032}}]},{"address":{"type":"absolute","value":4304090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4420544}},{"address":{"type":"absolute","value":4420637}},{"address":{"type":"absolute","value":4420692}},{"address":{"type":"absolute","value":4420734}},{"address":{"type":"absolute","value":4420755}},{"address":{"type":"absolute","value":4420798}},{"address":{"type":"absolute","value":4420847}},{"address":{"type":"absolute","value":4420882}},{"address":{"type":"absolute","value":4420909}},{"address":{"type":"absolute","value":4420934}}]},{"address":{"type":"absolute","value":4304095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4440156}},{"address":{"type":"absolute","value":4440178}},{"address":{"type":"absolute","value":4440288}},{"address":{"type":"absolute","value":4440307}},{"address":{"type":"absolute","value":4440329}}]},{"address":{"type":"absolute","value":4304100},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384832}}]},{"address":{"type":"absolute","value":4304105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4408405}},{"address":{"type":"absolute","value":4408516}},{"address":{"type":"absolute","value":4408703}},{"address":{"type":"absolute","value":4408813}},{"address":{"type":"absolute","value":4408848}},{"address":{"type":"absolute","value":4408909}},{"address":{"type":"absolute","value":4408955}},{"address":{"type":"absolute","value":4409004}},{"address":{"type":"absolute","value":4409132}},{"address":{"type":"absolute","value":4409176}},{"address":{"type":"absolute","value":4409288}}]},{"address":{"type":"absolute","value":4304110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4329792}},{"address":{"type":"absolute","value":4329942}}]},{"address":{"type":"absolute","value":4304115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356144}}]},{"address":{"type":"absolute","value":4304120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455184}}]},{"address":{"type":"absolute","value":4304125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456448}}]},{"address":{"type":"absolute","value":4304130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387120}},{"address":{"type":"absolute","value":4387245}},{"address":{"type":"absolute","value":4387327}}]},{"address":{"type":"absolute","value":4304135},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442608}}]},{"address":{"type":"absolute","value":4304140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334176}},{"address":{"type":"absolute","value":4334225}},{"address":{"type":"absolute","value":4334245}},{"address":{"type":"absolute","value":4334261}}]},{"address":{"type":"absolute","value":4304145},"matched_basic_blocks":[{"address":{"type":"absolute","value":4396128}},{"address":{"type":"absolute","value":4396245}},{"address":{"type":"absolute","value":4396319}},{"address":{"type":"absolute","value":4396534}}]},{"address":{"type":"absolute","value":4304150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390512}}]},{"address":{"type":"absolute","value":4304155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461680}},{"address":{"type":"absolute","value":4461793}},{"address":{"type":"absolute","value":4461845}}]},{"address":{"type":"absolute","value":4304160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387424}},{"address":{"type":"absolute","value":4387636}}]},{"address":{"type":"absolute","value":4304165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404240}},{"address":{"type":"absolute","value":4404311}}]},{"address":{"type":"absolute","value":4304175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366512}}]},{"address":{"type":"absolute","value":4304185},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359536}}]},{"address":{"type":"absolute","value":4304190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383024}}]},{"address":{"type":"absolute","value":4304195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388112}}]},{"address":{"type":"absolute","value":4304205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500570}}]},{"address":{"type":"absolute","value":4304215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358960}}]},{"address":{"type":"absolute","value":4304225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4417968}},{"address":{"type":"absolute","value":4418097}},{"address":{"type":"absolute","value":4418231}},{"address":{"type":"absolute","value":4418498}}]},{"address":{"type":"absolute","value":4304235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467504}}]},{"address":{"type":"absolute","value":4304240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354096}},{"address":{"type":"absolute","value":4354172}}]},{"address":{"type":"absolute","value":4304250},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492144}}]},{"address":{"type":"absolute","value":4304265},"matched_basic_blocks":[{"address":{"type":"absolute","value":4463632}}]},{"address":{"type":"absolute","value":4304270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509104}}]},{"address":{"type":"absolute","value":4304275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482864}},{"address":{"type":"absolute","value":4482958}},{"address":{"type":"absolute","value":4483013}}]},{"address":{"type":"absolute","value":4304280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4458224}},{"address":{"type":"absolute","value":4458607}}]},{"address":{"type":"absolute","value":4304300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491696}},{"address":{"type":"absolute","value":4491794}}]},{"address":{"type":"absolute","value":4304310},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359664}}]},{"address":{"type":"absolute","value":4304315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4424896}},{"address":{"type":"absolute","value":4425015}},{"address":{"type":"absolute","value":4425156}},{"address":{"type":"absolute","value":4425244}},{"address":{"type":"absolute","value":4425265}},{"address":{"type":"absolute","value":4425282}},{"address":{"type":"absolute","value":4425303}},{"address":{"type":"absolute","value":4425320}},{"address":{"type":"absolute","value":4425341}},{"address":{"type":"absolute","value":4425512}}]},{"address":{"type":"absolute","value":4304325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481280}},{"address":{"type":"absolute","value":4481385}}]},{"address":{"type":"absolute","value":4304330},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359392}}]},{"address":{"type":"absolute","value":4304335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349344}}]},{"address":{"type":"absolute","value":4304340},"matched_basic_blocks":[{"address":{"type":"absolute","value":4328736}},{"address":{"type":"absolute","value":4328826}},{"address":{"type":"absolute","value":4328983}}]},{"address":{"type":"absolute","value":4304350},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506327}}]},{"address":{"type":"absolute","value":4304360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4512768}},{"address":{"type":"absolute","value":4512817}}]},{"address":{"type":"absolute","value":4304365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364640}},{"address":{"type":"absolute","value":4364713}},{"address":{"type":"absolute","value":4364736}},{"address":{"type":"absolute","value":4364766}}]},{"address":{"type":"absolute","value":4304370},"matched_basic_blocks":[{"address":{"type":"absolute","value":4304370}},{"address":{"type":"absolute","value":4496937}}]},{"address":{"type":"absolute","value":4304375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503360}}]},{"address":{"type":"absolute","value":4304380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492672}}]},{"address":{"type":"absolute","value":4304385},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483408}}]},{"address":{"type":"absolute","value":4304390},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337344}}]},{"address":{"type":"absolute","value":4304395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366800}}]},{"address":{"type":"absolute","value":4304400},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351072}}]},{"address":{"type":"absolute","value":4304405},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393616}}]},{"address":{"type":"absolute","value":4304410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402144}}]},{"address":{"type":"absolute","value":4304430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391264}}]},{"address":{"type":"absolute","value":4304440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4441149}},{"address":{"type":"absolute","value":4441171}},{"address":{"type":"absolute","value":4441327}},{"address":{"type":"absolute","value":4441346}},{"address":{"type":"absolute","value":4441368}}]},{"address":{"type":"absolute","value":4304445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337008}}]},{"address":{"type":"absolute","value":4304460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4505472}}]},{"address":{"type":"absolute","value":4304465},"matched_basic_blocks":[{"address":{"type":"absolute","value":4479728}},{"address":{"type":"absolute","value":4479847}},{"address":{"type":"absolute","value":4479868}},{"address":{"type":"absolute","value":4479970}},{"address":{"type":"absolute","value":4479985}},{"address":{"type":"absolute","value":4480020}}]},{"address":{"type":"absolute","value":4304470},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496670}}]},{"address":{"type":"absolute","value":4304475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395536}}]},{"address":{"type":"absolute","value":4304480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496673}},{"address":{"type":"absolute","value":4496679}}]},{"address":{"type":"absolute","value":4304490},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472112}},{"address":{"type":"absolute","value":4472276}},{"address":{"type":"absolute","value":4472415}}]},{"address":{"type":"absolute","value":4304500},"matched_basic_blocks":[{"address":{"type":"absolute","value":4352736}}]},{"address":{"type":"absolute","value":4304505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356304}}]},{"address":{"type":"absolute","value":4304520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4410192}},{"address":{"type":"absolute","value":4410324}},{"address":{"type":"absolute","value":4410411}},{"address":{"type":"absolute","value":4410441}},{"address":{"type":"absolute","value":4410511}},{"address":{"type":"absolute","value":4410530}},{"address":{"type":"absolute","value":4410552}},{"address":{"type":"absolute","value":4410627}},{"address":{"type":"absolute","value":4410654}},{"address":{"type":"absolute","value":4410681}},{"address":{"type":"absolute","value":4410697}},{"address":{"type":"absolute","value":4410716}},{"address":{"type":"absolute","value":4410733}}]},{"address":{"type":"absolute","value":4304535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509456}}]},{"address":{"type":"absolute","value":4304540},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319984}},{"address":{"type":"absolute","value":4320206}},{"address":{"type":"absolute","value":4320236}},{"address":{"type":"absolute","value":4320295}},{"address":{"type":"absolute","value":4320984}},{"address":{"type":"absolute","value":4321151}},{"address":{"type":"absolute","value":4321886}},{"address":{"type":"absolute","value":4322182}},{"address":{"type":"absolute","value":4322298}},{"address":{"type":"absolute","value":4322327}},{"address":{"type":"absolute","value":4322392}},{"address":{"type":"absolute","value":4322434}},{"address":{"type":"absolute","value":4322476}},{"address":{"type":"absolute","value":4322564}},{"address":{"type":"absolute","value":4322877}},{"address":{"type":"absolute","value":4322904}},{"address":{"type":"absolute","value":4323003}},{"address":{"type":"absolute","value":4323026}}]},{"address":{"type":"absolute","value":4304545},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327184}}]},{"address":{"type":"absolute","value":4304550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436080}},{"address":{"type":"absolute","value":4436193}}]},{"address":{"type":"absolute","value":4304570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462352}},{"address":{"type":"absolute","value":4462425}},{"address":{"type":"absolute","value":4462441}}]},{"address":{"type":"absolute","value":4304595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4397104}}]},{"address":{"type":"absolute","value":4304605},"matched_basic_blocks":[{"address":{"type":"absolute","value":4373088}},{"address":{"type":"absolute","value":4373245}},{"address":{"type":"absolute","value":4373296}},{"address":{"type":"absolute","value":4373371}},{"address":{"type":"absolute","value":4373404}},{"address":{"type":"absolute","value":4373464}},{"address":{"type":"absolute","value":4373487}},{"address":{"type":"absolute","value":4373645}},{"address":{"type":"absolute","value":4373688}},{"address":{"type":"absolute","value":4373730}},{"address":{"type":"absolute","value":4373799}},{"address":{"type":"absolute","value":4373832}},{"address":{"type":"absolute","value":4373981}},{"address":{"type":"absolute","value":4374024}},{"address":{"type":"absolute","value":4374044}},{"address":{"type":"absolute","value":4374062}},{"address":{"type":"absolute","value":4374089}},{"address":{"type":"absolute","value":4374159}},{"address":{"type":"absolute","value":4374321}}]},{"address":{"type":"absolute","value":4304610},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462832}}]},{"address":{"type":"absolute","value":4304620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325232}},{"address":{"type":"absolute","value":4325315}}]},{"address":{"type":"absolute","value":4304625},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401024}},{"address":{"type":"absolute","value":4401081}},{"address":{"type":"absolute","value":4401144}}]},{"address":{"type":"absolute","value":4304630},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457904}},{"address":{"type":"absolute","value":4457997}}]},{"address":{"type":"absolute","value":4304635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4414368}},{"address":{"type":"absolute","value":4414487}},{"address":{"type":"absolute","value":4414651}},{"address":{"type":"absolute","value":4414803}}]},{"address":{"type":"absolute","value":4304645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4405280}},{"address":{"type":"absolute","value":4405496}},{"address":{"type":"absolute","value":4405530}},{"address":{"type":"absolute","value":4405551}},{"address":{"type":"absolute","value":4405613}},{"address":{"type":"absolute","value":4405664}}]},{"address":{"type":"absolute","value":4304660},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453056}}]},{"address":{"type":"absolute","value":4304665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487136}}]},{"address":{"type":"absolute","value":4304670},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498473}}]},{"address":{"type":"absolute","value":4304685},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393952}},{"address":{"type":"absolute","value":4394059}}]},{"address":{"type":"absolute","value":4304690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4397008}}]},{"address":{"type":"absolute","value":4304705},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338288}}]},{"address":{"type":"absolute","value":4304715},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337616}}]},{"address":{"type":"absolute","value":4304725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498740}},{"address":{"type":"absolute","value":4498766}}]},{"address":{"type":"absolute","value":4304735},"matched_basic_blocks":[{"address":{"type":"absolute","value":4324470}},{"address":{"type":"absolute","value":4324504}},{"address":{"type":"absolute","value":4324604}},{"address":{"type":"absolute","value":4324623}},{"address":{"type":"absolute","value":4324645}}]},{"address":{"type":"absolute","value":4304740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442267}},{"address":{"type":"absolute","value":4442289}},{"address":{"type":"absolute","value":4442382}},{"address":{"type":"absolute","value":4442401}},{"address":{"type":"absolute","value":4442423}}]},{"address":{"type":"absolute","value":4304745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452384}}]},{"address":{"type":"absolute","value":4304750},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344976}}]},{"address":{"type":"absolute","value":4304770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4507625}},{"address":{"type":"absolute","value":4507895}}]},{"address":{"type":"absolute","value":4304775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325872}},{"address":{"type":"absolute","value":4326043}}]},{"address":{"type":"absolute","value":4304780},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467632}}]},{"address":{"type":"absolute","value":4304785},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394272}},{"address":{"type":"absolute","value":4394387}},{"address":{"type":"absolute","value":4394488}}]},{"address":{"type":"absolute","value":4304790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350048}}]},{"address":{"type":"absolute","value":4304795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357968}}]},{"address":{"type":"absolute","value":4304805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4407024}},{"address":{"type":"absolute","value":4407165}}]},{"address":{"type":"absolute","value":4304810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453152}}]},{"address":{"type":"absolute","value":4304830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333744}}]},{"address":{"type":"absolute","value":4304835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383280}}]},{"address":{"type":"absolute","value":4304845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487456}},{"address":{"type":"absolute","value":4487567}},{"address":{"type":"absolute","value":4487707}},{"address":{"type":"absolute","value":4487774}},{"address":{"type":"absolute","value":4487834}},{"address":{"type":"absolute","value":4487914}}]},{"address":{"type":"absolute","value":4304850},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357456}}]},{"address":{"type":"absolute","value":4304860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334784}},{"address":{"type":"absolute","value":4334864}},{"address":{"type":"absolute","value":4334880}}]},{"address":{"type":"absolute","value":4304870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4495872}},{"address":{"type":"absolute","value":4495944}},{"address":{"type":"absolute","value":4495964}},{"address":{"type":"absolute","value":4495992}}]},{"address":{"type":"absolute","value":4304875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360272}}]},{"address":{"type":"absolute","value":4304880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337888}}]},{"address":{"type":"absolute","value":4304890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401200}},{"address":{"type":"absolute","value":4401257}},{"address":{"type":"absolute","value":4401320}}]},{"address":{"type":"absolute","value":4304895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4508544}}]},{"address":{"type":"absolute","value":4304900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334000}}]},{"address":{"type":"absolute","value":4304910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366944}}]},{"address":{"type":"absolute","value":4304920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336384}},{"address":{"type":"absolute","value":4336487}}]},{"address":{"type":"absolute","value":4304930},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366080}}]},{"address":{"type":"absolute","value":4304935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351168}}]},{"address":{"type":"absolute","value":4304940},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401472}}]},{"address":{"type":"absolute","value":4304945},"matched_basic_blocks":[{"address":{"type":"absolute","value":4421563}},{"address":{"type":"absolute","value":4421585}},{"address":{"type":"absolute","value":4421673}},{"address":{"type":"absolute","value":4421692}},{"address":{"type":"absolute","value":4421714}}]},{"address":{"type":"absolute","value":4304950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367872}}]},{"address":{"type":"absolute","value":4304965},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348368}},{"address":{"type":"absolute","value":4348441}},{"address":{"type":"absolute","value":4348566}},{"address":{"type":"absolute","value":4348599}},{"address":{"type":"absolute","value":4348631}}]},{"address":{"type":"absolute","value":4304970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364336}}]},{"address":{"type":"absolute","value":4304975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361440}},{"address":{"type":"absolute","value":4361603}},{"address":{"type":"absolute","value":4361942}}]},{"address":{"type":"absolute","value":4304980},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365216}}]},{"address":{"type":"absolute","value":4304995},"matched_basic_blocks":[{"address":{"type":"absolute","value":4330096}},{"address":{"type":"absolute","value":4330314}},{"address":{"type":"absolute","value":4330346}},{"address":{"type":"absolute","value":4330478}},{"address":{"type":"absolute","value":4330517}},{"address":{"type":"absolute","value":4330565}}]},{"address":{"type":"absolute","value":4305005},"matched_basic_blocks":[{"address":{"type":"absolute","value":4381168}},{"address":{"type":"absolute","value":4381309}},{"address":{"type":"absolute","value":4381359}},{"address":{"type":"absolute","value":4381459}},{"address":{"type":"absolute","value":4381486}}]},{"address":{"type":"absolute","value":4305010},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393280}},{"address":{"type":"absolute","value":4393355}},{"address":{"type":"absolute","value":4393403}},{"address":{"type":"absolute","value":4393451}}]},{"address":{"type":"absolute","value":4305025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456576}}]},{"address":{"type":"absolute","value":4305040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358816}}]},{"address":{"type":"absolute","value":4305045},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471552}}]},{"address":{"type":"absolute","value":4305050},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492352}}]},{"address":{"type":"absolute","value":4305055},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390608}}]},{"address":{"type":"absolute","value":4305065},"matched_basic_blocks":[{"address":{"type":"absolute","value":4421136}},{"address":{"type":"absolute","value":4421228}},{"address":{"type":"absolute","value":4421277}},{"address":{"type":"absolute","value":4421312}},{"address":{"type":"absolute","value":4421334}}]},{"address":{"type":"absolute","value":4305070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348176}},{"address":{"type":"absolute","value":4348279}}]},{"address":{"type":"absolute","value":4305075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364480}}]},{"address":{"type":"absolute","value":4305080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457312}}]},{"address":{"type":"absolute","value":4305085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343680}},{"address":{"type":"absolute","value":4343801}},{"address":{"type":"absolute","value":4343840}}]},{"address":{"type":"absolute","value":4305090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345776}}]},{"address":{"type":"absolute","value":4305115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484720}},{"address":{"type":"absolute","value":4484841}},{"address":{"type":"absolute","value":4484880}}]},{"address":{"type":"absolute","value":4305120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4479264}},{"address":{"type":"absolute","value":4479513}}]},{"address":{"type":"absolute","value":4305125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371888}}]},{"address":{"type":"absolute","value":4305140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391664}}]},{"address":{"type":"absolute","value":4305145},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452960}}]},{"address":{"type":"absolute","value":4305150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460080}},{"address":{"type":"absolute","value":4460189}}]},{"address":{"type":"absolute","value":4305155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486096}}]},{"address":{"type":"absolute","value":4305160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404496}},{"address":{"type":"absolute","value":4404567}}]},{"address":{"type":"absolute","value":4305165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461920}}]},{"address":{"type":"absolute","value":4305185},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354782}},{"address":{"type":"absolute","value":4354852}}]},{"address":{"type":"absolute","value":4305190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395330}},{"address":{"type":"absolute","value":4395444}}]},{"address":{"type":"absolute","value":4305195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493160}},{"address":{"type":"absolute","value":4493175}},{"address":{"type":"absolute","value":4493263}}]},{"address":{"type":"absolute","value":4305205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384112}}]},{"address":{"type":"absolute","value":4305220},"matched_basic_blocks":[{"address":{"type":"absolute","value":4329072}},{"address":{"type":"absolute","value":4329213}}]},{"address":{"type":"absolute","value":4305225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353376}}]},{"address":{"type":"absolute","value":4305230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4331600}},{"address":{"type":"absolute","value":4331908}}]},{"address":{"type":"absolute","value":4305235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401872}}]},{"address":{"type":"absolute","value":4305250},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347600}}]},{"address":{"type":"absolute","value":4305255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337472}}]},{"address":{"type":"absolute","value":4305260},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4305270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455760}}]},{"address":{"type":"absolute","value":4305275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4410064}},{"address":{"type":"absolute","value":4410136}}]},{"address":{"type":"absolute","value":4305285},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342624}}]},{"address":{"type":"absolute","value":4305290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464672}}]},{"address":{"type":"absolute","value":4305295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4480832}},{"address":{"type":"absolute","value":4480949}}]},{"address":{"type":"absolute","value":4305300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356576}}]},{"address":{"type":"absolute","value":4305315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4374784}},{"address":{"type":"absolute","value":4374858}},{"address":{"type":"absolute","value":4374979}},{"address":{"type":"absolute","value":4375086}},{"address":{"type":"absolute","value":4375103}},{"address":{"type":"absolute","value":4375245}}]},{"address":{"type":"absolute","value":4305325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347168}},{"address":{"type":"absolute","value":4347242}}]},{"address":{"type":"absolute","value":4305330},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459909}},{"address":{"type":"absolute","value":4459957}},{"address":{"type":"absolute","value":4460005}}]},{"address":{"type":"absolute","value":4305335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349488}}]},{"address":{"type":"absolute","value":4305345},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325088}}]},{"address":{"type":"absolute","value":4305350},"matched_basic_blocks":[{"address":{"type":"absolute","value":4488976}},{"address":{"type":"absolute","value":4489038}},{"address":{"type":"absolute","value":4489075}}]},{"address":{"type":"absolute","value":4305355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467360}}]},{"address":{"type":"absolute","value":4305360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375622}},{"address":{"type":"absolute","value":4375684}},{"address":{"type":"absolute","value":4375761}},{"address":{"type":"absolute","value":4375907}},{"address":{"type":"absolute","value":4376003}},{"address":{"type":"absolute","value":4376023}},{"address":{"type":"absolute","value":4376083}},{"address":{"type":"absolute","value":4376194}},{"address":{"type":"absolute","value":4376216}},{"address":{"type":"absolute","value":4376378}}]},{"address":{"type":"absolute","value":4305365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355248}}]},{"address":{"type":"absolute","value":4305375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359792}}]},{"address":{"type":"absolute","value":4305380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349616}}]},{"address":{"type":"absolute","value":4305390},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383408}}]},{"address":{"type":"absolute","value":4305395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490656}}]},{"address":{"type":"absolute","value":4305405},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392176}}]},{"address":{"type":"absolute","value":4305410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506528}}]},{"address":{"type":"absolute","value":4305425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452672}}]},{"address":{"type":"absolute","value":4305430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383968}}]},{"address":{"type":"absolute","value":4305435},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392032}}]},{"address":{"type":"absolute","value":4305445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472944}},{"address":{"type":"absolute","value":4473065}},{"address":{"type":"absolute","value":4473126}},{"address":{"type":"absolute","value":4473188}},{"address":{"type":"absolute","value":4473504}},{"address":{"type":"absolute","value":4473562}},{"address":{"type":"absolute","value":4474105}},{"address":{"type":"absolute","value":4474342}},{"address":{"type":"absolute","value":4474419}},{"address":{"type":"absolute","value":4474537}},{"address":{"type":"absolute","value":4474823}},{"address":{"type":"absolute","value":4474945}},{"address":{"type":"absolute","value":4475078}}]},{"address":{"type":"absolute","value":4305460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358304}}]},{"address":{"type":"absolute","value":4305465},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387984}}]},{"address":{"type":"absolute","value":4305475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336816}},{"address":{"type":"absolute","value":4336919}}]},{"address":{"type":"absolute","value":4305480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356960}}]},{"address":{"type":"absolute","value":4305485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4400112}},{"address":{"type":"absolute","value":4400207}},{"address":{"type":"absolute","value":4400244}},{"address":{"type":"absolute","value":4400282}},{"address":{"type":"absolute","value":4400345}},{"address":{"type":"absolute","value":4400423}},{"address":{"type":"absolute","value":4400598}}]},{"address":{"type":"absolute","value":4305495},"matched_basic_blocks":[{"address":{"type":"absolute","value":4376930}},{"address":{"type":"absolute","value":4376992}},{"address":{"type":"absolute","value":4377069}},{"address":{"type":"absolute","value":4377300}},{"address":{"type":"absolute","value":4377329}},{"address":{"type":"absolute","value":4377342}},{"address":{"type":"absolute","value":4377435}},{"address":{"type":"absolute","value":4377535}},{"address":{"type":"absolute","value":4377613}},{"address":{"type":"absolute","value":4377652}},{"address":{"type":"absolute","value":4377672}},{"address":{"type":"absolute","value":4377724}},{"address":{"type":"absolute","value":4377746}},{"address":{"type":"absolute","value":4377908}}]},{"address":{"type":"absolute","value":4305500},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390720}}]},{"address":{"type":"absolute","value":4305510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344688}}]},{"address":{"type":"absolute","value":4305515},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498864}}]},{"address":{"type":"absolute","value":4305525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496673}}]},{"address":{"type":"absolute","value":4305550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4423856}},{"address":{"type":"absolute","value":4423975}},{"address":{"type":"absolute","value":4424165}},{"address":{"type":"absolute","value":4424339}},{"address":{"type":"absolute","value":4424506}}]},{"address":{"type":"absolute","value":4305555},"matched_basic_blocks":[{"address":{"type":"absolute","value":4419184}},{"address":{"type":"absolute","value":4419255}}]},{"address":{"type":"absolute","value":4305560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4438304}},{"address":{"type":"absolute","value":4438604}},{"address":{"type":"absolute","value":4438635}},{"address":{"type":"absolute","value":4438761}},{"address":{"type":"absolute","value":4438780}},{"address":{"type":"absolute","value":4438833}}]},{"address":{"type":"absolute","value":4305565},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485808}}]},{"address":{"type":"absolute","value":4305570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4449920}},{"address":{"type":"absolute","value":4450064}},{"address":{"type":"absolute","value":4450116}},{"address":{"type":"absolute","value":4450165}},{"address":{"type":"absolute","value":4450253}},{"address":{"type":"absolute","value":4450276}},{"address":{"type":"absolute","value":4450328}},{"address":{"type":"absolute","value":4450351}},{"address":{"type":"absolute","value":4450426}},{"address":{"type":"absolute","value":4450449}},{"address":{"type":"absolute","value":4450618}},{"address":{"type":"absolute","value":4450641}},{"address":{"type":"absolute","value":4450707}},{"address":{"type":"absolute","value":4450866}},{"address":{"type":"absolute","value":4450881}},{"address":{"type":"absolute","value":4451017}}]},{"address":{"type":"absolute","value":4305575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490369}},{"address":{"type":"absolute","value":4490378}},{"address":{"type":"absolute","value":4490389}},{"address":{"type":"absolute","value":4490427}}]},{"address":{"type":"absolute","value":4305580},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358192}}]},{"address":{"type":"absolute","value":4305600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4458816}},{"address":{"type":"absolute","value":4458938}}]},{"address":{"type":"absolute","value":4305610},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493008}}]},{"address":{"type":"absolute","value":4305620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506192}}]},{"address":{"type":"absolute","value":4305630},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485424}}]},{"address":{"type":"absolute","value":4305645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485680}}]},{"address":{"type":"absolute","value":4305655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4437792}},{"address":{"type":"absolute","value":4437988}},{"address":{"type":"absolute","value":4438016}}]},{"address":{"type":"absolute","value":4305665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391552}}]},{"address":{"type":"absolute","value":4305675},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482688}},{"address":{"type":"absolute","value":4482769}},{"address":{"type":"absolute","value":4482796}}]},{"address":{"type":"absolute","value":4305680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485904}}]},{"address":{"type":"absolute","value":4305685},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503296}}]},{"address":{"type":"absolute","value":4305690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4409968}}]},{"address":{"type":"absolute","value":4305695},"matched_basic_blocks":[{"address":{"type":"absolute","value":4463968}},{"address":{"type":"absolute","value":4464072}},{"address":{"type":"absolute","value":4464092}}]},{"address":{"type":"absolute","value":4305700},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491040}},{"address":{"type":"absolute","value":4491104}},{"address":{"type":"absolute","value":4491149}},{"address":{"type":"absolute","value":4491215}},{"address":{"type":"absolute","value":4491269}},{"address":{"type":"absolute","value":4491304}},{"address":{"type":"absolute","value":4491358}},{"address":{"type":"absolute","value":4491408}}]},{"address":{"type":"absolute","value":4305705},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337696}},{"address":{"type":"absolute","value":4337769}},{"address":{"type":"absolute","value":4337792}},{"address":{"type":"absolute","value":4337822}}]},{"address":{"type":"absolute","value":4305715},"matched_basic_blocks":[{"address":{"type":"absolute","value":4386192}},{"address":{"type":"absolute","value":4386313}},{"address":{"type":"absolute","value":4386352}}]},{"address":{"type":"absolute","value":4305720},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486192}}]},{"address":{"type":"absolute","value":4305725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464224}}]},{"address":{"type":"absolute","value":4305730},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486304}}]},{"address":{"type":"absolute","value":4305735},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364208}}]},{"address":{"type":"absolute","value":4305740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464784}},{"address":{"type":"absolute","value":4464907}}]},{"address":{"type":"absolute","value":4305745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388624}}]},{"address":{"type":"absolute","value":4305765},"matched_basic_blocks":[{"address":{"type":"absolute","value":4451456}},{"address":{"type":"absolute","value":4451556}},{"address":{"type":"absolute","value":4451613}},{"address":{"type":"absolute","value":4451723}},{"address":{"type":"absolute","value":4451743}},{"address":{"type":"absolute","value":4451798}},{"address":{"type":"absolute","value":4451815}},{"address":{"type":"absolute","value":4451888}},{"address":{"type":"absolute","value":4451905}},{"address":{"type":"absolute","value":4451923}}]},{"address":{"type":"absolute","value":4305775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509200}}]},{"address":{"type":"absolute","value":4305800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390224}}]},{"address":{"type":"absolute","value":4305805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355600}}]},{"address":{"type":"absolute","value":4305810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492784}},{"address":{"type":"absolute","value":4492863}}]},{"address":{"type":"absolute","value":4305815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4406309}},{"address":{"type":"absolute","value":4406343}},{"address":{"type":"absolute","value":4406686}}]},{"address":{"type":"absolute","value":4305820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4510963}},{"address":{"type":"absolute","value":4511016}},{"address":{"type":"absolute","value":4511030}},{"address":{"type":"absolute","value":4511051}},{"address":{"type":"absolute","value":4511063}},{"address":{"type":"absolute","value":4511071}},{"address":{"type":"absolute","value":4511167}},{"address":{"type":"absolute","value":4511468}},{"address":{"type":"absolute","value":4511703}}]},{"address":{"type":"absolute","value":4305825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453248}}]},{"address":{"type":"absolute","value":4305830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404368}},{"address":{"type":"absolute","value":4404439}}]},{"address":{"type":"absolute","value":4305845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4328288}},{"address":{"type":"absolute","value":4328380}},{"address":{"type":"absolute","value":4328505}},{"address":{"type":"absolute","value":4328542}}]},{"address":{"type":"absolute","value":4305850},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470832}}]},{"address":{"type":"absolute","value":4305855},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363072}}]},{"address":{"type":"absolute","value":4310928},"matched_basic_blocks":[{"address":{"type":"absolute","value":4310928}}]},{"address":{"type":"absolute","value":4311056},"matched_basic_blocks":[{"address":{"type":"absolute","value":4311056}}]},{"address":{"type":"absolute","value":4311408},"matched_basic_blocks":[{"address":{"type":"absolute","value":4311408}}]},{"address":{"type":"absolute","value":4312432},"matched_basic_blocks":[{"address":{"type":"absolute","value":4312432}}]},{"address":{"type":"absolute","value":4325724},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325779}}]},{"address":{"type":"absolute","value":4326006},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326043}}]},{"address":{"type":"absolute","value":4326736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326736}},{"address":{"type":"absolute","value":4326806}}]},{"address":{"type":"absolute","value":4326864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326864}}]},{"address":{"type":"absolute","value":4327024},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327024}},{"address":{"type":"absolute","value":4327087}},{"address":{"type":"absolute","value":4327121}}]},{"address":{"type":"absolute","value":4327622},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327714}}]},{"address":{"type":"absolute","value":4336159},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336166}}]},{"address":{"type":"absolute","value":4361215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361215}}]},{"address":{"type":"absolute","value":4361935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361935}}]},{"address":{"type":"absolute","value":4362665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4362665}}]},{"address":{"type":"absolute","value":4371168},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371168}},{"address":{"type":"absolute","value":4371256}},{"address":{"type":"absolute","value":4371299}},{"address":{"type":"absolute","value":4371378}},{"address":{"type":"absolute","value":4371412}},{"address":{"type":"absolute","value":4371552}},{"address":{"type":"absolute","value":4371642}}]},{"address":{"type":"absolute","value":4379632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379708}},{"address":{"type":"absolute","value":4379773}},{"address":{"type":"absolute","value":4379820}}]},{"address":{"type":"absolute","value":4379904},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379973}},{"address":{"type":"absolute","value":4380040}}]},{"address":{"type":"absolute","value":4380112},"matched_basic_blocks":[{"address":{"type":"absolute","value":4380112}},{"address":{"type":"absolute","value":4380209}}]},{"address":{"type":"absolute","value":4380272},"matched_basic_blocks":[{"address":{"type":"absolute","value":4380272}},{"address":{"type":"absolute","value":4380340}}]},{"address":{"type":"absolute","value":4394451},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394488}}]},{"address":{"type":"absolute","value":4396848},"matched_basic_blocks":[{"address":{"type":"absolute","value":4396848}},{"address":{"type":"absolute","value":4396911}},{"address":{"type":"absolute","value":4396945}}]},{"address":{"type":"absolute","value":4401568},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401568}}]},{"address":{"type":"absolute","value":4401680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401680}}]},{"address":{"type":"absolute","value":4401776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401776}}]},{"address":{"type":"absolute","value":4402832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402832}},{"address":{"type":"absolute","value":4402951}},{"address":{"type":"absolute","value":4403360}}]},{"address":{"type":"absolute","value":4418944},"matched_basic_blocks":[{"address":{"type":"absolute","value":4419050}}]},{"address":{"type":"absolute","value":4440528},"matched_basic_blocks":[{"address":{"type":"absolute","value":4440631}},{"address":{"type":"absolute","value":4440653}},{"address":{"type":"absolute","value":4440741}},{"address":{"type":"absolute","value":4440760}},{"address":{"type":"absolute","value":4440782}}]},{"address":{"type":"absolute","value":4455904},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455904}},{"address":{"type":"absolute","value":4456043}},{"address":{"type":"absolute","value":4456060}},{"address":{"type":"absolute","value":4456086}}]},{"address":{"type":"absolute","value":4458064},"matched_basic_blocks":[{"address":{"type":"absolute","value":4458064}},{"address":{"type":"absolute","value":4458158}}]},{"address":{"type":"absolute","value":4459008},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459008}},{"address":{"type":"absolute","value":4459203}}]},{"address":{"type":"absolute","value":4459296},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459296}},{"address":{"type":"absolute","value":4459364}}]},{"address":{"type":"absolute","value":4464512},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464512}}]},{"address":{"type":"absolute","value":4466544},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466544}}]},{"address":{"type":"absolute","value":4466656},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466656}}]},{"address":{"type":"absolute","value":4466768},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466768}}]},{"address":{"type":"absolute","value":4466992},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466992}}]},{"address":{"type":"absolute","value":4467216},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467216}}]},{"address":{"type":"absolute","value":4467632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467632}}]},{"address":{"type":"absolute","value":4468080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468080}},{"address":{"type":"absolute","value":4468243}},{"address":{"type":"absolute","value":4468582}}]},{"address":{"type":"absolute","value":4468575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468575}}]},{"address":{"type":"absolute","value":4469295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469295}}]},{"address":{"type":"absolute","value":4470448},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470448}},{"address":{"type":"absolute","value":4470521}},{"address":{"type":"absolute","value":4470544}},{"address":{"type":"absolute","value":4470574}}]},{"address":{"type":"absolute","value":4471696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471696}}]},{"address":{"type":"absolute","value":4472852},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472854}},{"address":{"type":"absolute","value":4472955}},{"address":{"type":"absolute","value":4473065}},{"address":{"type":"absolute","value":4473126}},{"address":{"type":"absolute","value":4473188}},{"address":{"type":"absolute","value":4473504}},{"address":{"type":"absolute","value":4473562}},{"address":{"type":"absolute","value":4474105}},{"address":{"type":"absolute","value":4474342}},{"address":{"type":"absolute","value":4474419}},{"address":{"type":"absolute","value":4474537}},{"address":{"type":"absolute","value":4474823}},{"address":{"type":"absolute","value":4474945}},{"address":{"type":"absolute","value":4475078}}]},{"address":{"type":"absolute","value":4476272},"matched_basic_blocks":[{"address":{"type":"absolute","value":4476272}},{"address":{"type":"absolute","value":4476418}},{"address":{"type":"absolute","value":4476451}},{"address":{"type":"absolute","value":4476628}},{"address":{"type":"absolute","value":4476669}}]},{"address":{"type":"absolute","value":4480208},"matched_basic_blocks":[{"address":{"type":"absolute","value":4480208}},{"address":{"type":"absolute","value":4480442}},{"address":{"type":"absolute","value":4480471}},{"address":{"type":"absolute","value":4480571}}]},{"address":{"type":"absolute","value":4481456},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481532}},{"address":{"type":"absolute","value":4481597}},{"address":{"type":"absolute","value":4481644}}]},{"address":{"type":"absolute","value":4481728},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481797}},{"address":{"type":"absolute","value":4481864}}]},{"address":{"type":"absolute","value":4481936},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481936}},{"address":{"type":"absolute","value":4482131}}]},{"address":{"type":"absolute","value":4482224},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482224}},{"address":{"type":"absolute","value":4482321}}]},{"address":{"type":"absolute","value":4482384},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482384}},{"address":{"type":"absolute","value":4482452}}]},{"address":{"type":"absolute","value":4486000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486000}}]},{"address":{"type":"absolute","value":4489616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4489675}},{"address":{"type":"absolute","value":4489695}},{"address":{"type":"absolute","value":4489712}},{"address":{"type":"absolute","value":4489732}},{"address":{"type":"absolute","value":4489868}},{"address":{"type":"absolute","value":4489893}},{"address":{"type":"absolute","value":4490004}},{"address":{"type":"absolute","value":4490031}},{"address":{"type":"absolute","value":4490072}}]},{"address":{"type":"absolute","value":4502963},"matched_basic_blocks":[{"address":{"type":"absolute","value":4502963}}]},{"address":{"type":"absolute","value":4508544},"matched_basic_blocks":[{"address":{"type":"absolute","value":4508544}}]},{"address":{"type":"absolute","value":4509056},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509056}}]},{"address":{"type":"absolute","value":4521360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350816}}]},{"address":{"type":"absolute","value":4521368},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350896}},{"address":{"type":"absolute","value":4350980}},{"address":{"type":"absolute","value":4351001}}]},{"address":{"type":"absolute","value":4521600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351168}}]},{"address":{"type":"absolute","value":4525888},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4525896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4526192},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351168}}]},{"address":{"type":"absolute","value":4526200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4526211},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4532208},"matched_basic_blocks":[{"address":{"type":"absolute","value":4532208}}]}]},"feature_counts":{"file":2659,"functions":[{"address":{"type":"absolute","value":4300810},"count":31},{"address":{"type":"absolute","value":4300815},"count":32},{"address":{"type":"absolute","value":4300820},"count":36},{"address":{"type":"absolute","value":4300825},"count":39},{"address":{"type":"absolute","value":4300835},"count":29},{"address":{"type":"absolute","value":4300840},"count":61},{"address":{"type":"absolute","value":4300850},"count":57},{"address":{"type":"absolute","value":4300855},"count":28},{"address":{"type":"absolute","value":4300865},"count":47},{"address":{"type":"absolute","value":4300870},"count":33},{"address":{"type":"absolute","value":4300875},"count":45},{"address":{"type":"absolute","value":4300880},"count":26},{"address":{"type":"absolute","value":4300885},"count":37},{"address":{"type":"absolute","value":4300890},"count":40},{"address":{"type":"absolute","value":4300895},"count":55},{"address":{"type":"absolute","value":4300900},"count":35},{"address":{"type":"absolute","value":4300905},"count":109},{"address":{"type":"absolute","value":4300910},"count":37},{"address":{"type":"absolute","value":4300915},"count":42},{"address":{"type":"absolute","value":4300925},"count":36},{"address":{"type":"absolute","value":4300930},"count":8},{"address":{"type":"absolute","value":4300935},"count":9},{"address":{"type":"absolute","value":4300945},"count":31},{"address":{"type":"absolute","value":4300950},"count":35},{"address":{"type":"absolute","value":4300955},"count":10},{"address":{"type":"absolute","value":4300960},"count":35},{"address":{"type":"absolute","value":4300965},"count":8},{"address":{"type":"absolute","value":4300975},"count":53},{"address":{"type":"absolute","value":4300980},"count":71},{"address":{"type":"absolute","value":4300985},"count":29},{"address":{"type":"absolute","value":4300990},"count":26},{"address":{"type":"absolute","value":4300995},"count":8},{"address":{"type":"absolute","value":4301000},"count":13},{"address":{"type":"absolute","value":4301005},"count":60},{"address":{"type":"absolute","value":4301010},"count":37},{"address":{"type":"absolute","value":4301020},"count":9},{"address":{"type":"absolute","value":4301025},"count":115},{"address":{"type":"absolute","value":4301035},"count":25},{"address":{"type":"absolute","value":4301050},"count":32},{"address":{"type":"absolute","value":4301055},"count":33},{"address":{"type":"absolute","value":4301060},"count":53},{"address":{"type":"absolute","value":4301070},"count":32},{"address":{"type":"absolute","value":4301075},"count":36},{"address":{"type":"absolute","value":4301080},"count":31},{"address":{"type":"absolute","value":4301085},"count":37},{"address":{"type":"absolute","value":4301090},"count":30},{"address":{"type":"absolute","value":4301095},"count":54},{"address":{"type":"absolute","value":4301100},"count":12},{"address":{"type":"absolute","value":4301110},"count":49},{"address":{"type":"absolute","value":4301115},"count":35},{"address":{"type":"absolute","value":4301120},"count":52},{"address":{"type":"absolute","value":4301125},"count":68},{"address":{"type":"absolute","value":4301130},"count":8},{"address":{"type":"absolute","value":4301135},"count":26},{"address":{"type":"absolute","value":4301140},"count":90},{"address":{"type":"absolute","value":4301150},"count":61},{"address":{"type":"absolute","value":4301155},"count":38},{"address":{"type":"absolute","value":4301160},"count":56},{"address":{"type":"absolute","value":4301165},"count":32},{"address":{"type":"absolute","value":4301170},"count":11},{"address":{"type":"absolute","value":4301175},"count":9},{"address":{"type":"absolute","value":4301180},"count":11},{"address":{"type":"absolute","value":4301190},"count":33},{"address":{"type":"absolute","value":4301195},"count":43},{"address":{"type":"absolute","value":4301200},"count":65},{"address":{"type":"absolute","value":4301205},"count":35},{"address":{"type":"absolute","value":4301210},"count":61},{"address":{"type":"absolute","value":4301215},"count":36},{"address":{"type":"absolute","value":4301220},"count":37},{"address":{"type":"absolute","value":4301230},"count":36},{"address":{"type":"absolute","value":4301240},"count":60},{"address":{"type":"absolute","value":4301245},"count":36},{"address":{"type":"absolute","value":4301255},"count":35},{"address":{"type":"absolute","value":4301265},"count":62},{"address":{"type":"absolute","value":4301270},"count":38},{"address":{"type":"absolute","value":4301275},"count":54},{"address":{"type":"absolute","value":4301280},"count":66},{"address":{"type":"absolute","value":4301290},"count":8},{"address":{"type":"absolute","value":4301295},"count":8},{"address":{"type":"absolute","value":4301300},"count":34},{"address":{"type":"absolute","value":4301305},"count":43},{"address":{"type":"absolute","value":4301310},"count":34},{"address":{"type":"absolute","value":4301315},"count":29},{"address":{"type":"absolute","value":4301320},"count":27},{"address":{"type":"absolute","value":4301330},"count":9},{"address":{"type":"absolute","value":4301335},"count":36},{"address":{"type":"absolute","value":4301345},"count":9},{"address":{"type":"absolute","value":4301350},"count":8},{"address":{"type":"absolute","value":4301355},"count":76},{"address":{"type":"absolute","value":4301370},"count":54},{"address":{"type":"absolute","value":4301375},"count":8},{"address":{"type":"absolute","value":4301380},"count":57},{"address":{"type":"absolute","value":4301385},"count":29},{"address":{"type":"absolute","value":4301390},"count":34},{"address":{"type":"absolute","value":4301395},"count":47},{"address":{"type":"absolute","value":4301405},"count":41},{"address":{"type":"absolute","value":4301410},"count":37},{"address":{"type":"absolute","value":4301415},"count":18},{"address":{"type":"absolute","value":4301420},"count":51},{"address":{"type":"absolute","value":4301425},"count":35},{"address":{"type":"absolute","value":4301435},"count":26},{"address":{"type":"absolute","value":4301440},"count":43},{"address":{"type":"absolute","value":4301445},"count":29},{"address":{"type":"absolute","value":4301455},"count":41},{"address":{"type":"absolute","value":4301460},"count":59},{"address":{"type":"absolute","value":4301470},"count":8},{"address":{"type":"absolute","value":4301475},"count":12},{"address":{"type":"absolute","value":4301480},"count":37},{"address":{"type":"absolute","value":4301485},"count":43},{"address":{"type":"absolute","value":4301505},"count":51},{"address":{"type":"absolute","value":4301510},"count":37},{"address":{"type":"absolute","value":4301515},"count":49},{"address":{"type":"absolute","value":4301520},"count":81},{"address":{"type":"absolute","value":4301525},"count":35},{"address":{"type":"absolute","value":4301530},"count":9},{"address":{"type":"absolute","value":4301535},"count":39},{"address":{"type":"absolute","value":4301545},"count":78},{"address":{"type":"absolute","value":4301550},"count":34},{"address":{"type":"absolute","value":4301555},"count":84},{"address":{"type":"absolute","value":4301565},"count":20},{"address":{"type":"absolute","value":4301570},"count":52},{"address":{"type":"absolute","value":4301575},"count":35},{"address":{"type":"absolute","value":4301580},"count":27},{"address":{"type":"absolute","value":4301585},"count":35},{"address":{"type":"absolute","value":4301590},"count":37},{"address":{"type":"absolute","value":4301595},"count":29},{"address":{"type":"absolute","value":4301600},"count":60},{"address":{"type":"absolute","value":4301605},"count":37},{"address":{"type":"absolute","value":4301615},"count":50},{"address":{"type":"absolute","value":4301620},"count":9},{"address":{"type":"absolute","value":4301625},"count":64},{"address":{"type":"absolute","value":4301630},"count":31},{"address":{"type":"absolute","value":4301635},"count":29},{"address":{"type":"absolute","value":4301640},"count":20},{"address":{"type":"absolute","value":4301650},"count":35},{"address":{"type":"absolute","value":4301655},"count":27},{"address":{"type":"absolute","value":4301665},"count":32},{"address":{"type":"absolute","value":4301675},"count":12},{"address":{"type":"absolute","value":4301690},"count":27},{"address":{"type":"absolute","value":4301695},"count":35},{"address":{"type":"absolute","value":4301700},"count":8},{"address":{"type":"absolute","value":4301710},"count":36},{"address":{"type":"absolute","value":4301715},"count":8},{"address":{"type":"absolute","value":4301725},"count":35},{"address":{"type":"absolute","value":4301730},"count":32},{"address":{"type":"absolute","value":4301735},"count":11},{"address":{"type":"absolute","value":4301740},"count":37},{"address":{"type":"absolute","value":4301750},"count":20},{"address":{"type":"absolute","value":4301755},"count":37},{"address":{"type":"absolute","value":4301760},"count":55},{"address":{"type":"absolute","value":4301765},"count":26},{"address":{"type":"absolute","value":4301770},"count":14},{"address":{"type":"absolute","value":4301780},"count":8},{"address":{"type":"absolute","value":4301785},"count":103},{"address":{"type":"absolute","value":4301790},"count":30},{"address":{"type":"absolute","value":4301795},"count":8},{"address":{"type":"absolute","value":4301800},"count":12},{"address":{"type":"absolute","value":4301810},"count":29},{"address":{"type":"absolute","value":4301815},"count":39},{"address":{"type":"absolute","value":4301820},"count":26},{"address":{"type":"absolute","value":4301825},"count":36},{"address":{"type":"absolute","value":4301835},"count":102},{"address":{"type":"absolute","value":4301860},"count":43},{"address":{"type":"absolute","value":4301865},"count":31},{"address":{"type":"absolute","value":4301870},"count":35},{"address":{"type":"absolute","value":4301875},"count":29},{"address":{"type":"absolute","value":4301880},"count":25},{"address":{"type":"absolute","value":4301885},"count":36},{"address":{"type":"absolute","value":4301895},"count":32},{"address":{"type":"absolute","value":4301900},"count":34},{"address":{"type":"absolute","value":4301905},"count":67},{"address":{"type":"absolute","value":4301910},"count":37},{"address":{"type":"absolute","value":4301915},"count":160},{"address":{"type":"absolute","value":4301925},"count":29},{"address":{"type":"absolute","value":4301935},"count":10},{"address":{"type":"absolute","value":4301940},"count":56},{"address":{"type":"absolute","value":4301950},"count":32},{"address":{"type":"absolute","value":4301955},"count":37},{"address":{"type":"absolute","value":4301960},"count":57},{"address":{"type":"absolute","value":4301965},"count":20},{"address":{"type":"absolute","value":4301970},"count":36},{"address":{"type":"absolute","value":4301985},"count":34},{"address":{"type":"absolute","value":4301995},"count":33},{"address":{"type":"absolute","value":4302000},"count":29},{"address":{"type":"absolute","value":4302015},"count":33},{"address":{"type":"absolute","value":4302020},"count":65},{"address":{"type":"absolute","value":4302035},"count":37},{"address":{"type":"absolute","value":4302040},"count":54},{"address":{"type":"absolute","value":4302045},"count":8},{"address":{"type":"absolute","value":4302050},"count":12},{"address":{"type":"absolute","value":4302060},"count":35},{"address":{"type":"absolute","value":4302065},"count":8},{"address":{"type":"absolute","value":4302070},"count":19},{"address":{"type":"absolute","value":4302075},"count":27},{"address":{"type":"absolute","value":4302080},"count":18},{"address":{"type":"absolute","value":4302085},"count":55},{"address":{"type":"absolute","value":4302100},"count":47},{"address":{"type":"absolute","value":4302105},"count":44},{"address":{"type":"absolute","value":4302110},"count":55},{"address":{"type":"absolute","value":4302115},"count":31},{"address":{"type":"absolute","value":4302120},"count":28},{"address":{"type":"absolute","value":4302125},"count":59},{"address":{"type":"absolute","value":4302130},"count":41},{"address":{"type":"absolute","value":4302135},"count":8},{"address":{"type":"absolute","value":4302140},"count":35},{"address":{"type":"absolute","value":4302150},"count":29},{"address":{"type":"absolute","value":4302155},"count":33},{"address":{"type":"absolute","value":4302160},"count":46},{"address":{"type":"absolute","value":4302165},"count":73},{"address":{"type":"absolute","value":4302170},"count":69},{"address":{"type":"absolute","value":4302175},"count":37},{"address":{"type":"absolute","value":4302180},"count":26},{"address":{"type":"absolute","value":4302190},"count":59},{"address":{"type":"absolute","value":4302200},"count":35},{"address":{"type":"absolute","value":4302205},"count":24},{"address":{"type":"absolute","value":4302210},"count":12},{"address":{"type":"absolute","value":4302215},"count":47},{"address":{"type":"absolute","value":4302225},"count":33},{"address":{"type":"absolute","value":4302230},"count":35},{"address":{"type":"absolute","value":4302235},"count":60},{"address":{"type":"absolute","value":4302240},"count":8},{"address":{"type":"absolute","value":4302245},"count":32},{"address":{"type":"absolute","value":4302250},"count":26},{"address":{"type":"absolute","value":4302255},"count":37},{"address":{"type":"absolute","value":4302260},"count":56},{"address":{"type":"absolute","value":4302265},"count":9},{"address":{"type":"absolute","value":4302270},"count":26},{"address":{"type":"absolute","value":4302275},"count":39},{"address":{"type":"absolute","value":4302280},"count":29},{"address":{"type":"absolute","value":4302285},"count":48},{"address":{"type":"absolute","value":4302290},"count":37},{"address":{"type":"absolute","value":4302295},"count":36},{"address":{"type":"absolute","value":4302300},"count":47},{"address":{"type":"absolute","value":4302305},"count":60},{"address":{"type":"absolute","value":4302320},"count":37},{"address":{"type":"absolute","value":4302325},"count":29},{"address":{"type":"absolute","value":4302335},"count":26},{"address":{"type":"absolute","value":4302340},"count":30},{"address":{"type":"absolute","value":4302345},"count":17},{"address":{"type":"absolute","value":4302350},"count":27},{"address":{"type":"absolute","value":4302355},"count":49},{"address":{"type":"absolute","value":4302360},"count":41},{"address":{"type":"absolute","value":4302365},"count":35},{"address":{"type":"absolute","value":4302370},"count":36},{"address":{"type":"absolute","value":4302375},"count":41},{"address":{"type":"absolute","value":4302380},"count":32},{"address":{"type":"absolute","value":4302395},"count":27},{"address":{"type":"absolute","value":4302400},"count":12},{"address":{"type":"absolute","value":4302405},"count":8},{"address":{"type":"absolute","value":4302410},"count":37},{"address":{"type":"absolute","value":4302415},"count":9},{"address":{"type":"absolute","value":4302420},"count":64},{"address":{"type":"absolute","value":4302425},"count":41},{"address":{"type":"absolute","value":4302430},"count":28},{"address":{"type":"absolute","value":4302435},"count":35},{"address":{"type":"absolute","value":4302440},"count":26},{"address":{"type":"absolute","value":4302445},"count":35},{"address":{"type":"absolute","value":4302450},"count":54},{"address":{"type":"absolute","value":4302460},"count":37},{"address":{"type":"absolute","value":4302465},"count":43},{"address":{"type":"absolute","value":4302470},"count":60},{"address":{"type":"absolute","value":4302475},"count":54},{"address":{"type":"absolute","value":4302480},"count":69},{"address":{"type":"absolute","value":4302495},"count":66},{"address":{"type":"absolute","value":4302510},"count":35},{"address":{"type":"absolute","value":4302525},"count":29},{"address":{"type":"absolute","value":4302530},"count":29},{"address":{"type":"absolute","value":4302535},"count":51},{"address":{"type":"absolute","value":4302550},"count":11},{"address":{"type":"absolute","value":4302555},"count":16},{"address":{"type":"absolute","value":4302560},"count":27},{"address":{"type":"absolute","value":4302565},"count":42},{"address":{"type":"absolute","value":4302570},"count":35},{"address":{"type":"absolute","value":4302585},"count":34},{"address":{"type":"absolute","value":4302590},"count":12},{"address":{"type":"absolute","value":4302595},"count":46},{"address":{"type":"absolute","value":4302600},"count":8},{"address":{"type":"absolute","value":4302605},"count":8},{"address":{"type":"absolute","value":4302610},"count":46},{"address":{"type":"absolute","value":4302615},"count":57},{"address":{"type":"absolute","value":4302620},"count":39},{"address":{"type":"absolute","value":4302635},"count":72},{"address":{"type":"absolute","value":4302640},"count":29},{"address":{"type":"absolute","value":4302645},"count":35},{"address":{"type":"absolute","value":4302655},"count":46},{"address":{"type":"absolute","value":4302665},"count":26},{"address":{"type":"absolute","value":4302670},"count":34},{"address":{"type":"absolute","value":4302675},"count":28},{"address":{"type":"absolute","value":4302685},"count":65},{"address":{"type":"absolute","value":4302690},"count":37},{"address":{"type":"absolute","value":4302695},"count":8},{"address":{"type":"absolute","value":4302700},"count":49},{"address":{"type":"absolute","value":4302705},"count":64},{"address":{"type":"absolute","value":4302710},"count":42},{"address":{"type":"absolute","value":4302715},"count":53},{"address":{"type":"absolute","value":4302725},"count":8},{"address":{"type":"absolute","value":4302730},"count":8},{"address":{"type":"absolute","value":4302740},"count":50},{"address":{"type":"absolute","value":4302745},"count":37},{"address":{"type":"absolute","value":4302750},"count":54},{"address":{"type":"absolute","value":4302755},"count":14},{"address":{"type":"absolute","value":4302765},"count":39},{"address":{"type":"absolute","value":4302770},"count":29},{"address":{"type":"absolute","value":4302775},"count":29},{"address":{"type":"absolute","value":4302780},"count":36},{"address":{"type":"absolute","value":4302785},"count":52},{"address":{"type":"absolute","value":4302790},"count":36},{"address":{"type":"absolute","value":4302795},"count":35},{"address":{"type":"absolute","value":4302800},"count":8},{"address":{"type":"absolute","value":4302810},"count":54},{"address":{"type":"absolute","value":4302815},"count":35},{"address":{"type":"absolute","value":4302825},"count":8},{"address":{"type":"absolute","value":4302830},"count":78},{"address":{"type":"absolute","value":4302835},"count":24},{"address":{"type":"absolute","value":4302840},"count":35},{"address":{"type":"absolute","value":4302845},"count":36},{"address":{"type":"absolute","value":4302860},"count":26},{"address":{"type":"absolute","value":4302865},"count":30},{"address":{"type":"absolute","value":4302870},"count":29},{"address":{"type":"absolute","value":4302875},"count":38},{"address":{"type":"absolute","value":4302880},"count":35},{"address":{"type":"absolute","value":4302885},"count":24},{"address":{"type":"absolute","value":4302890},"count":31},{"address":{"type":"absolute","value":4302895},"count":32},{"address":{"type":"absolute","value":4302900},"count":50},{"address":{"type":"absolute","value":4302910},"count":37},{"address":{"type":"absolute","value":4302915},"count":63},{"address":{"type":"absolute","value":4302920},"count":55},{"address":{"type":"absolute","value":4302925},"count":54},{"address":{"type":"absolute","value":4302930},"count":26},{"address":{"type":"absolute","value":4302935},"count":52},{"address":{"type":"absolute","value":4302940},"count":30},{"address":{"type":"absolute","value":4302950},"count":53},{"address":{"type":"absolute","value":4302955},"count":32},{"address":{"type":"absolute","value":4302960},"count":37},{"address":{"type":"absolute","value":4302965},"count":38},{"address":{"type":"absolute","value":4302970},"count":67},{"address":{"type":"absolute","value":4302975},"count":51},{"address":{"type":"absolute","value":4302980},"count":36},{"address":{"type":"absolute","value":4302995},"count":98},{"address":{"type":"absolute","value":4303000},"count":57},{"address":{"type":"absolute","value":4303015},"count":42},{"address":{"type":"absolute","value":4303020},"count":35},{"address":{"type":"absolute","value":4303025},"count":74},{"address":{"type":"absolute","value":4303030},"count":31},{"address":{"type":"absolute","value":4303035},"count":15},{"address":{"type":"absolute","value":4303040},"count":36},{"address":{"type":"absolute","value":4303050},"count":34},{"address":{"type":"absolute","value":4303055},"count":43},{"address":{"type":"absolute","value":4303060},"count":37},{"address":{"type":"absolute","value":4303065},"count":35},{"address":{"type":"absolute","value":4303075},"count":36},{"address":{"type":"absolute","value":4303080},"count":8},{"address":{"type":"absolute","value":4303085},"count":10},{"address":{"type":"absolute","value":4303090},"count":8},{"address":{"type":"absolute","value":4303095},"count":52},{"address":{"type":"absolute","value":4303100},"count":32},{"address":{"type":"absolute","value":4303105},"count":43},{"address":{"type":"absolute","value":4303110},"count":35},{"address":{"type":"absolute","value":4303115},"count":32},{"address":{"type":"absolute","value":4303130},"count":68},{"address":{"type":"absolute","value":4303140},"count":10},{"address":{"type":"absolute","value":4303145},"count":12},{"address":{"type":"absolute","value":4303155},"count":43},{"address":{"type":"absolute","value":4303160},"count":56},{"address":{"type":"absolute","value":4303165},"count":39},{"address":{"type":"absolute","value":4303170},"count":24},{"address":{"type":"absolute","value":4303175},"count":41},{"address":{"type":"absolute","value":4303180},"count":34},{"address":{"type":"absolute","value":4303190},"count":8},{"address":{"type":"absolute","value":4303195},"count":39},{"address":{"type":"absolute","value":4303200},"count":31},{"address":{"type":"absolute","value":4303205},"count":32},{"address":{"type":"absolute","value":4303210},"count":47},{"address":{"type":"absolute","value":4303220},"count":37},{"address":{"type":"absolute","value":4303225},"count":26},{"address":{"type":"absolute","value":4303230},"count":34},{"address":{"type":"absolute","value":4303235},"count":36},{"address":{"type":"absolute","value":4303245},"count":18},{"address":{"type":"absolute","value":4303265},"count":43},{"address":{"type":"absolute","value":4303270},"count":61},{"address":{"type":"absolute","value":4303275},"count":34},{"address":{"type":"absolute","value":4303280},"count":26},{"address":{"type":"absolute","value":4303285},"count":20},{"address":{"type":"absolute","value":4303290},"count":37},{"address":{"type":"absolute","value":4303295},"count":41},{"address":{"type":"absolute","value":4303305},"count":45},{"address":{"type":"absolute","value":4303310},"count":26},{"address":{"type":"absolute","value":4303320},"count":42},{"address":{"type":"absolute","value":4303325},"count":34},{"address":{"type":"absolute","value":4303330},"count":47},{"address":{"type":"absolute","value":4303335},"count":38},{"address":{"type":"absolute","value":4303340},"count":36},{"address":{"type":"absolute","value":4303350},"count":8},{"address":{"type":"absolute","value":4303355},"count":63},{"address":{"type":"absolute","value":4303365},"count":29},{"address":{"type":"absolute","value":4303375},"count":14},{"address":{"type":"absolute","value":4303380},"count":37},{"address":{"type":"absolute","value":4303385},"count":37},{"address":{"type":"absolute","value":4303400},"count":35},{"address":{"type":"absolute","value":4303410},"count":56},{"address":{"type":"absolute","value":4303415},"count":64},{"address":{"type":"absolute","value":4303420},"count":27},{"address":{"type":"absolute","value":4303425},"count":26},{"address":{"type":"absolute","value":4303430},"count":68},{"address":{"type":"absolute","value":4303450},"count":32},{"address":{"type":"absolute","value":4303455},"count":40},{"address":{"type":"absolute","value":4303460},"count":55},{"address":{"type":"absolute","value":4303465},"count":15},{"address":{"type":"absolute","value":4303470},"count":58},{"address":{"type":"absolute","value":4303475},"count":32},{"address":{"type":"absolute","value":4303480},"count":28},{"address":{"type":"absolute","value":4303485},"count":37},{"address":{"type":"absolute","value":4303490},"count":53},{"address":{"type":"absolute","value":4303495},"count":43},{"address":{"type":"absolute","value":4303505},"count":74},{"address":{"type":"absolute","value":4303510},"count":68},{"address":{"type":"absolute","value":4303520},"count":29},{"address":{"type":"absolute","value":4303525},"count":36},{"address":{"type":"absolute","value":4303530},"count":37},{"address":{"type":"absolute","value":4303535},"count":37},{"address":{"type":"absolute","value":4303540},"count":45},{"address":{"type":"absolute","value":4303550},"count":48},{"address":{"type":"absolute","value":4303555},"count":61},{"address":{"type":"absolute","value":4303575},"count":38},{"address":{"type":"absolute","value":4303580},"count":36},{"address":{"type":"absolute","value":4303585},"count":31},{"address":{"type":"absolute","value":4303595},"count":35},{"address":{"type":"absolute","value":4303605},"count":8},{"address":{"type":"absolute","value":4303615},"count":30},{"address":{"type":"absolute","value":4303620},"count":52},{"address":{"type":"absolute","value":4303625},"count":11},{"address":{"type":"absolute","value":4303630},"count":12},{"address":{"type":"absolute","value":4303635},"count":36},{"address":{"type":"absolute","value":4303640},"count":34},{"address":{"type":"absolute","value":4303645},"count":31},{"address":{"type":"absolute","value":4303650},"count":21},{"address":{"type":"absolute","value":4303655},"count":29},{"address":{"type":"absolute","value":4303660},"count":33},{"address":{"type":"absolute","value":4303665},"count":35},{"address":{"type":"absolute","value":4303675},"count":29},{"address":{"type":"absolute","value":4303680},"count":26},{"address":{"type":"absolute","value":4303690},"count":37},{"address":{"type":"absolute","value":4303700},"count":49},{"address":{"type":"absolute","value":4303710},"count":51},{"address":{"type":"absolute","value":4303715},"count":8},{"address":{"type":"absolute","value":4303720},"count":37},{"address":{"type":"absolute","value":4303725},"count":34},{"address":{"type":"absolute","value":4303735},"count":57},{"address":{"type":"absolute","value":4303745},"count":53},{"address":{"type":"absolute","value":4303755},"count":26},{"address":{"type":"absolute","value":4303765},"count":36},{"address":{"type":"absolute","value":4303770},"count":46},{"address":{"type":"absolute","value":4303775},"count":40},{"address":{"type":"absolute","value":4303780},"count":93},{"address":{"type":"absolute","value":4303790},"count":34},{"address":{"type":"absolute","value":4303795},"count":35},{"address":{"type":"absolute","value":4303800},"count":50},{"address":{"type":"absolute","value":4303805},"count":29},{"address":{"type":"absolute","value":4303815},"count":36},{"address":{"type":"absolute","value":4303820},"count":37},{"address":{"type":"absolute","value":4303825},"count":49},{"address":{"type":"absolute","value":4303830},"count":14},{"address":{"type":"absolute","value":4303835},"count":31},{"address":{"type":"absolute","value":4303840},"count":39},{"address":{"type":"absolute","value":4303845},"count":14},{"address":{"type":"absolute","value":4303855},"count":12},{"address":{"type":"absolute","value":4303860},"count":27},{"address":{"type":"absolute","value":4303865},"count":43},{"address":{"type":"absolute","value":4303870},"count":30},{"address":{"type":"absolute","value":4303875},"count":20},{"address":{"type":"absolute","value":4303880},"count":80},{"address":{"type":"absolute","value":4303890},"count":37},{"address":{"type":"absolute","value":4303895},"count":37},{"address":{"type":"absolute","value":4303905},"count":20},{"address":{"type":"absolute","value":4303910},"count":35},{"address":{"type":"absolute","value":4303915},"count":43},{"address":{"type":"absolute","value":4303920},"count":54},{"address":{"type":"absolute","value":4303925},"count":61},{"address":{"type":"absolute","value":4303930},"count":43},{"address":{"type":"absolute","value":4303935},"count":26},{"address":{"type":"absolute","value":4303940},"count":8},{"address":{"type":"absolute","value":4303945},"count":13},{"address":{"type":"absolute","value":4303950},"count":75},{"address":{"type":"absolute","value":4303955},"count":36},{"address":{"type":"absolute","value":4303960},"count":29},{"address":{"type":"absolute","value":4303965},"count":36},{"address":{"type":"absolute","value":4303970},"count":35},{"address":{"type":"absolute","value":4303985},"count":37},{"address":{"type":"absolute","value":4303990},"count":63},{"address":{"type":"absolute","value":4304000},"count":29},{"address":{"type":"absolute","value":4304015},"count":8},{"address":{"type":"absolute","value":4304020},"count":34},{"address":{"type":"absolute","value":4304025},"count":8},{"address":{"type":"absolute","value":4304030},"count":28},{"address":{"type":"absolute","value":4304040},"count":13},{"address":{"type":"absolute","value":4304045},"count":29},{"address":{"type":"absolute","value":4304060},"count":34},{"address":{"type":"absolute","value":4304065},"count":10},{"address":{"type":"absolute","value":4304070},"count":42},{"address":{"type":"absolute","value":4304075},"count":35},{"address":{"type":"absolute","value":4304080},"count":28},{"address":{"type":"absolute","value":4304085},"count":26},{"address":{"type":"absolute","value":4304090},"count":65},{"address":{"type":"absolute","value":4304095},"count":63},{"address":{"type":"absolute","value":4304100},"count":36},{"address":{"type":"absolute","value":4304105},"count":107},{"address":{"type":"absolute","value":4304110},"count":47},{"address":{"type":"absolute","value":4304115},"count":35},{"address":{"type":"absolute","value":4304120},"count":26},{"address":{"type":"absolute","value":4304125},"count":31},{"address":{"type":"absolute","value":4304130},"count":60},{"address":{"type":"absolute","value":4304135},"count":26},{"address":{"type":"absolute","value":4304140},"count":37},{"address":{"type":"absolute","value":4304145},"count":71},{"address":{"type":"absolute","value":4304150},"count":31},{"address":{"type":"absolute","value":4304155},"count":40},{"address":{"type":"absolute","value":4304160},"count":63},{"address":{"type":"absolute","value":4304165},"count":37},{"address":{"type":"absolute","value":4304175},"count":35},{"address":{"type":"absolute","value":4304185},"count":34},{"address":{"type":"absolute","value":4304190},"count":29},{"address":{"type":"absolute","value":4304195},"count":29},{"address":{"type":"absolute","value":4304205},"count":20},{"address":{"type":"absolute","value":4304215},"count":37},{"address":{"type":"absolute","value":4304220},"count":8},{"address":{"type":"absolute","value":4304225},"count":78},{"address":{"type":"absolute","value":4304235},"count":34},{"address":{"type":"absolute","value":4304240},"count":38},{"address":{"type":"absolute","value":4304245},"count":9},{"address":{"type":"absolute","value":4304250},"count":37},{"address":{"type":"absolute","value":4304255},"count":8},{"address":{"type":"absolute","value":4304260},"count":8},{"address":{"type":"absolute","value":4304265},"count":39},{"address":{"type":"absolute","value":4304270},"count":25},{"address":{"type":"absolute","value":4304275},"count":54},{"address":{"type":"absolute","value":4304280},"count":45},{"address":{"type":"absolute","value":4304295},"count":8},{"address":{"type":"absolute","value":4304300},"count":48},{"address":{"type":"absolute","value":4304305},"count":8},{"address":{"type":"absolute","value":4304310},"count":34},{"address":{"type":"absolute","value":4304315},"count":68},{"address":{"type":"absolute","value":4304325},"count":45},{"address":{"type":"absolute","value":4304330},"count":27},{"address":{"type":"absolute","value":4304335},"count":34},{"address":{"type":"absolute","value":4304340},"count":64},{"address":{"type":"absolute","value":4304350},"count":24},{"address":{"type":"absolute","value":4304355},"count":8},{"address":{"type":"absolute","value":4304360},"count":78},{"address":{"type":"absolute","value":4304365},"count":37},{"address":{"type":"absolute","value":4304370},"count":12},{"address":{"type":"absolute","value":4304375},"count":15},{"address":{"type":"absolute","value":4304380},"count":29},{"address":{"type":"absolute","value":4304385},"count":29},{"address":{"type":"absolute","value":4304390},"count":33},{"address":{"type":"absolute","value":4304395},"count":35},{"address":{"type":"absolute","value":4304400},"count":30},{"address":{"type":"absolute","value":4304405},"count":29},{"address":{"type":"absolute","value":4304410},"count":57},{"address":{"type":"absolute","value":4304415},"count":9},{"address":{"type":"absolute","value":4304430},"count":46},{"address":{"type":"absolute","value":4304440},"count":72},{"address":{"type":"absolute","value":4304445},"count":26},{"address":{"type":"absolute","value":4304460},"count":17},{"address":{"type":"absolute","value":4304465},"count":67},{"address":{"type":"absolute","value":4304470},"count":20},{"address":{"type":"absolute","value":4304475},"count":31},{"address":{"type":"absolute","value":4304480},"count":25},{"address":{"type":"absolute","value":4304490},"count":51},{"address":{"type":"absolute","value":4304495},"count":12},{"address":{"type":"absolute","value":4304500},"count":40},{"address":{"type":"absolute","value":4304505},"count":35},{"address":{"type":"absolute","value":4304510},"count":8},{"address":{"type":"absolute","value":4304515},"count":12},{"address":{"type":"absolute","value":4304520},"count":88},{"address":{"type":"absolute","value":4304535},"count":27},{"address":{"type":"absolute","value":4304540},"count":300},{"address":{"type":"absolute","value":4304545},"count":26},{"address":{"type":"absolute","value":4304550},"count":41},{"address":{"type":"absolute","value":4304560},"count":8},{"address":{"type":"absolute","value":4304570},"count":35},{"address":{"type":"absolute","value":4304580},"count":10},{"address":{"type":"absolute","value":4304595},"count":33},{"address":{"type":"absolute","value":4304605},"count":100},{"address":{"type":"absolute","value":4304610},"count":39},{"address":{"type":"absolute","value":4304620},"count":48},{"address":{"type":"absolute","value":4304625},"count":39},{"address":{"type":"absolute","value":4304630},"count":38},{"address":{"type":"absolute","value":4304635},"count":61},{"address":{"type":"absolute","value":4304645},"count":76},{"address":{"type":"absolute","value":4304650},"count":12},{"address":{"type":"absolute","value":4304660},"count":29},{"address":{"type":"absolute","value":4304665},"count":43},{"address":{"type":"absolute","value":4304670},"count":24},{"address":{"type":"absolute","value":4304675},"count":32},{"address":{"type":"absolute","value":4304680},"count":8},{"address":{"type":"absolute","value":4304685},"count":42},{"address":{"type":"absolute","value":4304690},"count":32},{"address":{"type":"absolute","value":4304705},"count":34},{"address":{"type":"absolute","value":4304710},"count":9},{"address":{"type":"absolute","value":4304715},"count":26},{"address":{"type":"absolute","value":4304725},"count":30},{"address":{"type":"absolute","value":4304730},"count":12},{"address":{"type":"absolute","value":4304735},"count":80},{"address":{"type":"absolute","value":4304740},"count":51},{"address":{"type":"absolute","value":4304745},"count":31},{"address":{"type":"absolute","value":4304750},"count":28},{"address":{"type":"absolute","value":4304755},"count":8},{"address":{"type":"absolute","value":4304770},"count":55},{"address":{"type":"absolute","value":4304775},"count":38},{"address":{"type":"absolute","value":4304780},"count":39},{"address":{"type":"absolute","value":4304785},"count":46},{"address":{"type":"absolute","value":4304790},"count":37},{"address":{"type":"absolute","value":4304795},"count":33},{"address":{"type":"absolute","value":4304800},"count":13},{"address":{"type":"absolute","value":4304805},"count":44},{"address":{"type":"absolute","value":4304810},"count":32},{"address":{"type":"absolute","value":4304815},"count":8},{"address":{"type":"absolute","value":4304820},"count":12},{"address":{"type":"absolute","value":4304830},"count":29},{"address":{"type":"absolute","value":4304835},"count":29},{"address":{"type":"absolute","value":4304845},"count":63},{"address":{"type":"absolute","value":4304850},"count":35},{"address":{"type":"absolute","value":4304860},"count":38},{"address":{"type":"absolute","value":4304870},"count":42},{"address":{"type":"absolute","value":4304875},"count":39},{"address":{"type":"absolute","value":4304880},"count":31},{"address":{"type":"absolute","value":4304890},"count":39},{"address":{"type":"absolute","value":4304895},"count":14},{"address":{"type":"absolute","value":4304900},"count":33},{"address":{"type":"absolute","value":4304910},"count":36},{"address":{"type":"absolute","value":4304920},"count":43},{"address":{"type":"absolute","value":4304930},"count":35},{"address":{"type":"absolute","value":4304935},"count":35},{"address":{"type":"absolute","value":4304940},"count":26},{"address":{"type":"absolute","value":4304945},"count":49},{"address":{"type":"absolute","value":4304950},"count":35},{"address":{"type":"absolute","value":4304955},"count":9},{"address":{"type":"absolute","value":4304965},"count":48},{"address":{"type":"absolute","value":4304970},"count":32},{"address":{"type":"absolute","value":4304975},"count":57},{"address":{"type":"absolute","value":4304980},"count":34},{"address":{"type":"absolute","value":4304995},"count":78},{"address":{"type":"absolute","value":4305005},"count":54},{"address":{"type":"absolute","value":4305010},"count":63},{"address":{"type":"absolute","value":4305025},"count":28},{"address":{"type":"absolute","value":4305030},"count":10},{"address":{"type":"absolute","value":4305040},"count":37},{"address":{"type":"absolute","value":4305045},"count":35},{"address":{"type":"absolute","value":4305050},"count":37},{"address":{"type":"absolute","value":4305055},"count":29},{"address":{"type":"absolute","value":4305065},"count":46},{"address":{"type":"absolute","value":4305070},"count":41},{"address":{"type":"absolute","value":4305075},"count":26},{"address":{"type":"absolute","value":4305080},"count":39},{"address":{"type":"absolute","value":4305085},"count":54},{"address":{"type":"absolute","value":4305090},"count":36},{"address":{"type":"absolute","value":4305095},"count":8},{"address":{"type":"absolute","value":4305115},"count":54},{"address":{"type":"absolute","value":4305120},"count":51},{"address":{"type":"absolute","value":4305125},"count":27},{"address":{"type":"absolute","value":4305130},"count":8},{"address":{"type":"absolute","value":4305140},"count":33},{"address":{"type":"absolute","value":4305145},"count":31},{"address":{"type":"absolute","value":4305150},"count":46},{"address":{"type":"absolute","value":4305155},"count":31},{"address":{"type":"absolute","value":4305160},"count":37},{"address":{"type":"absolute","value":4305165},"count":37},{"address":{"type":"absolute","value":4305170},"count":8},{"address":{"type":"absolute","value":4305185},"count":58},{"address":{"type":"absolute","value":4305190},"count":49},{"address":{"type":"absolute","value":4305195},"count":44},{"address":{"type":"absolute","value":4305205},"count":35},{"address":{"type":"absolute","value":4305210},"count":8},{"address":{"type":"absolute","value":4305220},"count":46},{"address":{"type":"absolute","value":4305225},"count":35},{"address":{"type":"absolute","value":4305230},"count":54},{"address":{"type":"absolute","value":4305235},"count":41},{"address":{"type":"absolute","value":4305245},"count":8},{"address":{"type":"absolute","value":4305250},"count":29},{"address":{"type":"absolute","value":4305255},"count":31},{"address":{"type":"absolute","value":4305260},"count":26},{"address":{"type":"absolute","value":4305270},"count":34},{"address":{"type":"absolute","value":4305275},"count":35},{"address":{"type":"absolute","value":4305280},"count":12},{"address":{"type":"absolute","value":4305285},"count":29},{"address":{"type":"absolute","value":4305290},"count":28},{"address":{"type":"absolute","value":4305295},"count":44},{"address":{"type":"absolute","value":4305300},"count":40},{"address":{"type":"absolute","value":4305310},"count":18},{"address":{"type":"absolute","value":4305315},"count":57},{"address":{"type":"absolute","value":4305320},"count":8},{"address":{"type":"absolute","value":4305325},"count":40},{"address":{"type":"absolute","value":4305330},"count":51},{"address":{"type":"absolute","value":4305335},"count":33},{"address":{"type":"absolute","value":4305340},"count":8},{"address":{"type":"absolute","value":4305345},"count":29},{"address":{"type":"absolute","value":4305350},"count":35},{"address":{"type":"absolute","value":4305355},"count":27},{"address":{"type":"absolute","value":4305360},"count":86},{"address":{"type":"absolute","value":4305365},"count":28},{"address":{"type":"absolute","value":4305370},"count":12},{"address":{"type":"absolute","value":4305375},"count":34},{"address":{"type":"absolute","value":4305380},"count":26},{"address":{"type":"absolute","value":4305390},"count":29},{"address":{"type":"absolute","value":4305395},"count":38},{"address":{"type":"absolute","value":4305405},"count":36},{"address":{"type":"absolute","value":4305410},"count":25},{"address":{"type":"absolute","value":4305425},"count":31},{"address":{"type":"absolute","value":4305430},"count":35},{"address":{"type":"absolute","value":4305435},"count":36},{"address":{"type":"absolute","value":4305445},"count":159},{"address":{"type":"absolute","value":4305450},"count":20},{"address":{"type":"absolute","value":4305460},"count":29},{"address":{"type":"absolute","value":4305465},"count":29},{"address":{"type":"absolute","value":4305475},"count":41},{"address":{"type":"absolute","value":4305480},"count":36},{"address":{"type":"absolute","value":4305485},"count":75},{"address":{"type":"absolute","value":4305490},"count":12},{"address":{"type":"absolute","value":4305495},"count":105},{"address":{"type":"absolute","value":4305500},"count":29},{"address":{"type":"absolute","value":4305510},"count":37},{"address":{"type":"absolute","value":4305515},"count":15},{"address":{"type":"absolute","value":4305525},"count":23},{"address":{"type":"absolute","value":4305535},"count":8},{"address":{"type":"absolute","value":4305550},"count":63},{"address":{"type":"absolute","value":4305555},"count":37},{"address":{"type":"absolute","value":4305560},"count":74},{"address":{"type":"absolute","value":4305565},"count":28},{"address":{"type":"absolute","value":4305570},"count":100},{"address":{"type":"absolute","value":4305575},"count":39},{"address":{"type":"absolute","value":4305580},"count":29},{"address":{"type":"absolute","value":4305585},"count":14},{"address":{"type":"absolute","value":4305600},"count":41},{"address":{"type":"absolute","value":4305610},"count":29},{"address":{"type":"absolute","value":4305620},"count":24},{"address":{"type":"absolute","value":4305630},"count":29},{"address":{"type":"absolute","value":4305635},"count":8},{"address":{"type":"absolute","value":4305645},"count":30},{"address":{"type":"absolute","value":4305650},"count":8},{"address":{"type":"absolute","value":4305655},"count":51},{"address":{"type":"absolute","value":4305660},"count":8},{"address":{"type":"absolute","value":4305665},"count":33},{"address":{"type":"absolute","value":4305675},"count":35},{"address":{"type":"absolute","value":4305680},"count":28},{"address":{"type":"absolute","value":4305685},"count":17},{"address":{"type":"absolute","value":4305690},"count":26},{"address":{"type":"absolute","value":4305695},"count":35},{"address":{"type":"absolute","value":4305700},"count":51},{"address":{"type":"absolute","value":4305705},"count":37},{"address":{"type":"absolute","value":4305715},"count":54},{"address":{"type":"absolute","value":4305720},"count":29},{"address":{"type":"absolute","value":4305725},"count":26},{"address":{"type":"absolute","value":4305730},"count":29},{"address":{"type":"absolute","value":4305735},"count":33},{"address":{"type":"absolute","value":4305740},"count":46},{"address":{"type":"absolute","value":4305745},"count":30},{"address":{"type":"absolute","value":4305750},"count":11},{"address":{"type":"absolute","value":4305765},"count":65},{"address":{"type":"absolute","value":4305775},"count":28},{"address":{"type":"absolute","value":4305780},"count":13},{"address":{"type":"absolute","value":4305785},"count":34},{"address":{"type":"absolute","value":4305790},"count":19},{"address":{"type":"absolute","value":4305800},"count":28},{"address":{"type":"absolute","value":4305805},"count":29},{"address":{"type":"absolute","value":4305810},"count":37},{"address":{"type":"absolute","value":4305815},"count":55},{"address":{"type":"absolute","value":4305820},"count":111},{"address":{"type":"absolute","value":4305825},"count":31},{"address":{"type":"absolute","value":4305830},"count":37},{"address":{"type":"absolute","value":4305840},"count":8},{"address":{"type":"absolute","value":4305845},"count":49},{"address":{"type":"absolute","value":4305850},"count":34},{"address":{"type":"absolute","value":4305855},"count":26},{"address":{"type":"absolute","value":4310928},"count":27},{"address":{"type":"absolute","value":4311056},"count":64},{"address":{"type":"absolute","value":4311408},"count":110},{"address":{"type":"absolute","value":4312432},"count":64},{"address":{"type":"absolute","value":4325724},"count":20},{"address":{"type":"absolute","value":4326006},"count":20},{"address":{"type":"absolute","value":4326736},"count":39},{"address":{"type":"absolute","value":4326864},"count":27},{"address":{"type":"absolute","value":4327024},"count":48},{"address":{"type":"absolute","value":4327568},"count":17},{"address":{"type":"absolute","value":4327622},"count":25},{"address":{"type":"absolute","value":4336094},"count":13},{"address":{"type":"absolute","value":4336159},"count":23},{"address":{"type":"absolute","value":4361150},"count":13},{"address":{"type":"absolute","value":4361215},"count":23},{"address":{"type":"absolute","value":4361870},"count":13},{"address":{"type":"absolute","value":4361935},"count":23},{"address":{"type":"absolute","value":4362600},"count":13},{"address":{"type":"absolute","value":4362665},"count":23},{"address":{"type":"absolute","value":4371168},"count":83},{"address":{"type":"absolute","value":4379632},"count":54},{"address":{"type":"absolute","value":4379904},"count":52},{"address":{"type":"absolute","value":4380112},"count":39},{"address":{"type":"absolute","value":4380272},"count":38},{"address":{"type":"absolute","value":4394451},"count":20},{"address":{"type":"absolute","value":4396848},"count":48},{"address":{"type":"absolute","value":4401568},"count":28},{"address":{"type":"absolute","value":4401680},"count":24},{"address":{"type":"absolute","value":4401776},"count":28},{"address":{"type":"absolute","value":4402832},"count":62},{"address":{"type":"absolute","value":4418944},"count":42},{"address":{"type":"absolute","value":4440528},"count":53},{"address":{"type":"absolute","value":4455904},"count":49},{"address":{"type":"absolute","value":4458064},"count":39},{"address":{"type":"absolute","value":4459008},"count":47},{"address":{"type":"absolute","value":4459296},"count":38},{"address":{"type":"absolute","value":4464512},"count":30},{"address":{"type":"absolute","value":4466544},"count":26},{"address":{"type":"absolute","value":4466656},"count":26},{"address":{"type":"absolute","value":4466768},"count":28},{"address":{"type":"absolute","value":4466992},"count":36},{"address":{"type":"absolute","value":4467216},"count":26},{"address":{"type":"absolute","value":4467632},"count":38},{"address":{"type":"absolute","value":4468080},"count":56},{"address":{"type":"absolute","value":4468510},"count":13},{"address":{"type":"absolute","value":4468575},"count":23},{"address":{"type":"absolute","value":4469230},"count":13},{"address":{"type":"absolute","value":4469295},"count":23},{"address":{"type":"absolute","value":4470448},"count":37},{"address":{"type":"absolute","value":4472852},"count":157},{"address":{"type":"absolute","value":4476272},"count":69},{"address":{"type":"absolute","value":4480208},"count":70},{"address":{"type":"absolute","value":4481456},"count":54},{"address":{"type":"absolute","value":4481728},"count":52},{"address":{"type":"absolute","value":4481936},"count":46},{"address":{"type":"absolute","value":4482224},"count":39},{"address":{"type":"absolute","value":4482384},"count":38},{"address":{"type":"absolute","value":4486000},"count":30},{"address":{"type":"absolute","value":4489616},"count":64},{"address":{"type":"absolute","value":4499520},"count":12},{"address":{"type":"absolute","value":4500326},"count":17},{"address":{"type":"absolute","value":4500365},"count":14},{"address":{"type":"absolute","value":4502963},"count":14},{"address":{"type":"absolute","value":4502990},"count":21},{"address":{"type":"absolute","value":4505102},"count":14},{"address":{"type":"absolute","value":4505121},"count":12},{"address":{"type":"absolute","value":4505600},"count":10},{"address":{"type":"absolute","value":4508544},"count":13},{"address":{"type":"absolute","value":4509056},"count":13},{"address":{"type":"absolute","value":4521360},"count":25},{"address":{"type":"absolute","value":4521368},"count":45},{"address":{"type":"absolute","value":4521600},"count":34},{"address":{"type":"absolute","value":4525888},"count":25},{"address":{"type":"absolute","value":4525896},"count":25},{"address":{"type":"absolute","value":4526192},"count":34},{"address":{"type":"absolute","value":4526200},"count":25},{"address":{"type":"absolute","value":4526211},"count":25},{"address":{"type":"absolute","value":4532208},"count":23}]},"library_functions":[{"address":{"type":"absolute","value":4319584},"name":"?"},{"address":{"type":"absolute","value":4325718},"name":"?"},{"address":{"type":"absolute","value":4326000},"name":"?"},{"address":{"type":"absolute","value":4394445},"name":"?"},{"address":{"type":"absolute","value":4471696},"name":"?GetPaltteMinSize@CMFCRibbonPanel@@IBE?AVCSize@@XZ"},{"address":{"type":"absolute","value":4497888},"name":"@_RTC_AllocaHelper@12"},{"address":{"type":"absolute","value":4497952},"name":"@_RTC_CheckStackVars2@12"},{"address":{"type":"absolute","value":4498592},"name":"__except_handler4"},{"address":{"type":"absolute","value":4498896},"name":"?find_pe_section@@YAPAU_IMAGE_SECTION_HEADER@@QAEI@Z"},{"address":{"type":"absolute","value":4499088},"name":"?is_potentially_valid_image_base@@YA_NQAX@Z"},{"address":{"type":"absolute","value":4499344},"name":"___scrt_dllmain_after_initialize_c"},{"address":{"type":"absolute","value":4499408},"name":"___scrt_dllmain_before_initialize_c"},{"address":{"type":"absolute","value":4499456},"name":"___scrt_dllmain_crt_thread_attach"},{"address":{"type":"absolute","value":4499552},"name":"___scrt_dllmain_exception_filter"},{"address":{"type":"absolute","value":4499648},"name":"___scrt_dllmain_uninitialize_c"},{"address":{"type":"absolute","value":4499712},"name":"___scrt_dllmain_uninitialize_critical"},{"address":{"type":"absolute","value":4500752},"name":"_at_quick_exit"},{"address":{"type":"absolute","value":4501648},"name":"___report_securityfailureEx"},{"address":{"type":"absolute","value":4502240},"name":"?pre_c_initialization@@YAHXZ"},{"address":{"type":"absolute","value":4502464},"name":"?post_pgo_initialization@@YAHXZ"},{"address":{"type":"absolute","value":4502480},"name":"?pre_cpp_initialization@@YAXXZ"},{"address":{"type":"absolute","value":4502512},"name":"?__scrt_common_main@@YAHXZ"},{"address":{"type":"absolute","value":4502544},"name":"?__scrt_common_main_seh@@YAHXZ"},{"address":{"type":"absolute","value":4503216},"name":"?invoke_main@@YAHXZ"},{"address":{"type":"absolute","value":4503408},"name":"?DebuggerProbe@@YA_NK@Z"},{"address":{"type":"absolute","value":4503488},"name":"?DebuggerRuntime@@YA_NKHPAXPB_W@Z"},{"address":{"type":"absolute","value":4503872},"name":"?_RTC_Failure@@YAXPAXH@Z"},{"address":{"type":"absolute","value":4504208},"name":"?_getMemBlockDataString@@YAXPAD0PBDI@Z"},{"address":{"type":"absolute","value":4504352},"name":"?_strlen_priv@@YAIPBD@Z"},{"address":{"type":"absolute","value":4504384},"name":"?failwithmessage@@YAXPAXHHPBD@Z"},{"address":{"type":"absolute","value":4505024},"name":"?notify_debugger@@YAXABUtagEXCEPTION_VISUALCPP_DEBUG_INFO@@@Z"},{"address":{"type":"absolute","value":4505184},"name":"__RTC_UninitUse"},{"address":{"type":"absolute","value":4505552},"name":"__RTC_GetErrDesc"},{"address":{"type":"absolute","value":4505696},"name":"__RTC_SetErrorType"},{"address":{"type":"absolute","value":4508000},"name":"___scrt_get_show_window_mode"},{"address":{"type":"absolute","value":4508512},"name":"?"},{"address":{"type":"absolute","value":4508576},"name":"__guard_icall_checks_enforced"},{"address":{"type":"absolute","value":4508640},"name":"___get_entropy"},{"address":{"type":"absolute","value":4509488},"name":"?GetPdbDll@@YAPAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":4509888},"name":"?GetPdbDllFromInstallPath@@YAPAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":4510640},"name":"?GetPdbDllPathFromFilePath@@YAHPB_WPA_WI@Z"},{"address":{"type":"absolute","value":4512048},"name":"__except_handler4_noexcept"}]}},"rules":{"calculate modulo 256 via x86 assembly":{"meta":{"name":"calculate modulo 256 via x86 assembly","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"instruction"},"attack":[],"mbc":[{"parts":["Data","Modulo"],"objective":"Data","behavior":"Modulo","method":"","id":"C0058"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4049A9"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: calculate modulo 256 via x86 assembly\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: instruction\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Data::Modulo [C0058]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9\r\n  features:\r\n    #  and ecx, 800000FFh\r\n    #  and ecx, 0FFh\r\n    - and:\r\n      - mnemonic: and\r\n      - or:\r\n        - number: 0x800000FF\r\n        - number: 0xFF\r\n","matches":[[{"type":"absolute","value":4399475},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":4399475}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483903}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[{"type":"absolute","value":4399475}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: delay execution\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@ramen0x3f\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449770\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.Sleep\r\n          - api: kernel32.SleepEx\r\n          - api: kernel32.WaitForSingleObject\r\n          - api: kernel32.SignalObjectAndWait\r\n          - api: kernel32.WaitForSingleObjectEx\r\n          - api: kernel32.WaitForMultipleObjects\r\n          - api: kernel32.WaitForMultipleObjectsEx\r\n          - api: kernel32.RegisterWaitForSingleObject\r\n          - api: WaitOnAddress\r\n          - api: user32.MsgWaitForMultipleObjects\r\n          - api: user32.MsgWaitForMultipleObjectsEx\r\n          - api: NtDelayExecution\r\n          - api: KeWaitForSingleObject\r\n          - api: KeDelayExecutionThread\r\n      - and:\r\n        - os: linux\r\n        - or:\r\n          - api: sleep\r\n          - api: usleep\r\n","matches":[[{"type":"absolute","value":4414048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4414140}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4447403},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4447427}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4332836},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4332840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4402572}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4496130},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4496136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443807},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4443828}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4493940},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4493954}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4494371},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4494379}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4395785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4395798}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4396319},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4396332}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4495964},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4495974}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450881},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4450905}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: open process\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Open Process [C0065]\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - or:\r\n      - api: kernel32.OpenProcess\r\n      - api: NtOpenProcess\r\n      - api: ZwOpenProcess\r\n","matches":[[{"type":"absolute","value":4446487},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4446517}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4352064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4352077}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4448742},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4448798}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4486608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4486704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443309},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4443322}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4393952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4394007}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4450094}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4476451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4476474}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate memory":{"meta":{"name":"allocate memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate memory\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA  # ntdll.NtAllocateVirtualMemory\r\n  features:\r\n    - or:\r\n      - api: kernel32.VirtualAlloc\r\n      - api: kernel32.VirtualAllocEx\r\n      - api: kernel32.VirtualAllocExNuma\r\n      - api: NtAllocateVirtualMemory\r\n      - api: ZwAllocateVirtualMemory\r\n      - api: NtMapViewOfSection\r\n      - api: ZwMapViewOfSection\r\n      - and:\r\n        - match: link function at runtime on Windows\r\n        - or:\r\n          - string: \"VirtualAlloc\"\r\n          - string: \"VirtualAllocEx\"\r\n          - string: \"VirtualAllocExNuma\"\r\n          - string: \"NtAllocateVirtualMemory\"\r\n          - string: \"ZwAllocateVirtualMemory\"\r\n          - string: \"NtMapViewOfSection\"\r\n          - string: \"ZwMapViewOfSection\"\r\n","matches":[[{"type":"absolute","value":4446875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4447016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4448846},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4448970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4399152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399225}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4399284},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4444488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4444514}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4445082},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4445118}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4327280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4327449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398553}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398612},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398628}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4326128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4326191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397419},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397435}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4330096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4330217}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400185}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400244},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450449},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4450590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RW memory":{"meta":{"name":"allocate or change RW memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate or change RW memory\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate memory\r\n        - match: change memory protection\r\n      - or:\r\n        - number: 0x4 = PAGE_READWRITE\r\n        # lea     r9d, [rcx+4]  ; flProtect\r\n        # call    cs:VirtualAlloc\r\n        - instruction:\r\n          - mnemonic: lea\r\n          - offset: 0x4 = PAGE_READWRITE\r\n","matches":[[{"type":"absolute","value":4446875},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4447016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4446875}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4446996}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4448846},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4448970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4448846}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4448947}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4399152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399225}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4399211}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4444488},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4444514}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4444488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4444500}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443488},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4443606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398480},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398553}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4398480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4398539}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398612},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398628}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4398612}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4398614}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4326128},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4326191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4326128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4326177}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4397280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4397346}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397419},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397435}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4397419}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4397421}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4330096},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4330217}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4330096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4330179},{"type":"absolute","value":4330204}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4401872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":4401979}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4401872}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4401968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400185}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4400112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4400171}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400244},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4400244}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4400246}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450449},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4450590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4450449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4450570}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Program Files directory":{"meta":{"name":"get Program Files directory","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[],"references":[],"examples":["BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get Program Files directory\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    examples:\r\n      - BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880\r\n  features:\r\n    - and:\r\n      - or:\r\n        - number: 0x26 = CSIDL_PROGRAM_FILES\r\n        - number: 0x2A = CSIDL_PROGRAM_FILESX86\r\n      - or:\r\n        - api: shell32.SHGetFolderPath\r\n        - api: shell32.SHGetFolderLocation\r\n        - api: shell32.SHGetSpecialFolderPath\r\n        - api: shell32.SHGetSpecialFolderLocation\r\n","matches":[[{"type":"absolute","value":4426650},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":4426654}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4426665}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4437988},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":4437992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4438003}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process image filename":{"meta":{"name":"get process image filename","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\r\nrule:\r\n  meta:\r\n    name: get process image filename\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.K32GetProcessImageFileName\r\n          - api: kernel32.GetProcessImageFileName\r\n      - and:\r\n        - api: System.Diagnostics.Process::GetCurrentProcess\r\n        - property/read: System.Diagnostics.Process::MainModule\r\n        - property/read: System.Diagnostics.ProcessModule::FileName\r\n","matches":[[{"type":"absolute","value":4369433},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4369574}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4352146},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4352176}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304370},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4304370}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4496937},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4496937}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open thread":{"meta":{"name":"open thread","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Thread"],"objective":"Process","behavior":"Open Thread","method":"","id":"C0066"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: open thread\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Open Thread [C0066]\r\n    examples:\r\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C\r\n  features:\r\n    - or:\r\n      - api: kernel32.OpenThread\r\n      - api: NtOpenThread\r\n      - api: ZwOpenThread\r\n","matches":[[{"type":"absolute","value":4449187},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":4449203}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4472638},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":4472651}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Explorer PID":{"meta":{"name":"get Explorer PID","namespace":"host-interaction/process/list","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp"],"examples":["al-khaser_x86.exe_:0x425210"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get Explorer PID\r\n    namespace: host-interaction/process/list\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x425210\r\n  features:\r\n    - and:\r\n      - api: GetShellWindow\r\n      - api: GetWindowThreadProcessId\r\n","matches":[[{"type":"absolute","value":4346384},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetShellWindow"}},"children":[],"locations":[{"type":"absolute","value":4346449}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowThreadProcessId"}},"children":[],"locations":[{"type":"absolute","value":4346463}],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RWX memory":{"meta":{"name":"allocate or change RWX memory","namespace":"host-interaction/process/inject","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: allocate or change RWX memory\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - \"@mr-tz\"\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\r\n      # ntdll\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate memory\r\n        - match: change memory protection\r\n      - or:\r\n        - number: 0x40 = PAGE_EXECUTE_READWRITE\r\n        # lea     r9d, [rcx+40h]  ; flProtect\r\n        # call    cs:VirtualAlloc\r\n        - instruction:\r\n          - mnemonic: lea\r\n          - offset: 0x40 = PAGE_EXECUTE_READWRITE\r\n","matches":[[{"type":"absolute","value":4399284},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399284}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4399286}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4445082},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4445118}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445082}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4445084}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4327280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4327449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4327280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4327436}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unexpected memory writes":{"meta":{"name":"check for unexpected memory writes","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Memory Write Watching"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Memory Write Watching","id":"B0001.010"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp"],"examples":["al-khaser_x86.exe_:0x431EBC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for unexpected memory writes\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x431EBC\r\n  features:\r\n    - and:\r\n      - api: kernel32.GetWriteWatch\r\n      - number: 0x0\r\n","matches":[[{"type":"absolute","value":4399631},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4399663}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4399661}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398713},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4398763}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4398761},{"type":"absolute","value":4398718}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397866},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4397885}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4397872},{"type":"absolute","value":4397874},{"type":"absolute","value":4397883},{"type":"absolute","value":4397876}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397935},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4397967}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4397965}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400345},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4400406}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4400404},{"type":"absolute","value":4400365}],"captures":{}}],"locations":[],"captures":{}}]]},"check for OutputDebugString error":{"meta":{"name":"check for OutputDebugString error","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","OutputDebugString"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"OutputDebugString","id":"B0001.016"}],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_:0x401020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for OutputDebugString error\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-02.exe_:0x401020\r\n  features:\r\n    - and:\r\n      - api: kernel32.SetLastError\r\n      - api: kernel32.GetLastError\r\n      - api: kernel32.OutputDebugString\r\n","matches":[[{"type":"absolute","value":4333602},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetLastError"}},"children":[],"locations":[{"type":"absolute","value":4333608}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[{"type":"absolute","value":4333643}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4333628}],"captures":{}}],"locations":[],"captures":{}}]]},"create process on Windows":{"meta":{"name":"create process on Windows","namespace":"host-interaction/process/create","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x406DB0","Practical Malware Analysis Lab 01-04.exe_:0x4011FC","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create process on Windows\r\n    namespace: host-interaction/process/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Process [C0017]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: kernel32.WinExec\r\n      - api: kernel32.CreateProcess\r\n      - api: shell32.ShellExecute\r\n      - api: shell32.ShellExecuteEx\r\n      - api: advapi32.CreateProcessAsUser\r\n      - api: advapi32.CreateProcessWithLogon\r\n      - api: advapi32.CreateProcessWithToken\r\n      - api: kernel32.CreateProcessInternal\r\n      - api: ntdll.NtCreateUserProcess\r\n      - api: ntdll.NtCreateProcess\r\n      - api: ntdll.NtCreateProcessEx\r\n      - api: ntdll.ZwCreateProcess\r\n      - api: ZwCreateProcessEx\r\n      - api: ntdll.ZwCreateUserProcess\r\n      - api: ntdll.RtlCreateUserProcess\r\n      - api: System.Diagnostics.Process::Start\r\n","matches":[[{"type":"absolute","value":4444419},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":4444453}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create process suspended":{"meta":{"name":"create process suspended","namespace":"host-interaction/process/create","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process","Create Suspended Process"],"objective":"Process","behavior":"Create Process","method":"Create Suspended Process","id":"C0017.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create process suspended\r\n    namespace: host-interaction/process/create\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Process::Create Suspended Process [C0017.003]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\r\n  features:\r\n    - and:\r\n      - or:\r\n        - number: 0x08000004 = CREATE_NO_WINDOW | CREATE_SUSPENDED\r\n        - number: 4 = CREATE_SUSPENDED\r\n      - or:\r\n        - api: kernel32.CreateProcess\r\n        - api: advapi32.CreateProcessAsUser\r\n","matches":[[{"type":"absolute","value":4444419},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":134217732,"description":"CREATE_NO_WINDOW | CREATE_SUSPENDED"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"CREATE_SUSPENDED"}},"children":[],"locations":[{"type":"absolute","value":4444439}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":4444453}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open file\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Create File [C0016]\r\n    examples:\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\r\n  features:\r\n    - or:\r\n      - api: CreateFile\r\n      - api: CreateFileEx\r\n      - api: IoCreateFile\r\n      - api: IoCreateFileEx\r\n      - api: ZwOpenFile\r\n      - api: ZwCreateFile\r\n      - api: NtOpenFile\r\n      - api: NtCreateFile\r\n      - api: LZCreateFile\r\n      - api: LZOpenFile\r\n      - api: fopen\r\n      - api: fopen64\r\n      - api: fdopen\r\n      - api: freopen\r\n      - api: open\r\n      - api: openat\r\n","matches":[[{"type":"absolute","value":4444623},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4444696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4437416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4437444}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4426109},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4426137}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4408516},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4408608}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4408909},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4408933}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4409132},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4409154}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"resume thread":{"meta":{"name":"resume thread","namespace":"host-interaction/thread/resume","authors":["0x534a@mailbox.org","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Resume Thread"],"objective":"Process","behavior":"Resume Thread","method":"","id":"C0054"}],"references":[],"examples":["Practical Malware Analysis Lab 12-02.exe_:0x4010EA","787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x4044C7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: resume thread\r\n    namespace: host-interaction/thread/resume\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Resume Thread [C0054]\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-02.exe_:0x4010EA\r\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x4044C7\r\n  features:\r\n    - or:\r\n      - api: kernel32.ResumeThread\r\n      - api: ntdll.NtResumeThread\r\n      - api: ntdll.ZwResumeThread\r\n      - api: System.Threading.Thread::Resume\r\n","matches":[[{"type":"absolute","value":4445368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ResumeThread"}},"children":[],"locations":[{"type":"absolute","value":4445485}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Resume"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"PEB access":{"meta":{"name":"PEB access","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block","id":"B0001.019"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp"],"examples":["al-khaser_x86.exe_:0x420D20"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: PEB access\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x420D20\r\n  features:\r\n    - or:\r\n      - characteristic: peb access\r\n      - and:\r\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41\r\n        - arch: i386\r\n        - characteristic: fs access\r\n        - or:\r\n          # in 0f5d5d07c6533bc6d991836ce79daaa1\r\n          # then we have:\r\n          #\r\n          #     xor edx, edx\r\n          #     mov edx, fs:[edx+30h]\r\n          - offset: 0x30\r\n          - instruction:\r\n            # in the case of CallObfuscator, gs:[rax]\r\n            - mnemonic: add\r\n            - number: 0x30\r\n      - and:\r\n        - arch: amd64\r\n        - characteristic: gs access\r\n        - or:\r\n          - offset: 0x60\r\n          - instruction:\r\n            - mnemonic: add\r\n            - number: 0x60\r\n      - and:\r\n        # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000\r\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45\r\n        - characteristic: fs access\r\n        - instruction:\r\n          - mnemonic: sub\r\n          - number: 0x2000\r\n","matches":[[{"type":"absolute","value":4402352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347051},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347380},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4328736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4328802}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4328826},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328826}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"sub"}},"children":[],"locations":[{"type":"absolute","value":4328832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8192}},"children":[],"locations":[{"type":"absolute","value":4328832}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328832}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328826}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[{"type":"absolute","value":4328843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4410192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4410298}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4410298}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4410298}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4325232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file attributes":{"meta":{"name":"get file attributes","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Get File Attributes"],"objective":"File System","behavior":"Get File Attributes","method":"","id":"C0049"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x180019824","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get file attributes\r\n    namespace: host-interaction/file-system/meta\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - File System::Get File Attributes [C0049]\r\n    examples:\r\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x180019824\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetFileAttributes\r\n      - api: ZwQueryDirectoryFile\r\n      - api: ZwQueryInformationFile\r\n      - api: NtQueryDirectoryFile\r\n      - api: NtQueryInformationFile\r\n      - api: System.IO.File::GetAttributes\r\n      - api: System.IO.File::GetCreationTime\r\n      - api: System.IO.File::GetCreationTimeUtc\r\n      - api: System.IO.File::GetLastAccessTime\r\n      - api: System.IO.File::GetLastAccessTimeUtc\r\n      - api: System.IO.File::GetLastWriteTime\r\n      - api: System.IO.File::GetLastWriteTimeUtc\r\n      - property/read: System.IO.FileSystemInfo::Attributes\r\n      - api: stat\r\n      - api: fstat\r\n      - api: lstat\r\n      - api: fstatat\r\n","matches":[[{"type":"absolute","value":4491536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491582}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4491696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491742}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for trap flag exception":{"meta":{"name":"check for trap flag exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp"],"examples":["al-khaser_x86.exe_:0x431680","al-khaser_x64.exe_:0x140030CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for trap flag exception\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x431680\r\n      - al-khaser_x64.exe_:0x140030CB0\r\n  features:\r\n    - and:\r\n      - or:\r\n        - description: read/write EFLAGS register\r\n        - and:\r\n          - mnemonic: pushf\r\n          - mnemonic: popf\r\n        - and:\r\n          - mnemonic: pushfd\r\n          - mnemonic: popfd\r\n        - and:\r\n          - mnemonic: pushfq\r\n          - mnemonic: popfq\r\n      - or:\r\n        - description: set trap flag\r\n        - instruction:\r\n          - mnemonic: or\r\n          - number: 0x100\r\n        - instruction:\r\n          - mnemonic: bts\r\n          - number: 0x8\r\n","matches":[[{"type":"absolute","value":4396672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"set trap flag"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":4396755}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":256}},"children":[],"locations":[{"type":"absolute","value":4396755}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4396755}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for trap flag exception/c94a9860686242a2bd2bc959b3227945"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"read/write EFLAGS register"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushf"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popf"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfd"}},"children":[],"locations":[{"type":"absolute","value":4396747}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfd"}},"children":[],"locations":[{"type":"absolute","value":4396767}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfq"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfq"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create or open registry key\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Registry::Create Registry Key [C0036.004]\r\n      - Operating System::Registry::Open Registry Key [C0036.003]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\r\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\r\n      - 493167E85E45363D09495D0841C30648:0x404D60\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\r\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\r\n  features:\r\n    - or:\r\n      - api: advapi32.RegOpenKey\r\n      - api: advapi32.RegOpenKeyEx\r\n      - api: advapi32.RegCreateKey\r\n      - api: advapi32.RegCreateKeyEx\r\n      - api: advapi32.RegOpenCurrentUser\r\n      - api: advapi32.RegOpenKeyTransacted\r\n      - api: advapi32.RegOpenUserClassesRoot\r\n      - api: advapi32.RegCreateKeyTransacted\r\n      - api: ZwOpenKey\r\n      - api: ZwOpenKeyEx\r\n      - api: ZwCreateKey\r\n      - api: ZwOpenKeyTransacted\r\n      - api: ZwOpenKeyTransactedEx\r\n      - api: ZwCreateKeyTransacted\r\n      - api: NtOpenKey\r\n      - api: NtCreateKey\r\n      - api: SHRegOpenUSKey\r\n      - api: SHRegCreateUSKey\r\n      - api: RtlCreateRegistryKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\r\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\r\n","matches":[[{"type":"absolute","value":4478944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":4479054}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4479264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":4479374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"change memory protection":{"meta":{"name":"change memory protection","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Change Memory Protection"],"objective":"Memory","behavior":"Change Memory Protection","method":"","id":"C0008"}],"references":[],"examples":["Practical Malware Analysis Lab 11-02.dll_:0x10001203"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: change memory protection\r\n    authors:\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: basic block\r\n      dynamic: call\r\n    mbc:\r\n      - Memory::Change Memory Protection [C0008]\r\n    examples:\r\n      - Practical Malware Analysis Lab 11-02.dll_:0x10001203\r\n  features:\r\n    - or:\r\n      - api: kernel32.VirtualProtect\r\n      - api: kernel32.VirtualProtectEx\r\n      - api: NtProtectVirtualMemory\r\n      - api: ZwProtectVirtualMemory\r\n      - and:\r\n        - match: link function at runtime on Windows\r\n        - or:\r\n          - string: \"VirtualProtect\"\r\n          - string: \"VirtualProtectEx\"\r\n          - string: \"NtProtectVirtualMemory\"\r\n          - string: \"ZwProtectVirtualMemory\"\r\n","matches":[[{"type":"absolute","value":4327478},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":4327516}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4401872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":4401979}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create thread\r\n    namespace: host-interaction/thread/create\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - joakim@intezer.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Create Thread [C0038]\r\n    examples:\r\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\r\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - or:\r\n          - api: kernel32.CreateThread\r\n          - api: _beginthread\r\n          - api: _beginthreadex\r\n          - api: PsCreateSystemThread\r\n          - api: SHCreateThread\r\n          - api: SHCreateThreadWithHandle\r\n          - api: kernel32.CreateRemoteThread\r\n          - api: kernel32.CreateRemoteThreadEx\r\n          - api: RtlCreateUserThread\r\n          - api: ntdll.NtCreateThread\r\n          - api: ntdll.NtCreateThreadEx\r\n          - api: ntdll.ZwCreateThread\r\n          - api: ntdll.ZwCreateThreadEx\r\n      - and:\r\n        - os: linux\r\n        - api: pthread_create\r\n      - and:\r\n        - api: System.Threading.Thread::Start\r\n        - optional:\r\n          - api: System.Threading.Thread::ctor\r\n","matches":[[{"type":"absolute","value":4443748},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":4443770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4396128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[{"type":"absolute","value":4396192}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap flags":{"meta":{"name":"get process heap flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get process heap flags\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13\r\n    examples:\r\n      - al-khaser_x86.exe_:0x425470\r\n  features:\r\n    - and:\r\n      - match: PEB access\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - number: 0x18 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x40 = ProcessHeap->HeapFlags >= Vista\r\n            - number: 0xC = ProcessHeap->HeapFlags < Vista\r\n        - and:\r\n          - arch: amd64\r\n          - number: 0x30 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x70 = ProcessHeap->HeapFlags >= Vista\r\n            - number: 0x14 = ProcessHeap->HeapFlags < Vista\r\n","matches":[[{"type":"absolute","value":4347051},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347057}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":4347068}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"access PEB ldr_data":{"meta":{"name":"access PEB ldr_data","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm","https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8"],"examples":["3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: access PEB ldr_data\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    references:\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm\r\n      - https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8\r\n    examples:\r\n      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7\r\n  features:\r\n    - or:\r\n      - and:\r\n        - arch: i386\r\n        - description: x32\r\n\r\n        - match: PEB access\r\n\r\n        # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0\r\n        # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives\r\n\r\n        - offset: 0x0C = PEB.LDR_DATA\r\n\r\n        - or:\r\n          - description: resolve a module list\r\n          - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList\r\n          - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList\r\n          - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList\r\n\r\n      - and:\r\n        - arch: amd64\r\n        - description: x64\r\n\r\n        - match: PEB access\r\n\r\n        - offset: 0x18 = PEB.LDR_DATA\r\n\r\n        - or:\r\n          - description: resolve a module list\r\n          - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList\r\n          - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList\r\n          - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList\r\n","matches":[[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402258}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402268}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get ntdll base address":{"meta":{"name":"get ntdll base address","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm"],"examples":["67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x40694A"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get ntdll base address\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    references:\r\n      - https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm\r\n    examples:\r\n      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x40694A\r\n  features:\r\n    - and:\r\n      # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink\r\n      - match: access PEB ldr_data\r\n      # -> current module\r\n      - count(offset(0)): 1\r\n      # -> ntdll -> LDR_DATA_TABLE_ENTRY.DllBase\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - offset: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase\r\n        - and:\r\n          - arch: amd64\r\n          - offset: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase\r\n","matches":[[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":4347091}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402144},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402258}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402268}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":4402280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":4402268}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap force flags":{"meta":{"name":"get process heap force flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get process heap force flags\r\n    namespace: host-interaction/process\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14\r\n    examples:\r\n      - al-khaser_x86.exe_:0x425470\r\n  features:\r\n    - and:\r\n      - match: PEB access\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - number: 0x18 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x44 = ProcessHeap->ForceFlags >= Vista\r\n            - number: 0x10 = ProcessHeap->ForceFlags < Vista\r\n        - and:\r\n          - arch: amd64\r\n          - number: 0x30 = PEB->ProcessHeap\r\n          - or:\r\n            - number: 0x74 = ProcessHeap->ForceFlags >= Vista\r\n            - number: 0x18 = ProcessHeap->ForceFlags < Vista\r\n","matches":[[{"type":"absolute","value":4347355},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347361}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":4347372}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347361}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347380},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347386}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347397}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347386}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via IOCTL":{"meta":{"name":"interact with driver via IOCTL","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x40108c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: interact with driver via IOCTL\r\n    namespace: host-interaction/driver\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    examples:\r\n      - Practical Malware Analysis Lab 10-03.exe_:0x40108c\r\n  features:\r\n    - or:\r\n      - api: DeviceIoControl\r\n","matches":[[{"type":"absolute","value":4408703},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4408754}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4408955},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4408982}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4409176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4409203}],"captures":{}}],"locations":[],"captures":{}}]]},"acquire debug privileges":{"meta":{"name":"acquire debug privileges","namespace":"host-interaction/process/modify","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x401174"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: acquire debug privileges\r\n    namespace: host-interaction/process/modify\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: thread\r\n    att&ck:\r\n      - Privilege Escalation::Access Token Manipulation [T1134]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x401174\r\n  features:\r\n    - and:\r\n      - string: \"SeDebugPrivilege\"\r\n      - optional:\r\n        - match: modify access privileges\r\n","matches":[[{"type":"absolute","value":4479868},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"SeDebugPrivilege"}},"children":[],"locations":[{"type":"absolute","value":4479906}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"modify access privileges"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB BeingDebugged flag":{"meta":{"name":"check for PEB BeingDebugged flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block BeingDebugged"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block BeingDebugged","id":"B0001.035"}],"references":["Practical Malware Analysis, Chapter 16, p. 353"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for PEB BeingDebugged flag\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: basic block\r\n      dynamic: unsupported  # requires offset features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035]\r\n    references:\r\n      - Practical Malware Analysis, Chapter 16, p. 353\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\r\n  features:\r\n    - and:\r\n      - match: PEB access\r\n      - offset: 2 = PEB.BeingDebugged\r\n","matches":[[{"type":"absolute","value":4325232},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4325232}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":2,"description":"PEB.BeingDebugged"}},"children":[],"locations":[{"type":"absolute","value":4325284}],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain loop\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    examples:\r\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\r\n  features:\r\n    - or:\r\n      - characteristic: loop\r\n      - characteristic: tight loop\r\n      - characteristic: recursive call\r\n","matches":[[{"type":"absolute","value":4300810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300810}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300895},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300895}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300915}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300975},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300975}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300980},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300980}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301110},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301110}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301140}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301200}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301265},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301275},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301275}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301420},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301420}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301460},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301460}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301545},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301545}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301625},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301625}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301785}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301835},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301835}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301905},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301905}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301915}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302020},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302110},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302110}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302160}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302165},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302165}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302190},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302190}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302215},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302215}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302260},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302285},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302285}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302305},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302305}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302375},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4502144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302420},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302420}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302425}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302450},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302450}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302495},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302495}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302535},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302535}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302635},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302635}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302675}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302685},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302685}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302705}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302715}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302810}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302830},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302830}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302950},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302965},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302965}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302975},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302975}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303130},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303130}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303270},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303270}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303430},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303430}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303460},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303460}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303470},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303470}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303505},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303505}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303510}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303745},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303745}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303925},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303925}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303950},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304070},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304070}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304090},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304090}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304095},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304095}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304105},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304105}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304145},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304145}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304225},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304225}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304440}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304535},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304535}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304605},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304605}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304635},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304635}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304645},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304645}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304725},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304725}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304735},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304735}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304740}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304845},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304845}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304945},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304945}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304995},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304995}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305010},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305010}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305115},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305115}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305195}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305330},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305330}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305495},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305495}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305550}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305575},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305575}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305715}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305785}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305815},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305820},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305820}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305845},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305845}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4371168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4371168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4379632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4379632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4379904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4379904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4402832}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4440528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4440528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4455904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4455904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4476272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4476272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4481456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4481456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4481728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4481728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4489616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4489616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unmoving mouse cursor":{"meta":{"name":"check for unmoving mouse cursor","namespace":"anti-analysis/anti-vm/vm-detection","authors":["BitsOfBinary"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","User Activity Based Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"User Activity Based Checks","id":"T1497.002"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection","Human User Check"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"Human User Check","id":"B0009.012"}],"references":["https://www.joesecurity.org/blog/5852460122427342172"],"examples":["d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for unmoving mouse cursor\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - BitsOfBinary\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check [B0009.012]\r\n    references:\r\n      - https://www.joesecurity.org/blog/5852460122427342172\r\n    examples:\r\n      - d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118\r\n  features:\r\n    - and:\r\n      - count(api(user32.GetCursorPos)): 2 or more\r\n","matches":[[{"type":"absolute","value":4300960},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetCursorPos"}}},"children":[],"locations":[{"type":"absolute","value":4414120},{"type":"absolute","value":4414159}],"captures":{}}],"locations":[],"captures":{}}]]},"reference WMI statements":{"meta":{"name":"reference WMI statements","namespace":"collection/database/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Data from Information Repositories"],"tactic":"Collection","technique":"Data from Information Repositories","subtechnique":"","id":"T1213"}],"mbc":[],"references":[],"examples":["al-khaser_x86.exe_:0x433490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference WMI statements\r\n    namespace: collection/database/wmi\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Collection::Data from Information Repositories [T1213]\r\n    examples:\r\n      - al-khaser_x86.exe_:0x433490\r\n  features:\r\n    - or:\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+CIM_./\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_./\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./\r\n","matches":[[{"type":"absolute","value":4301005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4432807}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":4432807}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404152}],"captures":{"SELECT * FROM CIM_Sensor":[{"type":"absolute","value":4404152}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4430647}],"captures":{"SELECT * FROM Win32_NetworkAdapterConfiguration":[{"type":"absolute","value":4430647}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4411735}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":4411735}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415176}],"captures":{"SELECT * FROM Win32_PerfFormattedData_Counters_ThermalZoneInformation":[{"type":"absolute","value":4415176}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4427093}],"captures":{"SELECT * FROM Win32_NTEventlogFile":[{"type":"absolute","value":4427093}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404024}],"captures":{"SELECT * FROM CIM_PhysicalConnector":[{"type":"absolute","value":4404024}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301910},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415432}],"captures":{"SELECT * FROM Win32_PortConnector":[{"type":"absolute","value":4415432}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4418856}],"captures":{"SELECT * FROM Win32_SMBIOSMemory":[{"type":"absolute","value":4418856}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415911}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":4415911}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302175},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4403896}],"captures":{"SELECT * FROM CIM_NumericSensor":[{"type":"absolute","value":4403896}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4402744}],"captures":{"SELECT * FROM Win32_CacheMemory":[{"type":"absolute","value":4402744}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4431799}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":4431799}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302685},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4433607}],"captures":{"SELECT * FROM Win32_PnPDevice":[{"type":"absolute","value":4433607}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4413239}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":4413239}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302745},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4403768}],"captures":{"SELECT * FROM CIM_Memory":[{"type":"absolute","value":4403768}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4413032}],"captures":{"SELECT * FROM Win32_MemoryDevice":[{"type":"absolute","value":4413032}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4417079}],"captures":{"SELECT * FROM Win32_BIOS":[{"type":"absolute","value":4417079}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415304}],"captures":{"SELECT * FROM Win32_PhysicalMemory":[{"type":"absolute","value":4415304}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4407445}],"captures":{"SELECT * FROM Win32_LogicalDisk":[{"type":"absolute","value":4407445}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4412904}],"captures":{"SELECT * FROM Win32_MemoryArray":[{"type":"absolute","value":4412904}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303745},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4404750}],"captures":{"SELECT * FROM Win32_Fan":[{"type":"absolute","value":4404750}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304165},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404280}],"captures":{"SELECT * FROM CIM_Slot":[{"type":"absolute","value":4404280}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4425015}],"captures":{"SELECT * FROM Win32_Bus":[{"type":"absolute","value":4425015}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304635},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4414487}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":4414487}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404536}],"captures":{"SELECT * FROM CIM_VoltageSensor":[{"type":"absolute","value":4404536}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4423975}],"captures":{"SELECT * FROM Win32_BaseBoard":[{"type":"absolute","value":4423975}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4419224}],"captures":{"SELECT * FROM Win32_VoltageProbe":[{"type":"absolute","value":4419224}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305815},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[{"type":"absolute","value":4406343}],"captures":{"SELECT * FROM MSAcpi_ThermalZoneTemperature":[{"type":"absolute","value":4406343}]}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305830},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404408}],"captures":{"SELECT * FROM CIM_TemperatureSensor":[{"type":"absolute","value":4404408}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4402951}],"captures":{"SELECT * FROM Win32_VideoController":[{"type":"absolute","value":4402951}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write process memory":{"meta":{"name":"write process memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Process Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"","id":"T1055"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: write process memory\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Defense Evasion::Process Injection [T1055]\r\n    examples:\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\r\n  features:\r\n    - or:\r\n      - api: kernel32.WriteProcessMemory\r\n      - api: ntdll.NtWriteVirtualMemory\r\n      - api: ntdll.ZwWriteVirtualMemory\r\n      - api: NtWow64WriteVirtualMemory64\r\n","matches":[[{"type":"absolute","value":4301025},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4447116}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4449068}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4445204},{"type":"absolute","value":4445350},{"type":"absolute","value":4445407}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4443714}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305570},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4450690}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: link function at runtime on Windows\r\n    namespace: linking/runtime-linking\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\r\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - api: kernel32.GetProcAddress\r\n        - api: ntdll.LdrGetProcedureAddress\r\n      - optional:\r\n        - characteristic: indirect call\r\n        - api: kernel32.LoadLibrary\r\n        - api: kernel32.GetModuleHandle\r\n        - api: kernel32.GetModuleHandleEx\r\n        - api: ntdll.LdrLoadDll\r\n","matches":[[{"type":"absolute","value":4301025},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4446824},{"type":"absolute","value":4446683},{"type":"absolute","value":4446726}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4447337},{"type":"absolute","value":4447291}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4446569},{"type":"absolute","value":4446621}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4448694}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4448619}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4445034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4445069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4445020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302420},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4453977}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":4453918}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302465},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4442097}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4442047}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4443443}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4443374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305570},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4450300},{"type":"absolute","value":4450398},{"type":"absolute","value":4450199}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4450769},{"type":"absolute","value":4450815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4450225},{"type":"absolute","value":4450143}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305765},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4451770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":4451695}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305820},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4511151}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4511233},{"type":"absolute","value":4511395},{"type":"absolute","value":4511580},{"type":"absolute","value":4511560},{"type":"absolute","value":4511690},{"type":"absolute","value":4511499},{"type":"absolute","value":4511275},{"type":"absolute","value":4511786},{"type":"absolute","value":4511600},{"type":"absolute","value":4511540},{"type":"absolute","value":4511317},{"type":"absolute","value":4511446},{"type":"absolute","value":4511196},{"type":"absolute","value":4511356}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305845},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4328463}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get common file path\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\r\n      - 972B219F18379907A045431303F4DA7D:0x404887\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetTempPath\r\n      - api: kernel32.GetTempFileName\r\n      - api: kernel32.GetSystemDirectory\r\n      - api: kernel32.GetWindowsDirectory\r\n      - api: kernel32.GetSystemWow64Directory\r\n      - api: GetAllUsersProfileDirectory\r\n      - api: GetAppContainerFolderPath\r\n      - api: GetCurrentDirectory\r\n      - api: GetDefaultUserProfileDirectory\r\n      - api: GetProfilesDirectory\r\n      - api: GetUserProfileDirectory\r\n      - api: SHGetFolderPathAndSubDir\r\n      - api: shell32.SHGetFolderPath\r\n      - api: shell32.SHGetFolderLocation\r\n      - api: shell32.SHGetKnownFolderPath\r\n      - api: shell32.SHGetSpecialFolderPath\r\n      - api: shell32.SHGetSpecialFolderLocation\r\n      - api: System.IO.Directory::GetCurrentDirectory\r\n      - api: System.Environment::GetFolderPath\r\n      - property/read: System.Environment::SystemDirectory\r\n      - property/read: System.Environment::CurrentDirectory\r\n","matches":[[{"type":"absolute","value":4301060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4426665}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301125},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[{"type":"absolute","value":4369447}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4369477}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301545},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":4428784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":4438548}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305655},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4438003}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query environment variable":{"meta":{"name":"query environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com","@_re_fox"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x401880","0761142efbda6c4b1e801223de723578:0x65483490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query environment variable\r\n    namespace: host-interaction/environment-variable\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    examples:\r\n      - Practical Malware Analysis Lab 14-02.exe_:0x401880\r\n      - 0761142efbda6c4b1e801223de723578:0x65483490\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetEnvironmentVariable\r\n      - api: kernel32.GetEnvironmentStrings\r\n      - api: kernel32.ExpandEnvironmentStrings\r\n      - api: msvcr90.getenv\r\n      - api: msvcrt.getenv\r\n      - api: System.Environment::GetEnvironmentVariable\r\n      - api: System.Environment::GetEnvironmentVariables\r\n      - api: System.Environment::ExpandEnvironmentVariables\r\n","matches":[[{"type":"absolute","value":4301060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":4426635}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301125},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":4369648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303780},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":4397590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305655},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":4437973}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate process modules":{"meta":{"name":"enumerate process modules","namespace":"host-interaction/process/modules/list","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":[],"examples":["6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8","9B2FD471274C41626B75DDBB5C897877:0x100046B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate process modules\r\n    namespace: host-interaction/process/modules/list\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    examples:\r\n      - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8\r\n      - 9B2FD471274C41626B75DDBB5C897877:0x100046B0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - optional:\r\n          - or:\r\n            - api: kernel32.OpenProcess\r\n            - api: kernel32.CloseHandle\r\n        - or:\r\n          - api: kernel32.K32EnumProcessModules\r\n          - api: kernel32.K32EnumProcessModulesEx\r\n          - api: kernel32.K32EnumProcesses\r\n          # depending on OS version in kernel32 or psapi\r\n          - api: EnumProcessModules\r\n          - api: EnumProcessModulesEx\r\n          - api: EnumProcesses\r\n      - and:\r\n        - api: kernel32.Module32First\r\n        - api: kernel32.Module32Next\r\n        - optional:\r\n          - basic block:\r\n            - and:\r\n              - or:\r\n                - number: 0x8 = TH32CS_SNAPMODULE\r\n                - number: 0x10 = TH32CS_SNAPMODULE32\r\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n          - call:\r\n            - and:\r\n              - or:\r\n                - number: 0x8 = TH32CS_SNAPMODULE\r\n                - number: 0x10 = TH32CS_SNAPMODULE32\r\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n      - and:\r\n        - property/read: System.Diagnostics.Process::Modules\r\n        - property/read: System.Diagnostics.ProcessModuleCollection::Item\r\n","matches":[[{"type":"absolute","value":4301120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":4448162}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":4448221}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4448127}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[{"type":"absolute","value":4448125}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4448064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4448236}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303270},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":4378515}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":4378605}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4378424}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[{"type":"absolute","value":4378422}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4378352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4378651}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303940},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/c91009d65f674caeafbe54a779f84d1b"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[{"type":"absolute","value":4497339},{"type":"absolute","value":4303940}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305095},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/c91009d65f674caeafbe54a779f84d1b"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[{"type":"absolute","value":4497345},{"type":"absolute","value":4305095}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4476272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/c91009d65f674caeafbe54a779f84d1b"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/8b331e58071546b195638f7dded0de86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4476474}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4476570}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[{"type":"absolute","value":4476525}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[{"type":"absolute","value":4476380}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get disk information":{"meta":{"name":"get disk information","namespace":"host-interaction/hardware/storage","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0","972B219F18379907A045431303F4DA7D:0x41064E"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get disk information\r\n    namespace: host-interaction/hardware/storage\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\r\n      - 972B219F18379907A045431303F4DA7D:0x41064E\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetDriveType\r\n      - api: kernel32.GetLogicalDrives\r\n      - api: kernel32.GetVolumeInformation\r\n      - api: kernel32.GetVolumeNameForVolumeMountPoint\r\n      - api: kernel32.GetVolumePathNamesForVolumeName\r\n      - api: kernel32.GetLogicalDriveStrings\r\n      - api: kernel32.QueryDosDevice\r\n      - property/read: System.IO.DriveInfo::VolumeLabel\r\n      - property/read: System.IO.DriveInfo::DriveType\r\n      - property/read: System.IO.DriveInfo::DriveFormat\r\n      - property/read: System.IO.DriveInfo::Name\r\n","matches":[[{"type":"absolute","value":4301125},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":4369690}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4371168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":4371505}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get system information on Windows":{"meta":{"name":"get system information on Windows","namespace":"host-interaction/os/info","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get system information on Windows\r\n    namespace: host-interaction/os/info\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - joakim@intezer.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    examples:\r\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - api: kernel32.GetSystemInfo\r\n        - api: kernel32.GetNativeSystemInfo\r\n        - api: NtQuerySystemInformation\r\n        - api: NtQuerySystemInformationEx\r\n        - api: ntdll.RtlGetNativeSystemInformation\r\n        - api: ZwQuerySystemInformation\r\n        - api: ZwQuerySystemInformationEx\r\n","matches":[[{"type":"absolute","value":4301140},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4339704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4341064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4327421}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305445},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4473175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4472852},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4473175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"print debug messages":{"meta":{"name":"print debug messages","namespace":"host-interaction/log/debug/write-event","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: print debug messages\r\n    namespace: host-interaction/log/debug/write-event\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x401000\r\n  features:\r\n    - or:\r\n      - api: DbgPrint\r\n      - api: kernel32.OutputDebugString\r\n","matches":[[{"type":"absolute","value":4301140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4340226},{"type":"absolute","value":4340131},{"type":"absolute","value":4340483},{"type":"absolute","value":4340037},{"type":"absolute","value":4339942},{"type":"absolute","value":4340169},{"type":"absolute","value":4340201},{"type":"absolute","value":4340011},{"type":"absolute","value":4340457},{"type":"absolute","value":4340398},{"type":"absolute","value":4340537},{"type":"absolute","value":4340091}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301860},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4333628}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303925},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4395762},{"type":"absolute","value":4395925},{"type":"absolute","value":4395864},{"type":"absolute","value":4395833},{"type":"absolute","value":4395947},{"type":"absolute","value":4395886}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304145},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4396296},{"type":"absolute","value":4396481},{"type":"absolute","value":4396420},{"type":"absolute","value":4396216},{"type":"absolute","value":4396459},{"type":"absolute","value":4396398},{"type":"absolute","value":4396367}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304475},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4395583}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305190},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4395400},{"type":"absolute","value":4395343}],"captures":{}}],"locations":[],"captures":{}}]]},"terminate process":{"meta":{"name":"terminate process","namespace":"host-interaction/process/terminate","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Terminate Process"],"objective":"Process","behavior":"Terminate Process","method":"","id":"C0018"}],"references":[],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x401A77","9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: terminate process\r\n    namespace: host-interaction/process/terminate\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Process::Terminate Process [C0018]\r\n    examples:\r\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\r\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\r\n  features:\r\n    - or:\r\n      - api: System.Diagnostics.Process::Kill\r\n      - api: System.Diagnostics.Process::WaitForExit\r\n      - api: System.Diagnostics.Process::WaitForExitAsync\r\n      - api: System.Environment::Exit\r\n      - api: System.Windows.Forms.Application::Exit\r\n      - api: exit\r\n      - api: Exit\r\n      - and:\r\n        - optional:\r\n          - match: open process\r\n        - or:\r\n          - api: kernel32.TerminateProcess\r\n          - api: ntdll.NtTerminateProcess\r\n          - api: kernel32.ExitProcess\r\n","matches":[[{"type":"absolute","value":4301210},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":4465972},{"type":"absolute","value":4465902}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[{"type":"absolute","value":4500993}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304260},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":4512473},{"type":"absolute","value":4304260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for debugger via API":{"meta":{"name":"check for debugger via API","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","CheckRemoteDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"CheckRemoteDebuggerPresent","id":"B0001.002"},{"parts":["Anti-Behavioral Analysis","Debugger Detection","WudfIsAnyDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"WudfIsAnyDebuggerPresent","id":"B0001.031"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp"],"examples":["al-khaser_x86.exe_:0x420000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for debugger via API\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]\r\n      - Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x420000\r\n  features:\r\n    - or:\r\n      # We're not including kernel32.IsDebuggerPresent here because some exception handlers and other compiler-inserted\r\n      # code may add calls to it, especially in debug builds. So, likely even with pretty good library code detection\r\n      # this feature could result in many false positives.\r\n      - api: kernel32.CheckRemoteDebuggerPresent\r\n      - api: WUDFPlatform.WudfIsAnyDebuggerPresent\r\n      - api: WUDFPlatform.WudfIsKernelDebuggerPresent\r\n      - api: WUDFPlatform.WudfIsUserDebuggerPresent\r\n      - property/read: System.Diagnostics.Debugger::IsAttached\r\n      - api: System.Diagnostics.Debugger::IsLogging\r\n","matches":[[{"type":"absolute","value":4301550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CheckRemoteDebuggerPresent"}},"children":[],"locations":[{"type":"absolute","value":4325455}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsAnyDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsKernelDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsUserDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Debugger::IsAttached"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Debugger::IsLogging"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check process job object":{"meta":{"name":"check process job object","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp"],"examples":["al-khaser_x86.exe_:0x426730"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check process job object\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x426730\r\n  features:\r\n    - or:\r\n      # static\r\n      - and:\r\n        - match: contain loop\r\n        - basic block:\r\n          - and:\r\n            - api: kernel32.QueryInformationJobObject\r\n            - number: 0x3 = JobObjectBasicProcessIdList\r\n        - basic block:\r\n          - and:\r\n            - api: kernel32.OpenProcess\r\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\r\n      # dynamic\r\n      - and:\r\n        - call:\r\n          - and:\r\n            - api: kernel32.QueryInformationJobObject\r\n            - number: 0x3 = JobObjectBasicProcessIdList\r\n        - call:\r\n          - and:\r\n            - api: kernel32.OpenProcess\r\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\r\n","matches":[[{"type":"absolute","value":4301555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/32a83c80df664d7bae9319c33769c72d"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/2df68db0ccc148dbab4fe2eb86c952c5"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4301555}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryInformationJobObject"}},"children":[],"locations":[{"type":"absolute","value":4351957}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"JobObjectBasicProcessIdList"}},"children":[],"locations":[{"type":"absolute","value":4351953}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4351915}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4352077}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1024,"description":"PROCESS_QUERY_INFORMATION"}},"children":[],"locations":[{"type":"absolute","value":4352072}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4352064}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute anti-debugging instructions":{"meta":{"name":"execute anti-debugging instructions","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Anti-debugging Instructions"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Anti-debugging Instructions","id":"B0001.034"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x401300"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: execute anti-debugging instructions\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-03.exe_:0x401300\r\n  features:\r\n    - or:\r\n      - count(mnemonic(rdtsc)): 2 or more\r\n      - mnemonic: icebp\r\n","matches":[[{"type":"absolute","value":4301625},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":4493440},{"type":"absolute","value":4493468}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":4493223},{"type":"absolute","value":4493198},{"type":"absolute","value":4493175}],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate processes":{"meta":{"name":"enumerate processes","namespace":"host-interaction/process/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"},{"parts":["Discovery","Software Discovery"],"tactic":"Discovery","technique":"Software Discovery","subtechnique":"","id":"T1518"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403DAB","35d04ecd797041eee796f4ddaa96cae8:0x10004F34"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate processes\r\n    namespace: host-interaction/process/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n      - Discovery::Software Discovery [T1518]\r\n    examples:\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403DAB\r\n      - 35d04ecd797041eee796f4ddaa96cae8:0x10004F34\r\n  features:\r\n    - or:\r\n      - api: System.Diagnostics.Process::GetProcesses\r\n      - and:\r\n        - api: kernel32.Process32First\r\n        - api: kernel32.Process32Next\r\n        - optional:\r\n          - basic block:\r\n            - and:\r\n              - or:\r\n                - number: 0xF = TH32CS_SNAPALL\r\n                - number: 0x2 = TH32CS_SNAPPROCESS\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n          - call:\r\n            - and:\r\n              - or:\r\n                - number: 0xF = TH32CS_SNAPALL\r\n                - number: 0x2 = TH32CS_SNAPPROCESS\r\n              - api: kernel32.CreateToolhelp32Snapshot\r\n","matches":[[{"type":"absolute","value":4301760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetProcesses"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32First"}},"children":[],"locations":[{"type":"absolute","value":4477140}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32Next"}},"children":[],"locations":[{"type":"absolute","value":4477265}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4477076}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"TH32CS_SNAPALL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"TH32CS_SNAPPROCESS"}},"children":[],"locations":[{"type":"absolute","value":4477074}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4476992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate processes/bc9a3c91e8f94c8ba66842d00377c5d0"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject APC":{"meta":{"name":"inject APC","namespace":"host-interaction/process/inject","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Asynchronous Procedure Call"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Asynchronous Procedure Call","id":"T1055.004"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x140019348"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: inject APC\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Asynchronous Procedure Call [T1055.004]\r\n    examples:\r\n      - al-khaser_x64.exe_:0x140019348\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: write process memory\r\n        - match: create or open section object\r\n        - api: kernel32.MapViewOfFile\r\n      - or:\r\n        - api: kernel32.QueueUserAPC\r\n        - api: ntdll.NtQueueApcThread\r\n      - optional:\r\n        - or:\r\n          - number: 0x1fffff = THREAD_ALL_ACCESS\r\n          - api: kernel32.CreateProcess\r\n          - api: kernel32.OpenProcess\r\n","matches":[[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueueUserAPC"}},"children":[],"locations":[{"type":"absolute","value":4449254}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueueApcThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4449068}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4301785}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open section object"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MapViewOfFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2097151,"description":"THREAD_ALL_ACCESS"}},"children":[],"locations":[{"type":"absolute","value":4448793},{"type":"absolute","value":4449198}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4448798}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate threads":{"meta":{"name":"enumerate threads","namespace":"host-interaction/thread/list","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[{"parts":["Process","Enumerate Threads"],"objective":"Process","behavior":"Enumerate Threads","method":"","id":"C0064"}],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x10006BD5"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate threads\r\n    namespace: host-interaction/thread/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Process Discovery [T1057]\r\n    mbc:\r\n      - Process::Enumerate Threads [C0064]\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x10006BD5\r\n  features:\r\n    - and:\r\n      - api: kernel32.Thread32First\r\n      - api: kernel32.Thread32Next\r\n      - optional:\r\n        - basic block:\r\n          - and:\r\n            - or:\r\n              - number: 0x4 = TH32CS_SNAPTHREAD\r\n              # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot\r\n            - api: kernel32.CreateToolhelp32Snapshot\r\n        - call:\r\n          - and:\r\n            - or:\r\n              - number: 0x4 = TH32CS_SNAPTHREAD\r\n            - api: kernel32.CreateToolhelp32Snapshot\r\n","matches":[[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":4449156}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":4449364}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4449107}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":4449105}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4449103}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/e918d7b548ab4219afd7b1e887aa7333"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302305},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":4472615}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":4472739}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4472582}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":4472580}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4472528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/e918d7b548ab4219afd7b1e887aa7333"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute shellcode via indirect call":{"meta":{"name":"execute shellcode via indirect call","namespace":"load-code/shellcode","authors":["ronnie.salomonsen@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: execute shellcode via indirect call\r\n    namespace: load-code/shellcode\r\n    authors:\r\n      - ronnie.salomonsen@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires characteristic features\r\n    mbc:\r\n      - Memory::Allocate Memory [C0007]\r\n  features:\r\n    - and:\r\n      - match: allocate or change RWX memory\r\n      - or:\r\n        - characteristic: indirect call\r\n        - characteristic: cross section flow\r\n","matches":[[{"type":"absolute","value":4301835},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399284}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4399286}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399284}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4399603}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4445118}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445082}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4445084}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445082}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4445069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4327449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4327280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4327436}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/62333f7427bc4563bf67b6dee8a5a79c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4327280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4327549}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file size":{"meta":{"name":"get file size","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["mimikatz.exe_:0x40630D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get file size\r\n    namespace: host-interaction/file-system/meta\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - mimikatz.exe_:0x40630D\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetFileSize\r\n      - api: kernel32.GetFileSizeEx\r\n      - property/read: System.IO.FileInfo::Length\r\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSize"}},"children":[],"locations":[{"type":"absolute","value":4444753}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSizeEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileInfo::Length"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read file on Windows\r\n    namespace: host-interaction/file-system/read\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - File System::Read File [C0051]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\r\n  features:\r\n    - or:\r\n      - and:\r\n        - os: windows\r\n        - optional:\r\n          - and:\r\n            - number: 0x80000000 = GENERIC_READ\r\n            - match: create or open file\r\n        - or:\r\n          - api: kernel32.ReadFile\r\n          - api: ReadFileEx\r\n          - api: NtReadFile\r\n          - api: ZwReadFile\r\n          - api: LZRead\r\n          - api: _read\r\n          - api: fread\r\n      - api: System.IO.File::ReadAllBytes\r\n      - api: System.IO.File::ReadAllBytesAsync\r\n      - api: System.IO.File::ReadAllLines\r\n      - api: System.IO.File::ReadAllLinesAsync\r\n      - api: System.IO.File::ReadAllText\r\n      - api: System.IO.File::ReadAllTextAsync\r\n      - api: System.IO.File::ReadLines\r\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[{"type":"absolute","value":4444684}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4444696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4444623}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[{"type":"absolute","value":4444904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"use process replacement":{"meta":{"name":"use process replacement","namespace":"host-interaction/process/inject","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Process Hollowing"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Process Hollowing","id":"T1055.012"},{"parts":["Defense Evasion","Reflective Code Loading"],"tactic":"Defense Evasion","technique":"Reflective Code Loading","subtechnique":"","id":"T1620"}],"mbc":[],"references":["http://www.autosectools.com/process-hollowing.pdf","https://www.andreafortuna.org/2017/10/09/understanding-process-hollowing/"],"examples":["Practical Malware Analysis Lab 12-02.exe_:0x4010EA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: use process replacement\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Process Hollowing [T1055.012]\r\n      - Defense Evasion::Reflective Code Loading [T1620]\r\n    references:\r\n      - http://www.autosectools.com/process-hollowing.pdf\r\n      - https://www.andreafortuna.org/2017/10/09/understanding-process-hollowing/\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-02.exe_:0x4010EA\r\n  features:\r\n    - and:\r\n      - match: create process suspended\r\n      - match: write process memory\r\n      - match: resume thread\r\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create process suspended"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":134217732,"description":"CREATE_NO_WINDOW | CREATE_SUSPENDED"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"CREATE_SUSPENDED"}},"children":[],"locations":[{"type":"absolute","value":4444439}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":4444453}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4444419}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4445204},{"type":"absolute","value":4445350},{"type":"absolute","value":4445407}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4301915}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"resume thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ResumeThread"}},"children":[],"locations":[{"type":"absolute","value":4445485}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Resume"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445368}],"captures":{}}],"locations":[],"captures":{}}]]},"parse PE header":{"meta":{"name":"parse PE header","namespace":"load-code/pe","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403DD0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: parse PE header\r\n    namespace: load-code/pe\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic, operand[1].offset features\r\n    att&ck:\r\n      - Execution::Shared Modules [T1129]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - and:\r\n        - mnemonic: cmp\r\n        - or:\r\n          - number: 0x4550 = IMAGE_NT_SIGNATURE (PE)\r\n          - and:\r\n            - number: 0x50\r\n            - number: 0x45\r\n        - or:\r\n          - number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ)\r\n          - and:\r\n            - number: 0x4D\r\n            - number: 0x5A\r\n        - optional:\r\n          - and:\r\n            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n            - or:\r\n              - and:\r\n                - arch: i386\r\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\r\n                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n              - and:\r\n                - arch: amd64\r\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\r\n                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase\r\n          - basic block:\r\n            - and:\r\n              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\r\n              - 3 or more:\r\n                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine\r\n                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\r\n                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\r\n                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics\r\n                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit\r\n                - or:\r\n                  - and:\r\n                    - arch: i386\r\n                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\r\n                  - and:\r\n                    - arch: amd64\r\n                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\r\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\r\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4444805},{"type":"absolute","value":4444938},{"type":"absolute","value":4445580},{"type":"absolute","value":4444818},{"type":"absolute","value":4445075},{"type":"absolute","value":4445719},{"type":"absolute","value":4445210},{"type":"absolute","value":4445595},{"type":"absolute","value":4445469},{"type":"absolute","value":4444702},{"type":"absolute","value":4444715},{"type":"absolute","value":4444459},{"type":"absolute","value":4445356},{"type":"absolute","value":4444977},{"type":"absolute","value":4444594},{"type":"absolute","value":4445491},{"type":"absolute","value":4445619},{"type":"absolute","value":4445626},{"type":"absolute","value":4445504},{"type":"absolute","value":4445124},{"type":"absolute","value":4445254},{"type":"absolute","value":4445768},{"type":"absolute","value":4445001},{"type":"absolute","value":4445137},{"type":"absolute","value":4445650},{"type":"absolute","value":4444759},{"type":"absolute","value":4445657},{"type":"absolute","value":4445026},{"type":"absolute","value":4445413},{"type":"absolute","value":4444520},{"type":"absolute","value":4444910},{"type":"absolute","value":4445040},{"type":"absolute","value":4444533},{"type":"absolute","value":4444791},{"type":"absolute","value":4445688},{"type":"absolute","value":4444665},{"type":"absolute","value":4445566},{"type":"absolute","value":4445695}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":4444977}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":4444938}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":4444962},{"type":"absolute","value":4445274}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[{"type":"absolute","value":4445097}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[{"type":"absolute","value":4445001},{"type":"absolute","value":4445107},{"type":"absolute","value":4445380}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[{"type":"absolute","value":4445097}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/b9b4ad7a16e14936bcf46acdb475b08d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303410},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4508129},{"type":"absolute","value":4508145},{"type":"absolute","value":4508226},{"type":"absolute","value":4508172},{"type":"absolute","value":4508205},{"type":"absolute","value":4508191}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":4508172}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":4508145}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":4508163}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/b9b4ad7a16e14936bcf46acdb475b08d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305820},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4511456},{"type":"absolute","value":4511075},{"type":"absolute","value":4511235},{"type":"absolute","value":4511619},{"type":"absolute","value":4511079},{"type":"absolute","value":4511464},{"type":"absolute","value":4511018},{"type":"absolute","value":4511722},{"type":"absolute","value":4511088},{"type":"absolute","value":4511473},{"type":"absolute","value":4511728},{"type":"absolute","value":4511059},{"type":"absolute","value":4510996},{"type":"absolute","value":4511734},{"type":"absolute","value":4511706},{"type":"absolute","value":4511067},{"type":"absolute","value":4511100}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":4511018}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":4510991}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":4511005}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/b9b4ad7a16e14936bcf46acdb475b08d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate services":{"meta":{"name":"enumerate services","namespace":"host-interaction/service/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Service Discovery"],"tactic":"Discovery","technique":"System Service Discovery","subtechnique":"","id":"T1007"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x1000B823"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate services\r\n    namespace: host-interaction/service/list\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Service Discovery [T1007]\r\n    examples:\r\n      - Practical Malware Analysis Lab 05-01.dll_:0x1000B823\r\n  features:\r\n    - or:\r\n      - api: advapi32.EnumServicesStatus\r\n      - api: advapi32.EnumServicesStatusEx\r\n      - api: advapi32.EnumDependentServices\r\n","matches":[[{"type":"absolute","value":4301940},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatusEx"}},"children":[],"locations":[{"type":"absolute","value":4423523},{"type":"absolute","value":4423357}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumDependentServices"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send ICMP echo request":{"meta":{"name":"send ICMP echo request","namespace":"communication/icmp","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","ICMP Communication","Echo Request"],"objective":"Communication","behavior":"ICMP Communication","method":"Echo Request","id":"C0014.002"}],"references":["https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/"],"examples":["al-khaser_x86.exe_:0x449510"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: send ICMP echo request\r\n    namespace: communication/icmp\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Communication::ICMP Communication::Echo Request [C0014.002]\r\n    references:\r\n      - https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/\r\n    examples:\r\n      - al-khaser_x86.exe_:0x449510\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: IcmpSendEcho\r\n        - api: IcmpSendEcho2\r\n        - api: IcmpSendEcho2Ex\r\n        - api: Icmp6SendEcho2\r\n      - optional:\r\n        - or:\r\n          - api: IcmpCreateFile\r\n          - api: Icmp6CreateFile\r\n        - api: IcmpCloseHandle\r\n","matches":[[{"type":"absolute","value":4301960},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho"}},"children":[],"locations":[{"type":"absolute","value":4494933}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2Ex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6SendEcho2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCreateFile"}},"children":[],"locations":[{"type":"absolute","value":4494752}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6CreateFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4494952},{"type":"absolute","value":4494870}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processors":{"meta":{"name":"get number of processors","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361"],"examples":["al-khaser_x86.exe_:0x432CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get number of processors\r\n    namespace: host-interaction/hardware/cpu\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires property features\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361\r\n    examples:\r\n      - al-khaser_x86.exe_:0x432CB0\r\n  features:\r\n    - or:\r\n      - and:\r\n        - match: PEB access\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - number: 0x64 = PEB->NumberOfProcessors\r\n          - and:\r\n            - arch: amd64\r\n            - number: 0xB8 = PEB->NumberOfProcessors\r\n      - property/read: System.Environment::ProcessorCount\r\n","matches":[[{"type":"absolute","value":4302100},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::ProcessorCount"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402352}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":100,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[{"type":"absolute","value":4402398}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":184,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"connect to WMI namespace via WbemLocator":{"meta":{"name":"connect to WMI namespace via WbemLocator","namespace":"host-interaction/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Windows Management Instrumentation"],"tactic":"Execution","technique":"Windows Management Instrumentation","subtechnique":"","id":"T1047"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x14001956e","al-khaser_x86.exe_:0x00445270"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\r\nrule:\r\n  meta:\r\n    name: connect to WMI namespace via WbemLocator\r\n    namespace: host-interaction/wmi\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires offset, bytes features\r\n    att&ck:\r\n      - Execution::Windows Management Instrumentation [T1047]\r\n    examples:\r\n      - al-khaser_x64.exe_:0x14001956e\r\n      - al-khaser_x86.exe_:0x00445270\r\n  features:\r\n    - and:\r\n      - basic block:\r\n        - and:\r\n          - api: ole32.CoCreateInstance\r\n          - com/class: WbemLocator  # 11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24 = CLSID_WbemLocator\r\n          - com/interface: IWbemLocator  # 87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24 = IID_IWbemLocator\r\n      - or:\r\n        - and:\r\n          - arch: i386\r\n          - offset: 0xC = ppv->ConnectServer\r\n        - and:\r\n          - arch: amd64\r\n          - offset: 0x18 = ppv->ConnectServer\r\n      - optional:\r\n        - string: /ROOT\\\\CIMV2/i\r\n        - string: /ROOT\\\\DEFAULT/i\r\n","matches":[[{"type":"absolute","value":4302170},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CoCreateInstance"}},"children":[],"locations":[{"type":"absolute","value":4477746}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"4590f811-1d3a-11d0-891f-00aa004b2e24","description":"CLSID_WbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"11f890453a1dd011891f00aa004b2e24","description":"CLSID_WbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":4477741}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"dc12a687-737f-11cf-884d-00aa004b2e24","description":"IID_IWbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"87a612dc7f73cf11884d00aa004b2e24","description":"IID_IWbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":4477732}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4477717}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"ppv->ConnectServer"}},"children":[],"locations":[{"type":"absolute","value":4477873}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"ppv->ConnectServer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\CIMV2/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\DEFAULT/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if file exists":{"meta":{"name":"check if file exists","namespace":"host-interaction/file-system/exists","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["31600AD0D1A7EA615690DF111AE36C73:0x401284"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check if file exists\r\n    namespace: host-interaction/file-system/exists\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::File and Directory Discovery [T1083]\r\n    mbc:\r\n      - Discovery::File and Directory Discovery [E1083]\r\n    examples:\r\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\r\n  features:\r\n    - or:\r\n      - basic block:\r\n        - and:\r\n          - api: kernel32.GetFileAttributes\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\r\n      - basic block:\r\n        - and:\r\n          - api: kernel32.GetLastError\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 2 = ERROR_FILE_NOT_FOUND\r\n      - api: shlwapi.PathFileExists\r\n      - api: System.IO.File::Exists\r\n      - property/read: System.IO.FileSystemInfo::Exists\r\n","matches":[[{"type":"absolute","value":4302300},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491582}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4491598}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":4491598}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491598}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/a039fdffa08040fabf99312614f547a5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304300},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491742}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4491758}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":4491758}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491758}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/a039fdffa08040fabf99312614f547a5"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if process is running under wine":{"meta":{"name":"check if process is running under wine","namespace":"anti-analysis/anti-emulation/wine","authors":["@_re_fox"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Emulator Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Emulator Detection","method":"","id":"B0004"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp"],"examples":["ccbf7cba35bab56563c0fbe4237fdc41:0x40d750"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check if process is running under wine\r\n    namespace: anti-analysis/anti-emulation/wine\r\n    authors:\r\n      - \"@_re_fox\"\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Emulator Detection [B0004]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp\r\n    examples:\r\n      - ccbf7cba35bab56563c0fbe4237fdc41:0x40d750\r\n  features:\r\n    - or:\r\n      - string: /SOFTWARE\\\\Wine/i\r\n      - and:\r\n        - api: GetModuleHandle\r\n        - api: GetProcAddress\r\n        - string: \"wine_get_unix_file_name\"\r\n        - or:\r\n          - string: \"kernel32.dll\"\r\n          - string: \"ntdll.dll\"\r\n","matches":[[{"type":"absolute","value":4302465},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4442047}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4442097}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[{"type":"absolute","value":4442088}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[{"type":"absolute","value":4442042}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[{"type":"absolute","value":4442242}],"captures":{"SOFTWARE\\Wine":[{"type":"absolute","value":4442242}]}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get OS version":{"meta":{"name":"get OS version","authors":["@mr-tz"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000","5f66b82558ca92e54e77f216ef4c066c:0x44580A"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get OS version\r\n    authors:\r\n      - \"@mr-tz\"\r\n    lib: true\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    examples:\r\n      - 493167E85E45363D09495D0841C30648:0x401000\r\n      - 5f66b82558ca92e54e77f216ef4c066c:0x44580A\r\n  features:\r\n    - or:\r\n      - api: RtlGetVersion\r\n      - api: ntoskrnl.PsGetVersion\r\n      - api: GetVersion\r\n      - api: GetVersionEx\r\n      - api: VerifyVersionInfo\r\n      - api: VerSetConditionMask\r\n      - api: RtlGetNtVersionNumbers\r\n      - api: GetProductInfo\r\n      - and:\r\n        - match: PEB access\r\n        - or:\r\n          - and:\r\n            - arch: i386\r\n            - or:\r\n              - offset: 0xA4 = PEB->OSMajorVersion\r\n              - offset: 0xA8 = PEB->OSMinorVersion\r\n              - offset: 0xAC = PEB->OSBuildNumber\r\n          - and:\r\n            - arch: amd64\r\n            - or:\r\n              - offset: 0x118 = PEB->OSMajorVersion\r\n              - offset: 0x11C = PEB->OSMinorVersion\r\n              - offset: 0x120 = PEB->OSBuildNumber\r\n","matches":[[{"type":"absolute","value":4302785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":4333224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":4333146},{"type":"absolute","value":4333131}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":4331869}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":4331776},{"type":"absolute","value":4331761},{"type":"absolute","value":4331791}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get MAC address on Windows":{"meta":{"name":"get MAC address on Windows","namespace":"collection/network","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","echernofsky@google.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128","https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific"],"examples":["al-khaser_x64.exe_:0x14001A1BC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get MAC address on Windows\r\n    namespace: collection/network\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - echernofsky@google.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128\r\n      - https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific\r\n    examples:\r\n      - al-khaser_x64.exe_:0x14001A1BC\r\n  features:\r\n    - and:\r\n      - os: windows\r\n      - or:\r\n        - and:\r\n          - api: iphlpapi.GetAdaptersInfo\r\n          - or:\r\n            - offset: 0x194 = IP_ADAPTER_INFO.Address\r\n            - offset: 0x195 = IP_ADAPTER_INFO.Address+1\r\n            - offset: 0x196 = IP_ADAPTER_INFO.Address+2\r\n            - offset: 0x197 = IP_ADAPTER_INFO.Address+3\r\n            - offset: 0x198 = IP_ADAPTER_INFO.Address+4\r\n            - offset: 0x199 = IP_ADAPTER_INFO.Address+5\r\n          - optional:\r\n            - string: \"%02X-%02X-%02X-%02X-%02X-%02X\"\r\n        - and:\r\n          - api: iphlpapi.GetAdaptersAddresses\r\n          - offset: 0x2C = PhysicalAddress\r\n","matches":[[{"type":"absolute","value":4302830},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersInfo"}},"children":[],"locations":[{"type":"absolute","value":4488428},{"type":"absolute","value":4488286}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":404,"description":"IP_ADAPTER_INFO.Address"}},"children":[],"locations":[{"type":"absolute","value":4488521}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":405,"description":"IP_ADAPTER_INFO.Address+1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":406,"description":"IP_ADAPTER_INFO.Address+2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":407,"description":"IP_ADAPTER_INFO.Address+3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":408,"description":"IP_ADAPTER_INFO.Address+4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":409,"description":"IP_ADAPTER_INFO.Address+5"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"%02X-%02X-%02X-%02X-%02X-%02X"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersAddresses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":44,"description":"PhysicalAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for time delay via GetTickCount":{"meta":{"name":"check for time delay via GetTickCount","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Timing/Delay Check GetTickCount"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Timing/Delay Check GetTickCount","id":"B0001.032"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x4013d0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for time delay via GetTickCount\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-03.exe_:0x4013d0\r\n  features:\r\n    - and:\r\n      - count(api(kernel32.GetTickCount)): 2 or more\r\n      - basic block:\r\n        - and:\r\n          - mnemonic: sub\r\n          - mnemonic: cmp\r\n","matches":[[{"type":"absolute","value":4302875},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"sub"}},"children":[],"locations":[{"type":"absolute","value":4402483},{"type":"absolute","value":4402606},{"type":"absolute","value":4402615}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4402593},{"type":"absolute","value":4402578},{"type":"absolute","value":4402556},{"type":"absolute","value":4402620}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402480}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetTickCount"}}},"children":[],"locations":[{"type":"absolute","value":4402587},{"type":"absolute","value":4402550}],"captures":{}}],"locations":[],"captures":{}}]]},"inject dll":{"meta":{"name":"inject dll","namespace":"host-interaction/process/inject","authors":["0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Dynamic-link Library Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Dynamic-link Library Injection","id":"T1055.001"}],"mbc":[],"references":["Practical Malware Analysis, p. 676","https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis","https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf","https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf","https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/","https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf","https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: inject dll\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - 0x534a@mailbox.org\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001]\r\n    references:\r\n      - Practical Malware Analysis, p. 676\r\n      - https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis\r\n      - https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf\r\n      - https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf\r\n      - https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/\r\n      - https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf\r\n      - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - or:\r\n          - match: open process\r\n          - match: host-interaction/process/create\r\n      - match: allocate or change RW memory\r\n      - match: write process memory\r\n      - and:\r\n        - or:\r\n          - api: kernel32.GetModuleHandle\r\n          - api: kernel32.GetModuleHandleEx\r\n        - string: \"/LoadLibrary[AW]/\"\r\n      - match: create thread\r\n","matches":[[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4443606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4443714}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4302995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":4443770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443748}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4443322}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443309}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4443374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LoadLibrary[AW]/"}},"children":[],"locations":[{"type":"absolute","value":4443434}],"captures":{"LoadLibraryW":[{"type":"absolute","value":4443434}]}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject thread":{"meta":{"name":"inject thread","namespace":"host-interaction/process/inject","authors":["anamaria.martinezgom@mandiant.com","0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Thread Execution Hijacking"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Thread Execution Hijacking","id":"T1055.003"},{"parts":["Defense Evasion","Reflective Code Loading"],"tactic":"Defense Evasion","technique":"Reflective Code Loading","subtechnique":"","id":"T1620"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-01.exe_:0x4010D0","2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: inject thread\r\n    namespace: host-interaction/process/inject\r\n    authors:\r\n      - anamaria.martinezgom@mandiant.com\r\n      - 0x534a@mailbox.org\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003]\r\n      - Defense Evasion::Reflective Code Loading [T1620]\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-01.exe_:0x4010D0\r\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\r\n  features:\r\n    - and:\r\n      - or:\r\n        - match: allocate or change RWX memory\r\n        - match: allocate or change RW memory\r\n      - match: write process memory\r\n      - match: create thread\r\n      - optional:\r\n        - or:\r\n          - match: host-interaction/process/create\r\n          - match: open process\r\n          - number: 0x3000 = MEM_COMMIT or MEM_RESERVE\r\n","matches":[[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4443714}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4302995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":4443770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443748}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4443606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/ba49ad9b268c4b23bcc4fb6c4be58dec"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4443322}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443309}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12288,"description":"MEM_COMMIT or MEM_RESERVE"}},"children":[],"locations":[{"type":"absolute","value":4443608}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get memory capacity":{"meta":{"name":"get memory capacity","namespace":"host-interaction/hardware/memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get memory capacity\r\n    namespace: host-interaction/hardware/memory\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\r\n  features:\r\n    - or:\r\n      - api: kernel32.GlobalMemoryStatus\r\n      - api: kernel32.GlobalMemoryStatusEx\r\n        # TODO kernel32.GetSystemInfo with offset\r\n","matches":[[{"type":"absolute","value":4303055},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatusEx"}},"children":[],"locations":[{"type":"absolute","value":4412669}],"captures":{}}],"locations":[],"captures":{}}]]},"check for software breakpoints":{"meta":{"name":"check for software breakpoints","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Software Breakpoints"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Software Breakpoints","id":"B0001.025"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp","https://anti-debug.checkpoint.com/techniques/assembly.html"],"examples":["al-khaser_x86.exe_:0x431020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for software breakpoints\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp\r\n      - https://anti-debug.checkpoint.com/techniques/assembly.html\r\n    examples:\r\n      - al-khaser_x86.exe_:0x431020\r\n  features:\r\n    - and:\r\n      - or:\r\n        - instruction:\r\n          - mnemonic: cmp\r\n          - number: 0xCC = INT3\r\n        - and:\r\n          - description: INT3 (long form)\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0xCD = INT3 (long form byte 1)\r\n          - instruction:\r\n            - mnemonic: cmp\r\n            - number: 0x03 = INT3 (long form byte 2)\r\n      - match: contain loop\r\n","matches":[[{"type":"absolute","value":4303320},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4303320}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4395135}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":204,"description":"INT3"}},"children":[],"locations":[{"type":"absolute","value":4395135}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4395135}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"INT3 (long form)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/6ad668bfa45a4a4cab8bb6ca25b4f893"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/2abefe1474b74891a1c248a9969463cb"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set console window title":{"meta":{"name":"set console window title","namespace":"host-interaction/gui/console","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Console"],"objective":"Operating System","behavior":"Console","method":"","id":"C0033"}],"references":[],"examples":["mimikatz.exe_:0x44570F"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set console window title\r\n    namespace: host-interaction/gui/console\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Operating System::Console [C0033]\r\n    examples:\r\n      - mimikatz.exe_:0x44570F\r\n  features:\r\n    - or:\r\n      - api: kernel32.SetConsoleTitle\r\n","matches":[[{"type":"absolute","value":4303335},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetConsoleTitle"}},"children":[],"locations":[{"type":"absolute","value":4464383}],"captures":{}}],"locations":[],"captures":{}}]]},"check for hardware breakpoints":{"meta":{"name":"check for hardware breakpoints","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Hardware Breakpoints"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Hardware Breakpoints","id":"B0001.005"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/HardwareBreakpoints.cpp"],"examples":["al-khaser_x86.exe_:0x42035D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for hardware breakpoints\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires offset, mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints [B0001.005]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/HardwareBreakpoints.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x42035D\r\n  features:\r\n    - and:\r\n      - api: kernel32.GetThreadContext\r\n      - number: 0x10010 = CONTEXT_DEBUG_REGISTERS\r\n      - offset: 0x4 = DR0\r\n      - offset: 0x8 = DR1\r\n      - offset: 0xC = DR2\r\n      - offset: 0x10 = DR3\r\n      - count(mnemonic(cmp)): 4 or more\r\n","matches":[[{"type":"absolute","value":4303415},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetThreadContext"}},"children":[],"locations":[{"type":"absolute","value":4326265}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":65552,"description":"CONTEXT_DEBUG_REGISTERS"}},"children":[],"locations":[{"type":"absolute","value":4326237}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":4,"description":"DR0"}},"children":[],"locations":[{"type":"absolute","value":4326285}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":8,"description":"DR1"}},"children":[],"locations":[{"type":"absolute","value":4326294}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"DR2"}},"children":[],"locations":[{"type":"absolute","value":4326303}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"DR3"}},"children":[],"locations":[{"type":"absolute","value":4326312}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"cmp"}}},"children":[],"locations":[{"type":"absolute","value":4326312},{"type":"absolute","value":4326344},{"type":"absolute","value":4326285},{"type":"absolute","value":4326257},{"type":"absolute","value":4326197},{"type":"absolute","value":4326294},{"type":"absolute","value":4326271},{"type":"absolute","value":4326303},{"type":"absolute","value":4326363},{"type":"absolute","value":4326207}],"captures":{}}],"locations":[],"captures":{}}]]},"check for kernel debugger via shared user data structure":{"meta":{"name":"check for kernel debugger via shared user data structure","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SharedUserData_KernelDebugger.cpp","http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data.htm"],"examples":["al-khaser_x86.exe_:0x430E60"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for kernel debugger via shared user data structure\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SharedUserData_KernelDebugger.cpp\r\n      - http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data.htm\r\n    examples:\r\n      - al-khaser_x86.exe_:0x430E60\r\n  features:\r\n    - and:\r\n      - number: 0x7FFE02D4 = UserSharedData->KdDebuggerEnabled\r\n      - instruction:\r\n        - mnemonic: and\r\n        - number: 0x2 = KdDebuggerNotPresent\r\n      - instruction:\r\n        - mnemonic: and\r\n        - number: 0x1 = KdDebuggerEnabled\r\n","matches":[[{"type":"absolute","value":4303540},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147353300,"description":"UserSharedData->KdDebuggerEnabled"}},"children":[],"locations":[{"type":"absolute","value":4394639}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":4394685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"KdDebuggerNotPresent"}},"children":[],"locations":[{"type":"absolute","value":4394685}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4394685}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":4394651}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"KdDebuggerEnabled"}},"children":[],"locations":[{"type":"absolute","value":4394651}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4394651}],"captures":{}}],"locations":[],"captures":{}}]]},"get disk size":{"meta":{"name":"get disk size","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347"],"examples":["al-khaser_x86.exe_:0x4343D0","al-khaser_x86.exe_:0x434010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get disk size\r\n    namespace: host-interaction/hardware/storage\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    mbc:\r\n      - Discovery::System Information Discovery [E1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347\r\n    examples:\r\n      - al-khaser_x86.exe_:0x4343D0\r\n      - al-khaser_x86.exe_:0x434010\r\n  features:\r\n    - or:\r\n      - api: kernel32.GetDiskFreeSpace\r\n      - api: kernel32.GetDiskFreeSpaceEx\r\n      - property/read: System.IO.DriveInfo::TotalSize\r\n      - property/read: System.IO.DriveInfo::TotalFreeSpace\r\n      - property/read: System.IO.DriveInfo::AvailableFreeSpace\r\n      - basic block:\r\n        - and:\r\n          - match: interact with driver via IOCTL\r\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\r\n      - call:\r\n        - and:\r\n          - match: interact with driver via IOCTL\r\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\r\n      - and:\r\n        - or:\r\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i\r\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i\r\n        - string: \"Size\"\r\n","matches":[[{"type":"absolute","value":4304105},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4409203}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4409176}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":4409194}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4408982}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4408955}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":4408973}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4409176},{"type":"absolute","value":4408955}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/caf381278ac947948b25a47c8c0e29a2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304805},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[{"type":"absolute","value":4407116}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/382eca0b8cf844eaa82f18e35725ccad"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/caf381278ac947948b25a47c8c0e29a2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate disk properties":{"meta":{"name":"enumerate disk properties","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518"],"examples":["al-khaser_x86.exe_:0x4369B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: enumerate disk properties\r\n    namespace: host-interaction/hardware/storage\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires bytes features\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518\r\n    examples:\r\n      - al-khaser_x86.exe_:0x4369B0\r\n  features:\r\n    - and:\r\n      - basic block:\r\n        - and:\r\n          - api: setupapi.SetupDiGetClassDevs\r\n          - bytes: 67 E9 36 4D 25 E3 CE 11 BF C1 08 00 2B E1 03 18 = GUID_DEVCLASS_DISKDRIVE\r\n      - api: setupapi.SetupDiEnumDeviceInfo\r\n      - api: setupapi.SetupDiGetDeviceRegistryProperty\r\n      - optional:\r\n        - api: setupapi.SetupDiDestroyDeviceInfoList\r\n","matches":[[{"type":"absolute","value":4304225},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetClassDevs"}},"children":[],"locations":[{"type":"absolute","value":4418038}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e9364d25e3ce11bfc108002be10318","description":"GUID_DEVCLASS_DISKDRIVE"}},"children":[],"locations":[{"type":"absolute","value":4418033}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4417968}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiEnumDeviceInfo"}},"children":[],"locations":[{"type":"absolute","value":4418120}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetDeviceRegistryProperty"}},"children":[],"locations":[{"type":"absolute","value":4418169}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiDestroyDeviceInfoList"}},"children":[],"locations":[{"type":"absolute","value":4418437}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB NtGlobalFlag flag":{"meta":{"name":"check for PEB NtGlobalFlag flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block NtGlobalFlag"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block NtGlobalFlag","id":"B0001.036"}],"references":["Practical Malware Analysis, Chapter 16, p. 355","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for PEB NtGlobalFlag flag\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: unsupported  # requires offset, mnemonic features\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]\r\n    references:\r\n      - Practical Malware Analysis, Chapter 16, p. 355\r\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\r\n  features:\r\n    - and:\r\n      - basic block:\r\n        - and:\r\n          - match: PEB access\r\n          - or:\r\n            - and:\r\n              - arch: i386\r\n              - offset: 0x68 = PEB.NtGlobalFlag\r\n            - and:\r\n              - arch: amd64\r\n              - offset: 0xBC = PEB.NtGlobalFlag\r\n            - instruction:\r\n              - arch: i386\r\n              - mnemonic: add\r\n              - offset: 0x68 = PEB.NtGlobalFlag\r\n            - instruction:\r\n              - arch: amd64\r\n              - mnemonic: add\r\n              - offset: 0xBC = PEB.NtGlobalFlag\r\n      - number: 0x70 = (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)\r\n","matches":[[{"type":"absolute","value":4304340},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/fca5b275943840729617702ee26edcbc"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4328802}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/b2fc0e71f7cb45c891fdd0a2416f468e"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/721401aaee98487fbe98d5269bbe5362"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328736}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":104,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":4328811}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":188,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":4328811}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":104,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":4328811}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328811}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for PEB NtGlobalFlag flag/b837da6a639b481c9721ac21a5fe6ba1/d56844a0b0ce4e1bb76d09e472ddecdb"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328736}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"(FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)"}},"children":[],"locations":[{"type":"absolute","value":4328924},{"type":"absolute","value":4328877}],"captures":{}}],"locations":[],"captures":{}}]]},"modify access privileges":{"meta":{"name":"modify access privileges","namespace":"host-interaction/process/modify","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403BE0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: modify access privileges\r\n    namespace: host-interaction/process/modify\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Privilege Escalation::Access Token Manipulation [T1134]\r\n    examples:\r\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403BE0\r\n  features:\r\n    - and:\r\n      - api: advapi32.AdjustTokenPrivileges\r\n      - optional:\r\n        - or:\r\n          - api: advapi32.LookupPrivilegeValue\r\n","matches":[[{"type":"absolute","value":4304465},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"AdjustTokenPrivileges"}},"children":[],"locations":[{"type":"absolute","value":4479948}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LookupPrivilegeValue"}},"children":[],"locations":[{"type":"absolute","value":4479913}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4480208},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"AdjustTokenPrivileges"}},"children":[],"locations":[{"type":"absolute","value":4480368},{"type":"absolute","value":4480530}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LookupPrivilegeValue"}},"children":[],"locations":[{"type":"absolute","value":4480277}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"find graphical window":{"meta":{"name":"find graphical window","namespace":"host-interaction/gui/window/find","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","Application Window Discovery"],"tactic":"Discovery","technique":"Application Window Discovery","subtechnique":"","id":"T1010"}],"mbc":[],"references":[],"examples":["7C843E75D4F02087B932FE280DF9C90C:0x41B180"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: find graphical window\r\n    namespace: host-interaction/gui/window/find\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Discovery::Application Window Discovery [T1010]\r\n    examples:\r\n      - 7C843E75D4F02087B932FE280DF9C90C:0x41B180\r\n  features:\r\n    - or:\r\n      - api: user32.FindWindow\r\n      - api: user32.FindWindowEx\r\n","matches":[[{"type":"absolute","value":4304550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"FindWindow"}},"children":[],"locations":[{"type":"absolute","value":4436129},{"type":"absolute","value":4436154}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"FindWindowEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processor cores":{"meta":{"name":"get number of processor cores","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207"],"examples":["al-khaser_x86.exe_:0x435BA0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: get number of processor cores\r\n    namespace: host-interaction/hardware/cpu\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::System Information Discovery [T1082]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207\r\n    examples:\r\n      - al-khaser_x86.exe_:0x435BA0\r\n  features:\r\n    - and:\r\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/\r\n      - string: \"NumberOfCores\"\r\n","matches":[[{"type":"absolute","value":4304635},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"NumberOfCores"}},"children":[],"locations":[{"type":"absolute","value":4414607}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/"}},"children":[],"locations":[{"type":"absolute","value":4414487}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":4414487}]}}],"locations":[],"captures":{}}]]},"create mutex":{"meta":{"name":"create mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Mutex"],"objective":"Process","behavior":"Create Mutex","method":"","id":"C0042"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: create mutex\r\n    namespace: host-interaction/mutex\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    mbc:\r\n      - Process::Create Mutex [C0042]\r\n    examples:\r\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\r\n  features:\r\n    - or:\r\n      - api: kernel32.CreateMutex\r\n      - api: kernel32.CreateMutexEx\r\n      - api: System.Threading.Mutex::ctor\r\n","matches":[[{"type":"absolute","value":4304785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutex"}},"children":[],"locations":[{"type":"absolute","value":4394365}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutexEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for protected handle exception":{"meta":{"name":"check for protected handle exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","SetHandleInformation"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"SetHandleInformation","id":"B0001.024"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp"],"examples":["al-khaser_x86.exe_:0x430D20"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: check for protected handle exception\r\n    namespace: anti-analysis/anti-debugging/debugger-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_:0x430D20\r\n  features:\r\n    - and:\r\n      - or:\r\n        - description: SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);\r\n        - basic block:\r\n          - and:\r\n            - count(number(2)): 2 or more\r\n            - api: SetHandleInformation\r\n        - call:\r\n          - and:\r\n            - count(number(2)): 2 or more\r\n            - api: SetHandleInformation\r\n      - api: CloseHandle\r\n","matches":[[{"type":"absolute","value":4304785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4394423}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetHandleInformation"}},"children":[],"locations":[{"type":"absolute","value":4394397}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"number","number":2}}},"children":[],"locations":[{"type":"absolute","value":4394389},{"type":"absolute","value":4394391}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4394387}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for protected handle exception/14e241b95d104a0fbfa0db5d508b8e69"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: query or enumerate registry value\r\n    namespace: host-interaction/registry\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n      - michael.hunhoff@mandiant.com\r\n      - anushka.virgaonkar@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    att&ck:\r\n      - Discovery::Query Registry [T1012]\r\n    mbc:\r\n      - Operating System::Registry::Query Registry Value [C0036.006]\r\n    examples:\r\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\r\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\r\n  features:\r\n    - and:\r\n      - optional:\r\n        - match: create or open registry key\r\n      - or:\r\n        - api: advapi32.RegGetValue\r\n        - api: advapi32.RegEnumValue\r\n        - api: advapi32.RegQueryValue\r\n        - api: advapi32.RegQueryValueEx\r\n        - api: advapi32.RegQueryMultipleValues\r\n        - api: ZwQueryValueKey\r\n        - api: ZwEnumerateValueKey\r\n        - api: NtQueryValueKey\r\n        - api: NtEnumerateValueKey\r\n        - api: RtlQueryRegistryValues\r\n        - api: SHGetValue\r\n        - api: SHEnumValue\r\n        - api: SHRegGetInt\r\n        - api: SHRegGetPath\r\n        - api: SHRegGetValue\r\n        - api: SHQueryValueEx\r\n        - api: SHRegGetUSValue\r\n        - api: SHOpenRegStream\r\n        - api: SHRegEnumUSValue\r\n        - api: SHOpenRegStream2\r\n        - api: SHRegQueryUSValue\r\n        - api: SHRegGetBoolUSValue\r\n        - api: SHRegGetValueFromHKCUHKLM\r\n        - api: SHRegGetBoolValueFromHKCUHKLM\r\n        - api: Microsoft.Win32.RegistryKey::GetValue\r\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\r\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\r\n        - api: Microsoft.Win32.Registry::GetValue\r\n","matches":[[{"type":"absolute","value":4305120},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":4479374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4479264}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":4479419}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set application hook":{"meta":{"name":"set application hook","namespace":"host-interaction/gui","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: set application hook\r\n    namespace: host-interaction/gui\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: thread\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\r\n  features:\r\n    - and:\r\n      - or:\r\n        - api: user32.SetWindowsHookEx\r\n        - api: user32.UnhookWindowsHookEx\r\n","matches":[[{"type":"absolute","value":4305765},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":4451860}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"log keystrokes via application hook":{"meta":{"name":"log keystrokes via application hook","namespace":"collection/keylog","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Collection","Input Capture","Keylogging"],"tactic":"Collection","technique":"Input Capture","subtechnique":"Keylogging","id":"T1056.001"}],"mbc":[{"parts":["Collection","Keylogging","Application Hook"],"objective":"Collection","behavior":"Keylogging","method":"Application Hook","id":"F0002.001"}],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: log keystrokes via application hook\r\n    namespace: collection/keylog\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: function\r\n      dynamic: call\r\n    att&ck:\r\n      - Collection::Input Capture::Keylogging [T1056.001]\r\n    mbc:\r\n      - Collection::Keylogging::Application Hook [F0002.001]\r\n    examples:\r\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\r\n  features:\r\n    - and:\r\n      - match: set application hook\r\n      - or:\r\n        - number: 13 = WH_KEYBOARD_LL\r\n        - number: 2  = WH_KEYBOARD\r\n","matches":[[{"type":"absolute","value":4305765},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"set application hook"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":4451860}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4305765}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"WH_KEYBOARD_LL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"WH_KEYBOARD"}},"children":[],"locations":[{"type":"absolute","value":4451858}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contain a thread local storage (.tls) section":{"meta":{"name":"contain a thread local storage (.tls) section","namespace":"executable/pe/section/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contain a thread local storage (.tls) section\r\n    namespace: executable/pe/section/tls\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    examples:\r\n      - Practical Malware Analysis Lab 16-02.exe_\r\n  features:\r\n    - section: .tls\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"section","section":".tls"}},"children":[],"locations":[{"type":"absolute","value":4743168}],"captures":{}}]]},"read raw disk data":{"meta":{"name":"read raw disk data","namespace":"host-interaction/file-system","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: read raw disk data\r\n    namespace: host-interaction/file-system\r\n    authors:\r\n      - william.ballenthin@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n  features:\r\n    - or:\r\n      - string: \"\\\\\\\\.\\\\PhysicalDrive0\"\r\n      - string: \"\\\\\\\\.\\\\C:\"\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\PhysicalDrive0"}},"children":[],"locations":[{"type":"file","value":261844}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\C:"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference analysis tools strings\r\n    namespace: anti-analysis\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    mbc:\r\n      - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /ollydbg(\\.exe)?/i\r\n      - string: /ProcessHacker(\\.exe)?/i\r\n      - string: /tcpview(\\.exe)?/i\r\n      - string: /autoruns(\\.exe)?/i\r\n      - string: /autorunsc(\\.exe)?/i\r\n      - string: /filemon(\\.exe)?/i\r\n      - string: /procmon(\\.exe)?/i\r\n      - string: /regmon(\\.exe)?/i\r\n      - string: /procexp(\\.exe)?/i\r\n      - string: /(?<!\\w)ida[gqtuw]?(\\.exe)?$/i\r\n      - string: /ida[gqtuw]?64(\\.exe)?$/i\r\n      - string: /ImmunityDebugger(\\.exe)?/i\r\n      - string: /Wireshark(\\.exe)?/i\r\n      - string: /dumpcap(\\.exe)?/i\r\n      - string: /HookExplorer(\\.exe)?/i\r\n      - string: /ImportREC(\\.exe)?/i\r\n      - string: /PETools(\\.exe)?/i\r\n      - string: /LordPE(\\.exe)?/i\r\n      - string: /SysInspector(\\.exe)?/i\r\n      - string: /proc_analyzer(\\.exe)?/i\r\n      - string: /sysAnalyzer(\\.exe)?/i\r\n      - string: /sniff_hit(\\.exe)?/i\r\n      - string: /windbg(\\.exe)?/i\r\n      - string: /joeboxcontrol(\\.exe)?/i\r\n      - string: /joeboxserver(\\.exe)?/i\r\n      - string: /ResourceHacker(\\.exe)?/i\r\n      - string: /x32dbg(\\.exe)?/i\r\n      - string: /x64dbg(\\.exe)?/i\r\n      - string: /Fiddler(\\.exe)?/i\r\n      - string: /httpdebugger(\\.exe)?/i\r\n      - string: /fakenet(\\.exe)?/i\r\n      - string: /netmon(\\.exe)?/i\r\n      - string: /WPE PRO(\\.exe)?/i\r\n      - string: /decompile(\\.exe)?/i\r\n      - string: /scylla/i\r\n      - string: /megadumper/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253136}],"captures":{"ollydbg.exe":[{"type":"file","value":253136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253164}],"captures":{"ProcessHacker.exe":[{"type":"file","value":253164}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253208}],"captures":{"tcpview.exe":[{"type":"file","value":253208}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253236},{"type":"file","value":253268}],"captures":{"autoruns.exe":[{"type":"file","value":253236}],"autorunsc.exe":[{"type":"file","value":253268}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253268}],"captures":{"autorunsc.exe":[{"type":"file","value":253268}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253304}],"captures":{"filemon.exe":[{"type":"file","value":253304}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253332}],"captures":{"procmon.exe":[{"type":"file","value":253332}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253360}],"captures":{"regmon.exe":[{"type":"file","value":253360}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253388}],"captures":{"procexp.exe":[{"type":"file","value":253388}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/(?<!\\w)ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":253416}],"captures":{"idaq.exe":[{"type":"file","value":253416}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?64(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":253440}],"captures":{"idaq64.exe":[{"type":"file","value":253440}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253468}],"captures":{"ImmunityDebugger.exe":[{"type":"file","value":253468}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253520}],"captures":{"Wireshark.exe":[{"type":"file","value":253520}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253556}],"captures":{"dumpcap.exe":[{"type":"file","value":253556}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253584}],"captures":{"HookExplorer.exe":[{"type":"file","value":253584}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253624}],"captures":{"ImportREC.exe":[{"type":"file","value":253624}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253660}],"captures":{"PETools.exe":[{"type":"file","value":253660}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253688}],"captures":{"LordPE.exe":[{"type":"file","value":253688}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253716}],"captures":{"SysInspector.exe":[{"type":"file","value":253716}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253756}],"captures":{"proc_analyzer.exe":[{"type":"file","value":253756}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253800}],"captures":{"sysAnalyzer.exe":[{"type":"file","value":253800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253840}],"captures":{"sniff_hit.exe":[{"type":"file","value":253840}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253876}],"captures":{"windbg.exe":[{"type":"file","value":253876}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253904}],"captures":{"joeboxcontrol.exe":[{"type":"file","value":253904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253948}],"captures":{"joeboxserver.exe":[{"type":"file","value":253948}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253988}],"captures":{"ResourceHacker.exe":[{"type":"file","value":253988}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254036}],"captures":{"x32dbg.exe":[{"type":"file","value":254036}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254064}],"captures":{"x64dbg.exe":[{"type":"file","value":254064}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254092}],"captures":{"Fiddler.exe":[{"type":"file","value":254092}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254120}],"captures":{"httpdebugger.exe":[{"type":"file","value":254120}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"contains PDB path":{"meta":{"name":"contains PDB path","namespace":"executable/pe/pdb","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["464EF2CA59782CE697BC329713698CCC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: contains PDB path\r\n    namespace: executable/pe/pdb\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    examples:\r\n      - 464EF2CA59782CE697BC329713698CCC  # level32.exe\r\n  features:\r\n    - string: /:\\\\.*\\.pdb/\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/:\\\\.*\\.pdb/"}},"children":[],"locations":[{"type":"file","value":291092}],"captures":{"C:\\Users\\spring\\Desktop\\al-khaser-master\\Debug\\al-khaser.pdb":[{"type":"file","value":291092}]}}]]},"reference anti-VM strings targeting Parallels":{"meta":{"name":"reference anti-VM strings targeting Parallels","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting Parallels\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /Parallels/i\r\n      - string: /prl_cc.exe/i\r\n      - string: /prl_tools.exe/i\r\n      - string: /prl hyperv/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Parallels/i"}},"children":[],"locations":[{"type":"file","value":264328}],"captures":{"Checking Parallels processes: %s":[{"type":"file","value":264328}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_cc.exe/i"}},"children":[],"locations":[{"type":"file","value":264260}],"captures":{"prl_cc.exe":[{"type":"file","value":264260}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_tools.exe/i"}},"children":[],"locations":[{"type":"file","value":264288}],"captures":{"prl_tools.exe":[{"type":"file","value":264288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl hyperv/i"}},"children":[],"locations":[{"type":"file","value":262080}],"captures":{"prl hyperv  ":[{"type":"file","value":262080}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Qemu":{"meta":{"name":"reference anti-VM strings targeting Qemu","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting Qemu\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /Qemu/i\r\n      - string: /qemu-ga.exe/i\r\n      - string: /BOCHS/i\r\n      - string: /^BXPC/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Qemu/i"}},"children":[],"locations":[{"type":"file","value":264896},{"type":"file","value":261920},{"type":"file","value":264800},{"type":"file","value":262520},{"type":"file","value":250920},{"type":"file","value":264828},{"type":"file","value":264904}],"captures":{"qemu":[{"type":"file","value":264896},{"type":"file","value":261920}],"QEMU":[{"type":"file","value":264904},{"type":"file","value":262520}],"QEMU Detection":[{"type":"file","value":250920}],"qemu-ga.exe":[{"type":"file","value":264800}],"Checking qemu processes %s ":[{"type":"file","value":264828}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/qemu-ga.exe/i"}},"children":[],"locations":[{"type":"file","value":264800}],"captures":{"qemu-ga.exe":[{"type":"file","value":264800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/BOCHS/i"}},"children":[],"locations":[{"type":"file","value":264912}],"captures":{"BOCHS":[{"type":"file","value":264912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^BXPC/i"}},"children":[],"locations":[{"type":"file","value":264920}],"captures":{"BXPC":[{"type":"file","value":264920}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualBox":{"meta":{"name":"reference anti-VM strings targeting VirtualBox","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting VirtualBox\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /VBOX/i\r\n      - string: /VEN_VBOX/i\r\n      - string: /VirtualBox/i\r\n      - string: /06/23/99/i\r\n      - string: /HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i\r\n      - string: /HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i\r\n      - string: /HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i\r\n      - string: /SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i\r\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i\r\n      - string: /VBoxMouse\\.sys/i\r\n      - string: /VBoxGuest\\.sys/i\r\n      - string: /VBoxSF\\.sys/i\r\n      - string: /VBoxVideo\\.sys/i\r\n      - string: /vboxdisp\\.dll/i\r\n      - string: /vboxhook\\.dll/i\r\n      - string: /vboxmrxnp\\.dll/i\r\n      - string: /vboxogl\\.dll/i\r\n      - string: /vboxoglarrayspu\\.dll/i\r\n      - string: /vboxoglcrutil\\.dll/i\r\n      - string: /vboxoglerrorspu\\.dll/i\r\n      - string: /vboxoglfeedbackspu\\.dll/i\r\n      - string: /vboxoglpackspu\\.dll/i\r\n      - string: /vboxoglpassthroughspu\\.dll/i\r\n      - string: /vboxservice\\.exe/i\r\n      - string: /vboxtray\\.exe/i\r\n      - string: /VBoxControl\\.exe/i\r\n      - string: /oracle\\\\virtualbox guest additions\\\\/i\r\n      - string: /\\\\\\\\.\\\\VBoxMiniRdrDN/i\r\n      - string: /\\\\\\\\.\\\\VBoxGuest/i\r\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i\r\n      - string: /\\\\\\\\.\\\\VBoxTrayIPC/i\r\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i\r\n      - string: /VBoxTrayToolWndClass/i\r\n      - string: /VBoxTrayToolWnd/i\r\n      - string: /vboxservice\\.exe/i\r\n      - string: /vboxtray.exe/i\r\n      - string: /vboxvideo/i\r\n      - string: /VBoxVideoW8/i\r\n      - string: /VBoxWddm/i\r\n      - string: /PCI\\\\VEN_80EE&DEV_CAFE/i\r\n      - string: /82801FB/i\r\n      - string: /82441FX/i\r\n      - string: /82371SB/i\r\n      - string: /OpenHCD/i\r\n      - string: /ACPIBus_BUS_0/i\r\n      - string: /PCI_BUS_0/i\r\n      - string: /PNP_BUS_0/i\r\n      - string: /Oracle Corporation/i\r\n      - string: /VBoxWdd/i\r\n      - string: /VBoxS/i\r\n        description: VirtualBox Shared Folders\r\n      - string: /VBoxMouse/i\r\n        description: VirtualBox Guest Mouse\r\n      - string: /VBoxGuest/i\r\n        description: VirtualBox Guest Driver\r\n      - string: /VBoxVBoxVBox/i\r\n      - string: /innotek GmbH/i\r\n      - string: /drivers\\\\vboxdrv/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBOX/i"}},"children":[],"locations":[{"type":"file","value":250112},{"type":"file","value":265600},{"type":"file","value":265728},{"type":"file","value":261892},{"type":"file","value":266884},{"type":"file","value":264968},{"type":"file","value":265992},{"type":"file","value":266376},{"type":"file","value":268424},{"type":"file","value":267020},{"type":"file","value":266776},{"type":"file","value":267676},{"type":"file","value":264992},{"type":"file","value":266528},{"type":"file","value":267808},{"type":"file","value":268448},{"type":"file","value":267172},{"type":"file","value":265896},{"type":"file","value":266280},{"type":"file","value":267436},{"type":"file","value":267948},{"type":"file","value":266672},{"type":"file","value":249784},{"type":"file","value":267324},{"type":"file","value":249536},{"type":"file","value":265664},{"type":"file","value":267720},{"type":"file","value":267848},{"type":"file","value":268104},{"type":"file","value":266956},{"type":"file","value":266192},{"type":"file","value":266832},{"type":"file","value":266452},{"type":"file","value":249944},{"type":"file","value":267096},{"type":"file","value":265308},{"type":"file","value":268640},{"type":"file","value":262112},{"type":"file","value":264928},{"type":"file","value":268000},{"type":"file","value":266596},{"type":"file","value":266724},{"type":"file","value":269280},{"type":"file","value":268648},{"type":"file","value":266088},{"type":"file","value":267240},{"type":"file","value":267756},{"type":"file","value":268144},{"type":"file","value":128375},{"type":"file","value":264952},{"type":"file","value":267384}],"captures":{"szVBoxSources":[{"type":"file","value":128375}],"vbox":[{"type":"file","value":268640},{"type":"file","value":261892}],"VBOX":[{"type":"file","value":268648},{"type":"file","value":265308}],"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":249536}],"Checking Win32_PnPDevice DeviceId from WMI for VBox PCI device ":[{"type":"file","value":249784}],"Checking Win32_PnPDevice Name from WMI for VBox controller hardware ":[{"type":"file","value":249944}],"Checking Win32_PnPDevice Name from WMI for VBOX names ":[{"type":"file","value":250112}],"VBoxVBoxVBox":[{"type":"file","value":262112}],"VBoxWddm":[{"type":"file","value":264928}],"VBoxSF":[{"type":"file","value":264952}],"VBoxMouse":[{"type":"file","value":264968}],"VBoxGuest":[{"type":"file","value":264992}],"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":265600}],"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":265664}],"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":265728}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":265896}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":265992}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":266088}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":266192}],"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":266280}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":266376}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":266452}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":266528}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":266596}],"System32\\vboxdisp.dll":[{"type":"file","value":266672}],"System32\\vboxhook.dll":[{"type":"file","value":266724}],"System32\\vboxmrxnp.dll":[{"type":"file","value":266776}],"System32\\vboxogl.dll":[{"type":"file","value":266832}],"System32\\vboxoglarrayspu.dll":[{"type":"file","value":266884}],"System32\\vboxoglcrutil.dll":[{"type":"file","value":266956}],"System32\\vboxoglerrorspu.dll":[{"type":"file","value":267020}],"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":267096}],"System32\\vboxoglpackspu.dll":[{"type":"file","value":267172}],"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":267240}],"System32\\vboxservice.exe":[{"type":"file","value":267324}],"System32\\vboxtray.exe":[{"type":"file","value":267384}],"System32\\VBoxControl.exe":[{"type":"file","value":267436}],"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":267676}],"\\\\.\\VBoxGuest":[{"type":"file","value":267720}],"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":267756}],"\\\\.\\VBoxTrayIPC":[{"type":"file","value":267808}],"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":267848}],"VBoxTrayToolWndClass":[{"type":"file","value":267948}],"VBoxTrayToolWnd":[{"type":"file","value":268000}],"vboxservice.exe":[{"type":"file","value":268104}],"vboxtray.exe":[{"type":"file","value":268144}],"vboxvideo":[{"type":"file","value":268424}],"VBoxVideoW8":[{"type":"file","value":268448}],"VEN_VBOX":[{"type":"file","value":269280}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VEN_VBOX/i"}},"children":[],"locations":[{"type":"file","value":269280}],"captures":{"VEN_VBOX":[{"type":"file","value":269280}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualBox/i"}},"children":[],"locations":[{"type":"file","value":265792},{"type":"file","value":267544},{"type":"file","value":262404},{"type":"file","value":249224},{"type":"file","value":268040},{"type":"file","value":268624},{"type":"file","value":249168},{"type":"file","value":265360},{"type":"file","value":268176},{"type":"file","value":249656}],"captures":{"VirtualBox":[{"type":"file","value":268624},{"type":"file","value":262404}],"VirtualBox Detection":[{"type":"file","value":249168}],"Checking VirtualBox Guest Additions directory ":[{"type":"file","value":249224}],"Checking VirtualBox Shared Folders network provider ":[{"type":"file","value":249656}],"VIRTUALBOX":[{"type":"file","value":265360}],"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":265792}],"oracle\\virtualbox guest additions\\":[{"type":"file","value":267544}],"VirtualBox Shared Folders":[{"type":"file","value":268040}],"Checking VirtualBox process %s ":[{"type":"file","value":268176}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/06/23/99/i"}},"children":[],"locations":[{"type":"file","value":265424}],"captures":{"06/23/99":[{"type":"file","value":265424}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":265600}],"captures":{"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":265600}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":265664}],"captures":{"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":265664}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":265728}],"captures":{"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":265728}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i"}},"children":[],"locations":[{"type":"file","value":265792}],"captures":{"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":265792}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":265896}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":265896}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i"}},"children":[],"locations":[{"type":"file","value":265992}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":265992}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i"}},"children":[],"locations":[{"type":"file","value":266088}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":266088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i"}},"children":[],"locations":[{"type":"file","value":266192}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":266192}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i"}},"children":[],"locations":[{"type":"file","value":266280}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":266280}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266376}],"captures":{"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":266376}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266452}],"captures":{"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":266452}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxSF\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266528}],"captures":{"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":266528}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideo\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266596}],"captures":{"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":266596}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxdisp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266672}],"captures":{"System32\\vboxdisp.dll":[{"type":"file","value":266672}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxhook\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266724}],"captures":{"System32\\vboxhook.dll":[{"type":"file","value":266724}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxmrxnp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266776}],"captures":{"System32\\vboxmrxnp.dll":[{"type":"file","value":266776}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxogl\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266832}],"captures":{"System32\\vboxogl.dll":[{"type":"file","value":266832}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglarrayspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266884}],"captures":{"System32\\vboxoglarrayspu.dll":[{"type":"file","value":266884}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglcrutil\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266956}],"captures":{"System32\\vboxoglcrutil.dll":[{"type":"file","value":266956}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglerrorspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267020}],"captures":{"System32\\vboxoglerrorspu.dll":[{"type":"file","value":267020}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglfeedbackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267096}],"captures":{"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":267096}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267172}],"captures":{"System32\\vboxoglpackspu.dll":[{"type":"file","value":267172}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpassthroughspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267240}],"captures":{"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":267240}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":268104},{"type":"file","value":267324}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":267324}],"vboxservice.exe":[{"type":"file","value":268104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":267384},{"type":"file","value":268144}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":267384}],"vboxtray.exe":[{"type":"file","value":268144}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxControl\\.exe/i"}},"children":[],"locations":[{"type":"file","value":267436}],"captures":{"System32\\VBoxControl.exe":[{"type":"file","value":267436}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/oracle\\\\virtualbox guest additions\\\\/i"}},"children":[],"locations":[{"type":"file","value":267544}],"captures":{"oracle\\virtualbox guest additions\\":[{"type":"file","value":267544}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxMiniRdrDN/i"}},"children":[],"locations":[{"type":"file","value":267676}],"captures":{"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":267676}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":267720}],"captures":{"\\\\.\\VBoxGuest":[{"type":"file","value":267720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i"}},"children":[],"locations":[{"type":"file","value":267756}],"captures":{"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":267756}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":267808}],"captures":{"\\\\.\\VBoxTrayIPC":[{"type":"file","value":267808}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":267848}],"captures":{"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":267848}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWndClass/i"}},"children":[],"locations":[{"type":"file","value":249536},{"type":"file","value":267948}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":249536}],"VBoxTrayToolWndClass":[{"type":"file","value":267948}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWnd/i"}},"children":[],"locations":[{"type":"file","value":249536},{"type":"file","value":267948},{"type":"file","value":268000}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":249536}],"VBoxTrayToolWndClass":[{"type":"file","value":267948}],"VBoxTrayToolWnd":[{"type":"file","value":268000}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":268104},{"type":"file","value":267324}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":267324}],"vboxservice.exe":[{"type":"file","value":268104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray.exe/i"}},"children":[],"locations":[{"type":"file","value":267384},{"type":"file","value":268144}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":267384}],"vboxtray.exe":[{"type":"file","value":268144}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxvideo/i"}},"children":[],"locations":[{"type":"file","value":266280},{"type":"file","value":266596},{"type":"file","value":268424},{"type":"file","value":268448}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":266280}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":266596}],"vboxvideo":[{"type":"file","value":268424}],"VBoxVideoW8":[{"type":"file","value":268448}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideoW8/i"}},"children":[],"locations":[{"type":"file","value":268448}],"captures":{"VBoxVideoW8":[{"type":"file","value":268448}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWddm/i"}},"children":[],"locations":[{"type":"file","value":264928}],"captures":{"VBoxWddm":[{"type":"file","value":264928}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI\\\\VEN_80EE&DEV_CAFE/i"}},"children":[],"locations":[{"type":"file","value":268752}],"captures":{"PCI\\VEN_80EE&DEV_CAFE":[{"type":"file","value":268752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82801FB/i"}},"children":[],"locations":[{"type":"file","value":268816}],"captures":{"82801FB":[{"type":"file","value":268816}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82441FX/i"}},"children":[],"locations":[{"type":"file","value":268836}],"captures":{"82441FX":[{"type":"file","value":268836}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82371SB/i"}},"children":[],"locations":[{"type":"file","value":268856}],"captures":{"82371SB":[{"type":"file","value":268856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/OpenHCD/i"}},"children":[],"locations":[{"type":"file","value":268876}],"captures":{"OpenHCD":[{"type":"file","value":268876}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ACPIBus_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":268956}],"captures":{"ACPIBus_BUS_0":[{"type":"file","value":268956}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":268992}],"captures":{"PCI_BUS_0":[{"type":"file","value":268992}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PNP_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":269016}],"captures":{"PNP_BUS_0":[{"type":"file","value":269016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Oracle Corporation/i"}},"children":[],"locations":[{"type":"file","value":269132}],"captures":{"Oracle Corporation":[{"type":"file","value":269132}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWdd/i"}},"children":[],"locations":[{"type":"file","value":264928}],"captures":{"VBoxWddm":[{"type":"file","value":264928}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxS/i","description":"VirtualBox Shared Folders"}},"children":[],"locations":[{"type":"file","value":266192},{"type":"file","value":266528},{"type":"file","value":268104},{"type":"file","value":266088},{"type":"file","value":128375},{"type":"file","value":264952},{"type":"file","value":267324}],"captures":{"szVBoxSources":[{"type":"file","value":128375}],"VBoxSF":[{"type":"file","value":264952}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":266088}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":266192}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":266528}],"System32\\vboxservice.exe":[{"type":"file","value":267324}],"vboxservice.exe":[{"type":"file","value":268104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse/i","description":"VirtualBox Guest Mouse"}},"children":[],"locations":[{"type":"file","value":264968},{"type":"file","value":265992},{"type":"file","value":266376}],"captures":{"VBoxMouse":[{"type":"file","value":264968}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":265992}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":266376}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest/i","description":"VirtualBox Guest Driver"}},"children":[],"locations":[{"type":"file","value":264992},{"type":"file","value":266452},{"type":"file","value":265896},{"type":"file","value":267720}],"captures":{"VBoxGuest":[{"type":"file","value":264992}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":265896}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":266452}],"\\\\.\\VBoxGuest":[{"type":"file","value":267720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVBoxVBox/i"}},"children":[],"locations":[{"type":"file","value":262112}],"captures":{"VBoxVBoxVBox":[{"type":"file","value":262112}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/innotek GmbH/i"}},"children":[],"locations":[{"type":"file","value":262488}],"captures":{"innotek GmbH":[{"type":"file","value":262488}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/drivers\\\\vboxdrv/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Xen":{"meta":{"name":"reference anti-VM strings targeting Xen","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting Xen\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /^Xen/i\r\n      - string: /XenVMMXenVMM/i\r\n      - string: /xenservice.exe/i\r\n      - string: /XenVMMXenVMM/i\r\n      - string: /HVM domU/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^Xen/i"}},"children":[],"locations":[{"type":"file","value":262048},{"type":"file","value":271872},{"type":"file","value":250956}],"captures":{"Xen Detection":[{"type":"file","value":250956}],"XenVMMXenVMM":[{"type":"file","value":262048}],"xenservice.exe":[{"type":"file","value":271872}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":262048}],"captures":{"XenVMMXenVMM":[{"type":"file","value":262048}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/xenservice.exe/i"}},"children":[],"locations":[{"type":"file","value":271872}],"captures":{"xenservice.exe":[{"type":"file","value":271872}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":262048}],"captures":{"XenVMMXenVMM":[{"type":"file","value":262048}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HVM domU/i"}},"children":[],"locations":[{"type":"file","value":262432}],"captures":{"HVM domU":[{"type":"file","value":262432}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings":{"meta":{"name":"reference anti-VM strings","namespace":"anti-analysis/anti-vm/vm-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp"],"examples":["Practical Malware Analysis Lab 17-02.dll_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - moritz.raabe@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp\r\n    examples:\r\n      - Practical Malware Analysis Lab 17-02.dll_\r\n  features:\r\n    - or:\r\n      - string: /HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i\r\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i\r\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i\r\n      - string: /HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i\r\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i\r\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i\r\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i\r\n      - string: /A M I/i\r\n      - string: /Hyper-V/i\r\n      - string: /Kernel-VMDetection-Private/i\r\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L699\r\n      - string: /KVMKVMKVM/i\r\n        description: KVM\r\n      - string: /Microsoft Hv/i\r\n        description: Microsoft Hyper-V or Windows Virtual PC\r\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L8\r\n      - string: /avghookx.dll/i\r\n        description: AVG\r\n      - string: /avghooka.dll/i\r\n        description: AVG\r\n      - string: /snxhk.dll/i\r\n        description: Avast\r\n      - string: /pstorec.dll/i\r\n        description: SunBelt Sandbox\r\n      - string: /vmcheck.dll/i\r\n        description: Virtual PC\r\n      - string: /wpespy.dll/i\r\n        description: WPE Pro\r\n      - string: /cmdvrt64.dll/i\r\n        description: Comodo Container\r\n      - string: /cmdvrt32.dll/i\r\n        description: Comodo Container\r\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L46\r\n      - string: /sample.exe/i\r\n      - string: /bot.exe/i\r\n      - string: /sandbox.exe/i\r\n      - string: /malware.exe/i\r\n      - string: /test.exe/i\r\n      - string: /klavme.exe/i\r\n      - string: /myapp.exe/i\r\n      - string: /testapp.exe/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i"}},"children":[],"locations":[{"type":"file","value":264424}],"captures":{"HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0":[{"type":"file","value":264424}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/A M I/i"}},"children":[],"locations":[{"type":"file","value":262288}],"captures":{"A M I":[{"type":"file","value":262288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Hyper-V/i"}},"children":[],"locations":[{"type":"file","value":262916}],"captures":{"Hyper-V":[{"type":"file","value":262916}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Kernel-VMDetection-Private/i"}},"children":[],"locations":[{"type":"file","value":247632},{"type":"file","value":262936}],"captures":{"Checking NtQueryLicenseValue with Kernel-VMDetection-Private ":[{"type":"file","value":247632}],"Kernel-VMDetection-Private":[{"type":"file","value":262936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/KVMKVMKVM/i","description":"KVM"}},"children":[],"locations":[{"type":"file","value":261952}],"captures":{"KVMKVMKVM":[{"type":"file","value":261952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Microsoft Hv/i","description":"Microsoft Hyper-V or Windows Virtual PC"}},"children":[],"locations":[{"type":"file","value":261984}],"captures":{"Microsoft Hv":[{"type":"file","value":261984}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghookx.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":260612}],"captures":{"avghookx.dll":[{"type":"file","value":260612}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghooka.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":260644}],"captures":{"avghooka.dll":[{"type":"file","value":260644}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/snxhk.dll/i","description":"Avast"}},"children":[],"locations":[{"type":"file","value":260676}],"captures":{"snxhk.dll":[{"type":"file","value":260676}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/pstorec.dll/i","description":"SunBelt Sandbox"}},"children":[],"locations":[{"type":"file","value":260820}],"captures":{"pstorec.dll":[{"type":"file","value":260820}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmcheck.dll/i","description":"Virtual PC"}},"children":[],"locations":[{"type":"file","value":260848}],"captures":{"vmcheck.dll":[{"type":"file","value":260848}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/wpespy.dll/i","description":"WPE Pro"}},"children":[],"locations":[{"type":"file","value":260876}],"captures":{"wpespy.dll":[{"type":"file","value":260876}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt64.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":260904}],"captures":{"cmdvrt64.dll":[{"type":"file","value":260904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt32.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":260936}],"captures":{"cmdvrt32.dll":[{"type":"file","value":260936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sample.exe/i"}},"children":[],"locations":[{"type":"file","value":261088}],"captures":{"sample.exe":[{"type":"file","value":261088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/bot.exe/i"}},"children":[],"locations":[{"type":"file","value":261116}],"captures":{"bot.exe":[{"type":"file","value":261116}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sandbox.exe/i"}},"children":[],"locations":[{"type":"file","value":261136}],"captures":{"sandbox.exe":[{"type":"file","value":261136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/malware.exe/i"}},"children":[],"locations":[{"type":"file","value":261164}],"captures":{"malware.exe":[{"type":"file","value":261164}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/test.exe/i"}},"children":[],"locations":[{"type":"file","value":261192}],"captures":{"test.exe":[{"type":"file","value":261192}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/klavme.exe/i"}},"children":[],"locations":[{"type":"file","value":261216}],"captures":{"klavme.exe":[{"type":"file","value":261216}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/myapp.exe/i"}},"children":[],"locations":[{"type":"file","value":261244}],"captures":{"myapp.exe":[{"type":"file","value":261244}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/testapp.exe/i"}},"children":[],"locations":[{"type":"file","value":261268}],"captures":{"testapp.exe":[{"type":"file","value":261268}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualPC":{"meta":{"name":"reference anti-VM strings targeting VirtualPC","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting VirtualPC\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n  features:\r\n    - or:\r\n      - string: /VirtualPC/i\r\n      - string: /VMSrvc.exe/i\r\n      - string: /VMUSrvc.exe/i\r\n      - string: /SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualPC/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":269304}],"captures":{"VMSrvc.exe":[{"type":"file","value":269304}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMUSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":269332}],"captures":{"VMUSrvc.exe":[{"type":"file","value":269332}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i"}},"children":[],"locations":[{"type":"file","value":269448}],"captures":{"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters":[{"type":"file","value":269448}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VMWare":{"meta":{"name":"reference anti-VM strings targeting VMWare","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com","@johnk3r"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp"],"examples":["al-khaser_x86.exe_","b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\r\n  meta:\r\n    name: reference anti-VM strings targeting VMWare\r\n    namespace: anti-analysis/anti-vm/vm-detection\r\n    authors:\r\n      - michael.hunhoff@mandiant.com\r\n      - \"@johnk3r\"\r\n    scopes:\r\n      static: file\r\n      dynamic: file\r\n    att&ck:\r\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\r\n    mbc:\r\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\r\n    references:\r\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp\r\n    examples:\r\n      - al-khaser_x86.exe_\r\n      - b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80\r\n  features:\r\n    - or:\r\n      - string: /VMWare/i\r\n      - string: /VMTools/i\r\n      - string: /SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i\r\n      - string: /vmnet\\.sys/i\r\n      - string: /vmmouse\\.sys/i\r\n      - string: /vmusb\\.sys/i\r\n      - string: /vm3dmp\\.sys/i\r\n      - string: /vmci\\.sys/i\r\n      - string: /vmhgfs\\.sys/i\r\n      - string: /vmmemctl\\.sys/i\r\n      - string: /vmx86\\.sys/i\r\n      - string: /vmrawdsk\\.sys/i\r\n      - string: /vmusbmouse\\.sys/i\r\n      - string: /vmkdb\\.sys/i\r\n      - string: /vmnetuserif\\.sys/i\r\n      - string: /vmnetadapter\\.sys/i\r\n      - string: /\\\\\\\\.\\\\HGFS/i\r\n      - string: /\\\\\\\\.\\\\vmci/i\r\n      - string: /vmtoolsd\\.exe/i\r\n      - string: /vmwaretray\\.exe/i\r\n      - string: /vmwareuser\\.exe/i\r\n      - string: /VGAuthService\\.exe/i\r\n      - string: /vmacthlp\\.exe/i\r\n      - string: /vmci/i\r\n        description: VMWare VMCI Bus Driver\r\n      - string: /vmhgfs/i\r\n        description: VMWare Host Guest Control Redirector\r\n      - string: /vmmouse/i\r\n      - string: /vmmemctl/i\r\n        description: VMWare Guest Memory Controller Driver\r\n      - string: /vmusb/i\r\n      - string: /vmusbmouse/i\r\n      - string: /vmx_svga/i\r\n      - string: /vmxnet/i\r\n      - string: /vmx86/i\r\n      - string: /VMwareVMware/i\r\n      - string: /vmGuestLib\\.dll/i\r\n      - string: /vmGuestLib\\.dll/i\r\n      - string: /Applications\\\\VMwareHostOpen\\.exe/i\r\n      - string: /vm3dgl\\.dll/i\r\n      - string: /vmdum\\.dll/i\r\n      - string: /vm3dver\\.dll/i\r\n      - string: /vmtray\\.dll/i\r\n      - string: /VMToolsHook\\.dll/i\r\n      - string: /vmmousever\\.dll/i\r\n      - string: /VmGuestLibJava\\.dll/i\r\n      - string: /vmscsi\\.sys/i\r\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMWare/i"}},"children":[],"locations":[{"type":"file","value":262016},{"type":"file","value":269572},{"type":"file","value":271752},{"type":"file","value":270216},{"type":"file","value":250672},{"type":"file","value":271760},{"type":"file","value":261904},{"type":"file","value":271536},{"type":"file","value":250804},{"type":"file","value":271220},{"type":"file","value":271572},{"type":"file","value":250712},{"type":"file","value":262236}],"captures":{"VMware":[{"type":"file","value":271752}],"VMWARE":[{"type":"file","value":271760},{"type":"file","value":269572}],"VMWare Detection":[{"type":"file","value":250672}],"Checking VMWare network adapter name ":[{"type":"file","value":250712}],"Checking VMWare directory ":[{"type":"file","value":250804}],"vmware":[{"type":"file","value":261904}],"VMwareVMware":[{"type":"file","value":262016}],"VMWare":[{"type":"file","value":262236}],"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":270216}],"VMWare\\":[{"type":"file","value":271220}],"vmwaretray.exe":[{"type":"file","value":271536}],"vmwareuser.exe":[{"type":"file","value":271572}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMTools/i"}},"children":[],"locations":[{"type":"file","value":271504}],"captures":{"vmtoolsd.exe":[{"type":"file","value":271504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i"}},"children":[],"locations":[{"type":"file","value":270216}],"captures":{"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":270216}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnet\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270300}],"captures":{"System32\\drivers\\vmnet.sys":[{"type":"file","value":270300}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270364}],"captures":{"System32\\drivers\\vmmouse.sys":[{"type":"file","value":270364}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270436}],"captures":{"System32\\drivers\\vmusb.sys":[{"type":"file","value":270436}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dmp\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270500}],"captures":{"System32\\drivers\\vm3dmp.sys":[{"type":"file","value":270500}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270568}],"captures":{"System32\\drivers\\vmci.sys":[{"type":"file","value":270568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270632}],"captures":{"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":270632}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270700}],"captures":{"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":270700}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270772}],"captures":{"System32\\drivers\\vmx86.sys":[{"type":"file","value":270772}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmrawdsk\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270836}],"captures":{"System32\\drivers\\vmrawdsk.sys":[{"type":"file","value":270836}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270912}],"captures":{"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":270912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmkdb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270988}],"captures":{"System32\\drivers\\vmkdb.sys":[{"type":"file","value":270988}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetuserif\\.sys/i"}},"children":[],"locations":[{"type":"file","value":271056}],"captures":{"System32\\drivers\\vmnetuserif.sys":[{"type":"file","value":271056}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetadapter\\.sys/i"}},"children":[],"locations":[{"type":"file","value":271136}],"captures":{"System32\\drivers\\vmnetadapter.sys":[{"type":"file","value":271136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\HGFS/i"}},"children":[],"locations":[{"type":"file","value":271456}],"captures":{"\\\\.\\HGFS":[{"type":"file","value":271456}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\vmci/i"}},"children":[],"locations":[{"type":"file","value":271480}],"captures":{"\\\\.\\vmci":[{"type":"file","value":271480}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtoolsd\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271504}],"captures":{"vmtoolsd.exe":[{"type":"file","value":271504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwaretray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271536}],"captures":{"vmwaretray.exe":[{"type":"file","value":271536}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwareuser\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271572}],"captures":{"vmwareuser.exe":[{"type":"file","value":271572}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VGAuthService\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271608}],"captures":{"VGAuthService.exe":[{"type":"file","value":271608}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmacthlp\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271652}],"captures":{"vmacthlp.exe":[{"type":"file","value":271652}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci/i","description":"VMWare VMCI Bus Driver"}},"children":[],"locations":[{"type":"file","value":265016},{"type":"file","value":270568},{"type":"file","value":271480}],"captures":{"vmci":[{"type":"file","value":265016}],"System32\\drivers\\vmci.sys":[{"type":"file","value":270568}],"\\\\.\\vmci":[{"type":"file","value":271480}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs/i","description":"VMWare Host Guest Control Redirector"}},"children":[],"locations":[{"type":"file","value":270632},{"type":"file","value":265028}],"captures":{"vmhgfs":[{"type":"file","value":265028}],"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":270632}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse/i"}},"children":[],"locations":[{"type":"file","value":265044},{"type":"file","value":270364}],"captures":{"vmmouse":[{"type":"file","value":265044}],"System32\\drivers\\vmmouse.sys":[{"type":"file","value":270364}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl/i","description":"VMWare Guest Memory Controller Driver"}},"children":[],"locations":[{"type":"file","value":265064},{"type":"file","value":270700}],"captures":{"vmmemctl":[{"type":"file","value":265064}],"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":270700}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb/i"}},"children":[],"locations":[{"type":"file","value":265088},{"type":"file","value":270912},{"type":"file","value":270436},{"type":"file","value":265104}],"captures":{"vmusb":[{"type":"file","value":265088}],"vmusbmouse":[{"type":"file","value":265104}],"System32\\drivers\\vmusb.sys":[{"type":"file","value":270436}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":270912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse/i"}},"children":[],"locations":[{"type":"file","value":265104},{"type":"file","value":270912}],"captures":{"vmusbmouse":[{"type":"file","value":265104}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":270912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx_svga/i"}},"children":[],"locations":[{"type":"file","value":265132}],"captures":{"vmx_svga":[{"type":"file","value":265132}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmxnet/i"}},"children":[],"locations":[{"type":"file","value":265156}],"captures":{"vmxnet":[{"type":"file","value":265156}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86/i"}},"children":[],"locations":[{"type":"file","value":270772},{"type":"file","value":265172}],"captures":{"vmx86":[{"type":"file","value":265172}],"System32\\drivers\\vmx86.sys":[{"type":"file","value":270772}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMwareVMware/i"}},"children":[],"locations":[{"type":"file","value":262016}],"captures":{"VMwareVMware":[{"type":"file","value":262016}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Applications\\\\VMwareHostOpen\\.exe/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dgl\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmdum\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dver\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtray\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMToolsHook\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmousever\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VmGuestLibJava\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmscsi\\.sys/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}
+{"meta":{"timestamp":"2024-06-10T17:40:18.279877","version":"7.0.1","argv":["./tests/data/al-khaser_x86.exe_","--json"],"sample":{"md5":"db648cd247281954344f1d810c6fd590","sha1":"a457931874ba395917da2ab060c02159f2c418ec","sha256":"faf351db4072395ca1e2855a379b120cdbccdb09131c48463e30dccf4245f4bb","path":"/Users/fariss/Desktop/capa/tests/data/al-khaser_x86.exe_"},"flavor":"static","analysis":{"format":"pe","arch":"i386","os":"windows","extractor":"VivisectFeatureExtractor","rules":["/Users/fariss/Desktop/capa/rules"],"base_address":{"type":"absolute","value":4194304},"layout":{"functions":[{"address":{"type":"absolute","value":4300815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337168}}]},{"address":{"type":"absolute","value":4300820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483968}}]},{"address":{"type":"absolute","value":4300825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335440}}]},{"address":{"type":"absolute","value":4300835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344432}}]},{"address":{"type":"absolute","value":4300840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4454624}},{"address":{"type":"absolute","value":4454700}},{"address":{"type":"absolute","value":4454776}},{"address":{"type":"absolute","value":4454793}},{"address":{"type":"absolute","value":4454883}},{"address":{"type":"absolute","value":4454986}},{"address":{"type":"absolute","value":4455003}},{"address":{"type":"absolute","value":4455048}}]},{"address":{"type":"absolute","value":4300850},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360720}},{"address":{"type":"absolute","value":4360883}},{"address":{"type":"absolute","value":4361222}}]},{"address":{"type":"absolute","value":4300855},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390032}}]},{"address":{"type":"absolute","value":4300865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4478304}},{"address":{"type":"absolute","value":4478482}}]},{"address":{"type":"absolute","value":4300870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358080}}]},{"address":{"type":"absolute","value":4300875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348000}},{"address":{"type":"absolute","value":4348102}}]},{"address":{"type":"absolute","value":4300880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467136}}]},{"address":{"type":"absolute","value":4300885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389600}}]},{"address":{"type":"absolute","value":4300890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325600}},{"address":{"type":"absolute","value":4325779}}]},{"address":{"type":"absolute","value":4300895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4380400}},{"address":{"type":"absolute","value":4380517}},{"address":{"type":"absolute","value":4380558}},{"address":{"type":"absolute","value":4380571}},{"address":{"type":"absolute","value":4380632}},{"address":{"type":"absolute","value":4380677}},{"address":{"type":"absolute","value":4380748}},{"address":{"type":"absolute","value":4380879}}]},{"address":{"type":"absolute","value":4300900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342752}}]},{"address":{"type":"absolute","value":4300905},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506683}},{"address":{"type":"absolute","value":4507003}},{"address":{"type":"absolute","value":4507056}},{"address":{"type":"absolute","value":4507122}},{"address":{"type":"absolute","value":4507159}},{"address":{"type":"absolute","value":4507263}}]},{"address":{"type":"absolute","value":4300910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333856}}]},{"address":{"type":"absolute","value":4300915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461504}},{"address":{"type":"absolute","value":4461599}},{"address":{"type":"absolute","value":4461623}}]},{"address":{"type":"absolute","value":4300925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345920}}]},{"address":{"type":"absolute","value":4300945},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486000}}]},{"address":{"type":"absolute","value":4300950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335136}}]},{"address":{"type":"absolute","value":4300960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4414048}},{"address":{"type":"absolute","value":4414199}}]},{"address":{"type":"absolute","value":4300975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4434576}},{"address":{"type":"absolute","value":4434658}},{"address":{"type":"absolute","value":4434680}},{"address":{"type":"absolute","value":4434768}},{"address":{"type":"absolute","value":4434787}},{"address":{"type":"absolute","value":4434809}}]},{"address":{"type":"absolute","value":4300980},"matched_basic_blocks":[{"address":{"type":"absolute","value":4421904}},{"address":{"type":"absolute","value":4422014}},{"address":{"type":"absolute","value":4422036}},{"address":{"type":"absolute","value":4422192}},{"address":{"type":"absolute","value":4422211}},{"address":{"type":"absolute","value":4422233}}]},{"address":{"type":"absolute","value":4300985},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390832}}]},{"address":{"type":"absolute","value":4300990},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469680}}]},{"address":{"type":"absolute","value":4301005},"matched_basic_blocks":[{"address":{"type":"absolute","value":4432688}},{"address":{"type":"absolute","value":4432807}},{"address":{"type":"absolute","value":4432974}},{"address":{"type":"absolute","value":4433141}}]},{"address":{"type":"absolute","value":4301010},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344832}}]},{"address":{"type":"absolute","value":4301025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4446336}},{"address":{"type":"absolute","value":4446487}},{"address":{"type":"absolute","value":4446539}},{"address":{"type":"absolute","value":4446591}},{"address":{"type":"absolute","value":4446649}},{"address":{"type":"absolute","value":4446672}},{"address":{"type":"absolute","value":4446754}},{"address":{"type":"absolute","value":4446777}},{"address":{"type":"absolute","value":4446852}},{"address":{"type":"absolute","value":4446875}},{"address":{"type":"absolute","value":4447044}},{"address":{"type":"absolute","value":4447067}},{"address":{"type":"absolute","value":4447133}},{"address":{"type":"absolute","value":4447156}},{"address":{"type":"absolute","value":4447388}},{"address":{"type":"absolute","value":4447403}},{"address":{"type":"absolute","value":4447545}}]},{"address":{"type":"absolute","value":4301035},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506064}}]},{"address":{"type":"absolute","value":4301050},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363728}}]},{"address":{"type":"absolute","value":4301055},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470192}}]},{"address":{"type":"absolute","value":4301060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426480}},{"address":{"type":"absolute","value":4426650}},{"address":{"type":"absolute","value":4426678}}]},{"address":{"type":"absolute","value":4301070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371024}}]},{"address":{"type":"absolute","value":4301075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4499898}},{"address":{"type":"absolute","value":4499919}}]},{"address":{"type":"absolute","value":4301080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390320}}]},{"address":{"type":"absolute","value":4301085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404112}},{"address":{"type":"absolute","value":4404183}}]},{"address":{"type":"absolute","value":4301090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485552}}]},{"address":{"type":"absolute","value":4301095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342352}},{"address":{"type":"absolute","value":4342446}},{"address":{"type":"absolute","value":4342501}}]},{"address":{"type":"absolute","value":4301110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442779}},{"address":{"type":"absolute","value":4442801}},{"address":{"type":"absolute","value":4442889}},{"address":{"type":"absolute","value":4442908}},{"address":{"type":"absolute","value":4442930}}]},{"address":{"type":"absolute","value":4301115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383824}}]},{"address":{"type":"absolute","value":4301120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4448064}},{"address":{"type":"absolute","value":4448249}}]},{"address":{"type":"absolute","value":4301125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369232}},{"address":{"type":"absolute","value":4369312}},{"address":{"type":"absolute","value":4369433}},{"address":{"type":"absolute","value":4370126}}]},{"address":{"type":"absolute","value":4301135},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349120}}]},{"address":{"type":"absolute","value":4301140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339648}},{"address":{"type":"absolute","value":4339840}},{"address":{"type":"absolute","value":4339870}},{"address":{"type":"absolute","value":4340285}},{"address":{"type":"absolute","value":4340318}},{"address":{"type":"absolute","value":4340564}}]},{"address":{"type":"absolute","value":4301150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4430528}},{"address":{"type":"absolute","value":4430647}},{"address":{"type":"absolute","value":4430823}},{"address":{"type":"absolute","value":4430990}}]},{"address":{"type":"absolute","value":4301155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356416}}]},{"address":{"type":"absolute","value":4301160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4405952}},{"address":{"type":"absolute","value":4406073}}]},{"address":{"type":"absolute","value":4301165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4323856}}]},{"address":{"type":"absolute","value":4301190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470320}}]},{"address":{"type":"absolute","value":4301195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391104}}]},{"address":{"type":"absolute","value":4301200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460272}},{"address":{"type":"absolute","value":4460360}},{"address":{"type":"absolute","value":4460389}},{"address":{"type":"absolute","value":4460412}},{"address":{"type":"absolute","value":4460460}},{"address":{"type":"absolute","value":4460528}}]},{"address":{"type":"absolute","value":4301205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4381680}},{"address":{"type":"absolute","value":4381761}},{"address":{"type":"absolute","value":4381788}}]},{"address":{"type":"absolute","value":4301210},"matched_basic_blocks":[{"address":{"type":"absolute","value":4465728}},{"address":{"type":"absolute","value":4465885}},{"address":{"type":"absolute","value":4465915}},{"address":{"type":"absolute","value":4465955}},{"address":{"type":"absolute","value":4465985}},{"address":{"type":"absolute","value":4466033}},{"address":{"type":"absolute","value":4466106}},{"address":{"type":"absolute","value":4466151}}]},{"address":{"type":"absolute","value":4301215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384688}}]},{"address":{"type":"absolute","value":4301220},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365024}},{"address":{"type":"absolute","value":4365097}},{"address":{"type":"absolute","value":4365120}},{"address":{"type":"absolute","value":4365150}}]},{"address":{"type":"absolute","value":4301230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368947}},{"address":{"type":"absolute","value":4368961}}]},{"address":{"type":"absolute","value":4301240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4386512}},{"address":{"type":"absolute","value":4386637}},{"address":{"type":"absolute","value":4386719}}]},{"address":{"type":"absolute","value":4301245},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391888}}]},{"address":{"type":"absolute","value":4301255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471120}}]},{"address":{"type":"absolute","value":4301265},"matched_basic_blocks":[{"address":{"type":"absolute","value":4489136}},{"address":{"type":"absolute","value":4489289}},{"address":{"type":"absolute","value":4489406}},{"address":{"type":"absolute","value":4489435}}]},{"address":{"type":"absolute","value":4301270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347472}},{"address":{"type":"absolute","value":4347546}}]},{"address":{"type":"absolute","value":4301275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484400}},{"address":{"type":"absolute","value":4484521}},{"address":{"type":"absolute","value":4484560}}]},{"address":{"type":"absolute","value":4301280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4411616}},{"address":{"type":"absolute","value":4411735}},{"address":{"type":"absolute","value":4412204}}]},{"address":{"type":"absolute","value":4301300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365648}}]},{"address":{"type":"absolute","value":4301305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461216}},{"address":{"type":"absolute","value":4461284}}]},{"address":{"type":"absolute","value":4301310},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365792}}]},{"address":{"type":"absolute","value":4301315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387728}}]},{"address":{"type":"absolute","value":4301320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334640}}]},{"address":{"type":"absolute","value":4301335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385408}}]},{"address":{"type":"absolute","value":4301355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464976}},{"address":{"type":"absolute","value":4465042}},{"address":{"type":"absolute","value":4465079}},{"address":{"type":"absolute","value":4465145}},{"address":{"type":"absolute","value":4465202}},{"address":{"type":"absolute","value":4465236}},{"address":{"type":"absolute","value":4465270}},{"address":{"type":"absolute","value":4465311}},{"address":{"type":"absolute","value":4465355}},{"address":{"type":"absolute","value":4465399}},{"address":{"type":"absolute","value":4465433}},{"address":{"type":"absolute","value":4465499}}]},{"address":{"type":"absolute","value":4301370},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483136}},{"address":{"type":"absolute","value":4483230}},{"address":{"type":"absolute","value":4483285}}]},{"address":{"type":"absolute","value":4301380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468800}},{"address":{"type":"absolute","value":4468963}},{"address":{"type":"absolute","value":4469302}}]},{"address":{"type":"absolute","value":4301385},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344304}}]},{"address":{"type":"absolute","value":4301390},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365360}}]},{"address":{"type":"absolute","value":4301395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4475968}},{"address":{"type":"absolute","value":4476043}},{"address":{"type":"absolute","value":4476131}}]},{"address":{"type":"absolute","value":4301405},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357104}}]},{"address":{"type":"absolute","value":4301410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470448}},{"address":{"type":"absolute","value":4470521}},{"address":{"type":"absolute","value":4470544}},{"address":{"type":"absolute","value":4470574}}]},{"address":{"type":"absolute","value":4301420},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332752}},{"address":{"type":"absolute","value":4332821}},{"address":{"type":"absolute","value":4332836}},{"address":{"type":"absolute","value":4332872}},{"address":{"type":"absolute","value":4332900}}]},{"address":{"type":"absolute","value":4301425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366224}}]},{"address":{"type":"absolute","value":4301435},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469520}}]},{"address":{"type":"absolute","value":4301440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327968}},{"address":{"type":"absolute","value":4328049}},{"address":{"type":"absolute","value":4328090}},{"address":{"type":"absolute","value":4328192}}]},{"address":{"type":"absolute","value":4301445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383152}}]},{"address":{"type":"absolute","value":4301455},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350336}}]},{"address":{"type":"absolute","value":4301460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4341008}},{"address":{"type":"absolute","value":4341200}},{"address":{"type":"absolute","value":4341226}},{"address":{"type":"absolute","value":4341299}},{"address":{"type":"absolute","value":4341339}}]},{"address":{"type":"absolute","value":4301480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392320}}]},{"address":{"type":"absolute","value":4301485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390944}}]},{"address":{"type":"absolute","value":4301505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503584}},{"address":{"type":"absolute","value":4503636}},{"address":{"type":"absolute","value":4503669}}]},{"address":{"type":"absolute","value":4301510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415136}},{"address":{"type":"absolute","value":4415207}}]},{"address":{"type":"absolute","value":4301515},"matched_basic_blocks":[{"address":{"type":"absolute","value":4430096}},{"address":{"type":"absolute","value":4430192}},{"address":{"type":"absolute","value":4430262}},{"address":{"type":"absolute","value":4430290}},{"address":{"type":"absolute","value":4430325}},{"address":{"type":"absolute","value":4430347}}]},{"address":{"type":"absolute","value":4301520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426944}},{"address":{"type":"absolute","value":4427093}},{"address":{"type":"absolute","value":4427461}},{"address":{"type":"absolute","value":4427556}},{"address":{"type":"absolute","value":4427637}},{"address":{"type":"absolute","value":4427664}},{"address":{"type":"absolute","value":4427884}}]},{"address":{"type":"absolute","value":4301525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483680}}]},{"address":{"type":"absolute","value":4301535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360048}}]},{"address":{"type":"absolute","value":4301545},"matched_basic_blocks":[{"address":{"type":"absolute","value":4428512}},{"address":{"type":"absolute","value":4428840}},{"address":{"type":"absolute","value":4428871}},{"address":{"type":"absolute","value":4428997}},{"address":{"type":"absolute","value":4429016}},{"address":{"type":"absolute","value":4429069}}]},{"address":{"type":"absolute","value":4301550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325376}}]},{"address":{"type":"absolute","value":4301555},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351792}},{"address":{"type":"absolute","value":4351915}},{"address":{"type":"absolute","value":4351994}},{"address":{"type":"absolute","value":4352050}},{"address":{"type":"absolute","value":4352064}},{"address":{"type":"absolute","value":4352103}},{"address":{"type":"absolute","value":4352146}},{"address":{"type":"absolute","value":4352314}},{"address":{"type":"absolute","value":4352341}},{"address":{"type":"absolute","value":4352428}},{"address":{"type":"absolute","value":4352450}}]},{"address":{"type":"absolute","value":4301570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332192}},{"address":{"type":"absolute","value":4332556}}]},{"address":{"type":"absolute","value":4301575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339200}}]},{"address":{"type":"absolute","value":4301580},"matched_basic_blocks":[{"address":{"type":"absolute","value":4505984}}]},{"address":{"type":"absolute","value":4301585},"matched_basic_blocks":[{"address":{"type":"absolute","value":4409840}},{"address":{"type":"absolute","value":4409912}}]},{"address":{"type":"absolute","value":4301590},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346064}}]},{"address":{"type":"absolute","value":4301595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466416}}]},{"address":{"type":"absolute","value":4301600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4463168}},{"address":{"type":"absolute","value":4463284}},{"address":{"type":"absolute","value":4463357}},{"address":{"type":"absolute","value":4463458}}]},{"address":{"type":"absolute","value":4301605},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389168}}]},{"address":{"type":"absolute","value":4301615},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379152}},{"address":{"type":"absolute","value":4379270}}]},{"address":{"type":"absolute","value":4301625},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493425}},{"address":{"type":"absolute","value":4493440}},{"address":{"type":"absolute","value":4493576}}]},{"address":{"type":"absolute","value":4301630},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351632}}]},{"address":{"type":"absolute","value":4301635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485040}}]},{"address":{"type":"absolute","value":4301650},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351488}}]},{"address":{"type":"absolute","value":4301655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350720}}]},{"address":{"type":"absolute","value":4301665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363552}}]},{"address":{"type":"absolute","value":4301690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436256}}]},{"address":{"type":"absolute","value":4301695},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353232}}]},{"address":{"type":"absolute","value":4301710},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385120}}]},{"address":{"type":"absolute","value":4301725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482512}},{"address":{"type":"absolute","value":4482593}},{"address":{"type":"absolute","value":4482620}}]},{"address":{"type":"absolute","value":4301730},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452864}}]},{"address":{"type":"absolute","value":4301740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4403984}},{"address":{"type":"absolute","value":4404055}}]},{"address":{"type":"absolute","value":4301755},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470640}},{"address":{"type":"absolute","value":4470713}},{"address":{"type":"absolute","value":4470736}},{"address":{"type":"absolute","value":4470766}}]},{"address":{"type":"absolute","value":4301760},"matched_basic_blocks":[{"address":{"type":"absolute","value":4476992}},{"address":{"type":"absolute","value":4477096}},{"address":{"type":"absolute","value":4477149}},{"address":{"type":"absolute","value":4477360}}]},{"address":{"type":"absolute","value":4301765},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363152}}]},{"address":{"type":"absolute","value":4301770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500896}}]},{"address":{"type":"absolute","value":4301785},"matched_basic_blocks":[{"address":{"type":"absolute","value":4448400}},{"address":{"type":"absolute","value":4448564}},{"address":{"type":"absolute","value":4448592}},{"address":{"type":"absolute","value":4448647}},{"address":{"type":"absolute","value":4448667}},{"address":{"type":"absolute","value":4448722}},{"address":{"type":"absolute","value":4448742}},{"address":{"type":"absolute","value":4448826}},{"address":{"type":"absolute","value":4448846}},{"address":{"type":"absolute","value":4448998}},{"address":{"type":"absolute","value":4449016}},{"address":{"type":"absolute","value":4449085}},{"address":{"type":"absolute","value":4449103}},{"address":{"type":"absolute","value":4449187}},{"address":{"type":"absolute","value":4449271}},{"address":{"type":"absolute","value":4449335}},{"address":{"type":"absolute","value":4449489}}]},{"address":{"type":"absolute","value":4301790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344560}}]},{"address":{"type":"absolute","value":4301810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388240}}]},{"address":{"type":"absolute","value":4301815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346384}}]},{"address":{"type":"absolute","value":4301820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342080}}]},{"address":{"type":"absolute","value":4301825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367360}}]},{"address":{"type":"absolute","value":4301835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4399152}},{"address":{"type":"absolute","value":4399247}},{"address":{"type":"absolute","value":4399284}},{"address":{"type":"absolute","value":4399322}},{"address":{"type":"absolute","value":4399385}},{"address":{"type":"absolute","value":4399452}},{"address":{"type":"absolute","value":4399467}},{"address":{"type":"absolute","value":4399508}},{"address":{"type":"absolute","value":4399631}},{"address":{"type":"absolute","value":4399680}},{"address":{"type":"absolute","value":4399810}}]},{"address":{"type":"absolute","value":4301860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333602}},{"address":{"type":"absolute","value":4333668}}]},{"address":{"type":"absolute","value":4301865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345072}}]},{"address":{"type":"absolute","value":4301870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319424}},{"address":{"type":"absolute","value":4319504}},{"address":{"type":"absolute","value":4319520}}]},{"address":{"type":"absolute","value":4301875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358416}}]},{"address":{"type":"absolute","value":4301880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394944}}]},{"address":{"type":"absolute","value":4301885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353952}}]},{"address":{"type":"absolute","value":4301895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452576}}]},{"address":{"type":"absolute","value":4301900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339504}}]},{"address":{"type":"absolute","value":4301905},"matched_basic_blocks":[{"address":{"type":"absolute","value":4411256}},{"address":{"type":"absolute","value":4411278}},{"address":{"type":"absolute","value":4411378}},{"address":{"type":"absolute","value":4411397}},{"address":{"type":"absolute","value":4411419}}]},{"address":{"type":"absolute","value":4301910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415392}},{"address":{"type":"absolute","value":4415463}}]},{"address":{"type":"absolute","value":4301915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4444272}},{"address":{"type":"absolute","value":4444419}},{"address":{"type":"absolute","value":4444470}},{"address":{"type":"absolute","value":4444488}},{"address":{"type":"absolute","value":4444542}},{"address":{"type":"absolute","value":4444605}},{"address":{"type":"absolute","value":4444623}},{"address":{"type":"absolute","value":4444724}},{"address":{"type":"absolute","value":4444827}},{"address":{"type":"absolute","value":4444850}},{"address":{"type":"absolute","value":4444950}},{"address":{"type":"absolute","value":4445082}},{"address":{"type":"absolute","value":4445146}},{"address":{"type":"absolute","value":4445229}},{"address":{"type":"absolute","value":4445262}},{"address":{"type":"absolute","value":4445368}},{"address":{"type":"absolute","value":4445726}}]},{"address":{"type":"absolute","value":4301925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492560}}]},{"address":{"type":"absolute","value":4301940},"matched_basic_blocks":[{"address":{"type":"absolute","value":4423184}},{"address":{"type":"absolute","value":4423291}},{"address":{"type":"absolute","value":4423423}},{"address":{"type":"absolute","value":4423467}},{"address":{"type":"absolute","value":4423557}},{"address":{"type":"absolute","value":4423574}},{"address":{"type":"absolute","value":4423598}}]},{"address":{"type":"absolute","value":4301950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4324016}}]},{"address":{"type":"absolute","value":4301960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4494608}},{"address":{"type":"absolute","value":4494774}},{"address":{"type":"absolute","value":4494826}},{"address":{"type":"absolute","value":4494864}},{"address":{"type":"absolute","value":4494903}},{"address":{"type":"absolute","value":4494989}}]},{"address":{"type":"absolute","value":4301970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353808}}]},{"address":{"type":"absolute","value":4301985},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338000}}]},{"address":{"type":"absolute","value":4301995},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391440}}]},{"address":{"type":"absolute","value":4302000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393840}}]},{"address":{"type":"absolute","value":4302015},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394112}},{"address":{"type":"absolute","value":4394169}},{"address":{"type":"absolute","value":4394198}},{"address":{"type":"absolute","value":4394211}}]},{"address":{"type":"absolute","value":4302020},"matched_basic_blocks":[{"address":{"type":"absolute","value":4437312}},{"address":{"type":"absolute","value":4437394}},{"address":{"type":"absolute","value":4437416}},{"address":{"type":"absolute","value":4437534}},{"address":{"type":"absolute","value":4437572}},{"address":{"type":"absolute","value":4437594}}]},{"address":{"type":"absolute","value":4302035},"matched_basic_blocks":[{"address":{"type":"absolute","value":4418816}},{"address":{"type":"absolute","value":4418887}}]},{"address":{"type":"absolute","value":4302040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382480}},{"address":{"type":"absolute","value":4382574}},{"address":{"type":"absolute","value":4382629}}]},{"address":{"type":"absolute","value":4302060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338432}}]},{"address":{"type":"absolute","value":4302070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496742}}]},{"address":{"type":"absolute","value":4302075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326576}}]},{"address":{"type":"absolute","value":4302085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415792}},{"address":{"type":"absolute","value":4415911}},{"address":{"type":"absolute","value":4416218}}]},{"address":{"type":"absolute","value":4302100},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402352}},{"address":{"type":"absolute","value":4402423}}]},{"address":{"type":"absolute","value":4302105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431328}},{"address":{"type":"absolute","value":4431497}}]},{"address":{"type":"absolute","value":4302110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4419312}},{"address":{"type":"absolute","value":4419431}},{"address":{"type":"absolute","value":4419534}},{"address":{"type":"absolute","value":4419725}}]},{"address":{"type":"absolute","value":4302115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456336}}]},{"address":{"type":"absolute","value":4302120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371984}}]},{"address":{"type":"absolute","value":4302125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382752}},{"address":{"type":"absolute","value":4382906}}]},{"address":{"type":"absolute","value":4302130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456976}}]},{"address":{"type":"absolute","value":4302140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384256}}]},{"address":{"type":"absolute","value":4302150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345168}}]},{"address":{"type":"absolute","value":4302155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345664}}]},{"address":{"type":"absolute","value":4302160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357658}},{"address":{"type":"absolute","value":4357682}},{"address":{"type":"absolute","value":4357705}}]},{"address":{"type":"absolute","value":4302165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334320}},{"address":{"type":"absolute","value":4334384}},{"address":{"type":"absolute","value":4334407}},{"address":{"type":"absolute","value":4334452}},{"address":{"type":"absolute","value":4334497}}]},{"address":{"type":"absolute","value":4302170},"matched_basic_blocks":[{"address":{"type":"absolute","value":4477552}},{"address":{"type":"absolute","value":4477620}},{"address":{"type":"absolute","value":4477682}},{"address":{"type":"absolute","value":4477717}},{"address":{"type":"absolute","value":4477768}},{"address":{"type":"absolute","value":4477894}},{"address":{"type":"absolute","value":4478038}},{"address":{"type":"absolute","value":4478129}}]},{"address":{"type":"absolute","value":4302175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4403856}},{"address":{"type":"absolute","value":4403927}}]},{"address":{"type":"absolute","value":4302180},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455424}}]},{"address":{"type":"absolute","value":4302190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453585}},{"address":{"type":"absolute","value":4453660}},{"address":{"type":"absolute","value":4453700}}]},{"address":{"type":"absolute","value":4302200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471264}}]},{"address":{"type":"absolute","value":4302205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4512199}}]},{"address":{"type":"absolute","value":4302215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496208}},{"address":{"type":"absolute","value":4496475}}]},{"address":{"type":"absolute","value":4302225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4488864}}]},{"address":{"type":"absolute","value":4302230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384400}}]},{"address":{"type":"absolute","value":4302235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344000}},{"address":{"type":"absolute","value":4344125}},{"address":{"type":"absolute","value":4344207}}]},{"address":{"type":"absolute","value":4302245},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394816}}]},{"address":{"type":"absolute","value":4302250},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363392}}]},{"address":{"type":"absolute","value":4302255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389024}}]},{"address":{"type":"absolute","value":4302260},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348800}},{"address":{"type":"absolute","value":4348879}},{"address":{"type":"absolute","value":4348936}},{"address":{"type":"absolute","value":4348945}},{"address":{"type":"absolute","value":4348984}},{"address":{"type":"absolute","value":4349020}}]},{"address":{"type":"absolute","value":4302270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4425888}}]},{"address":{"type":"absolute","value":4302275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4400848}},{"address":{"type":"absolute","value":4400905}},{"address":{"type":"absolute","value":4400968}}]},{"address":{"type":"absolute","value":4302280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492912}}]},{"address":{"type":"absolute","value":4302285},"matched_basic_blocks":[{"address":{"type":"absolute","value":4495504}},{"address":{"type":"absolute","value":4495725}}]},{"address":{"type":"absolute","value":4302290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358672}}]},{"address":{"type":"absolute","value":4302295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369059}},{"address":{"type":"absolute","value":4369073}}]},{"address":{"type":"absolute","value":4302300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491536}},{"address":{"type":"absolute","value":4491634}}]},{"address":{"type":"absolute","value":4302305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472528}},{"address":{"type":"absolute","value":4472638}},{"address":{"type":"absolute","value":4472673}},{"address":{"type":"absolute","value":4472767}},{"address":{"type":"absolute","value":4472782}}]},{"address":{"type":"absolute","value":4302320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402704}},{"address":{"type":"absolute","value":4402775}}]},{"address":{"type":"absolute","value":4302325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452288}}]},{"address":{"type":"absolute","value":4302335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364560}}]},{"address":{"type":"absolute","value":4302340},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388496}}]},{"address":{"type":"absolute","value":4302345},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506592}}]},{"address":{"type":"absolute","value":4302350},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467216}}]},{"address":{"type":"absolute","value":4302355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357802}},{"address":{"type":"absolute","value":4357835}},{"address":{"type":"absolute","value":4357851}},{"address":{"type":"absolute","value":4357901}}]},{"address":{"type":"absolute","value":4302360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4396672}}]},{"address":{"type":"absolute","value":4302365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355984}}]},{"address":{"type":"absolute","value":4302370},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356800}}]},{"address":{"type":"absolute","value":4302375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4502156}}]},{"address":{"type":"absolute","value":4302380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333440}}]},{"address":{"type":"absolute","value":4302395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4372080}}]},{"address":{"type":"absolute","value":4302410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364832}},{"address":{"type":"absolute","value":4364905}},{"address":{"type":"absolute","value":4364928}},{"address":{"type":"absolute","value":4364958}}]},{"address":{"type":"absolute","value":4302420},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453825}},{"address":{"type":"absolute","value":4453844}},{"address":{"type":"absolute","value":4454055}}]},{"address":{"type":"absolute","value":4302425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326500}},{"address":{"type":"absolute","value":4326526}}]},{"address":{"type":"absolute","value":4302430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4499793}}]},{"address":{"type":"absolute","value":4302435},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363904}}]},{"address":{"type":"absolute","value":4302440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363472}}]},{"address":{"type":"absolute","value":4302445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338576}}]},{"address":{"type":"absolute","value":4302450},"matched_basic_blocks":[{"address":{"type":"absolute","value":4454209}},{"address":{"type":"absolute","value":4454261}},{"address":{"type":"absolute","value":4454301}}]},{"address":{"type":"absolute","value":4302460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389312}}]},{"address":{"type":"absolute","value":4302465},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442000}},{"address":{"type":"absolute","value":4442069}},{"address":{"type":"absolute","value":4442125}}]},{"address":{"type":"absolute","value":4302470},"matched_basic_blocks":[{"address":{"type":"absolute","value":4386816}},{"address":{"type":"absolute","value":4386941}},{"address":{"type":"absolute","value":4387023}}]},{"address":{"type":"absolute","value":4302475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459424}},{"address":{"type":"absolute","value":4459650}}]},{"address":{"type":"absolute","value":4302480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4431680}},{"address":{"type":"absolute","value":4431799}},{"address":{"type":"absolute","value":4432007}},{"address":{"type":"absolute","value":4432028}},{"address":{"type":"absolute","value":4432045}},{"address":{"type":"absolute","value":4432066}},{"address":{"type":"absolute","value":4432083}},{"address":{"type":"absolute","value":4432104}},{"address":{"type":"absolute","value":4432121}},{"address":{"type":"absolute","value":4432142}},{"address":{"type":"absolute","value":4432304}}]},{"address":{"type":"absolute","value":4302495},"matched_basic_blocks":[{"address":{"type":"absolute","value":4439168}},{"address":{"type":"absolute","value":4439264}},{"address":{"type":"absolute","value":4439319}},{"address":{"type":"absolute","value":4439361}},{"address":{"type":"absolute","value":4439378}},{"address":{"type":"absolute","value":4439421}},{"address":{"type":"absolute","value":4439470}},{"address":{"type":"absolute","value":4439497}},{"address":{"type":"absolute","value":4439522}}]},{"address":{"type":"absolute","value":4302510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366368}}]},{"address":{"type":"absolute","value":4302525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485296}}]},{"address":{"type":"absolute","value":4302530},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485168}}]},{"address":{"type":"absolute","value":4302535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436843}},{"address":{"type":"absolute","value":4436865}},{"address":{"type":"absolute","value":4436958}},{"address":{"type":"absolute","value":4436977}},{"address":{"type":"absolute","value":4436999}}]},{"address":{"type":"absolute","value":4302560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359104}}]},{"address":{"type":"absolute","value":4302565},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346608}},{"address":{"type":"absolute","value":4346748}}]},{"address":{"type":"absolute","value":4302570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367568}}]},{"address":{"type":"absolute","value":4302585},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347856}}]},{"address":{"type":"absolute","value":4302595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4352928}},{"address":{"type":"absolute","value":4353024}},{"address":{"type":"absolute","value":4353044}},{"address":{"type":"absolute","value":4353079}}]},{"address":{"type":"absolute","value":4302610},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481104}},{"address":{"type":"absolute","value":4481214}}]},{"address":{"type":"absolute","value":4302615},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335664}},{"address":{"type":"absolute","value":4335827}},{"address":{"type":"absolute","value":4336166}}]},{"address":{"type":"absolute","value":4302620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462496}}]},{"address":{"type":"absolute","value":4302635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435144}},{"address":{"type":"absolute","value":4435166}},{"address":{"type":"absolute","value":4435341}},{"address":{"type":"absolute","value":4435360}},{"address":{"type":"absolute","value":4435382}}]},{"address":{"type":"absolute","value":4302640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346272}}]},{"address":{"type":"absolute","value":4302645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350192}}]},{"address":{"type":"absolute","value":4302655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4478944}},{"address":{"type":"absolute","value":4479099}}]},{"address":{"type":"absolute","value":4302665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487024}}]},{"address":{"type":"absolute","value":4302670},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349200}}]},{"address":{"type":"absolute","value":4302675},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509392}}]},{"address":{"type":"absolute","value":4302685},"matched_basic_blocks":[{"address":{"type":"absolute","value":4433488}},{"address":{"type":"absolute","value":4433607}},{"address":{"type":"absolute","value":4433783}},{"address":{"type":"absolute","value":4433895}},{"address":{"type":"absolute","value":4434007}},{"address":{"type":"absolute","value":4434174}}]},{"address":{"type":"absolute","value":4302690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389456}}]},{"address":{"type":"absolute","value":4302700},"matched_basic_blocks":[{"address":{"type":"absolute","value":4329360}},{"address":{"type":"absolute","value":4329614}}]},{"address":{"type":"absolute","value":4302705},"matched_basic_blocks":[{"address":{"type":"absolute","value":4413120}},{"address":{"type":"absolute","value":4413239}},{"address":{"type":"absolute","value":4413680}}]},{"address":{"type":"absolute","value":4302710},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462128}}]},{"address":{"type":"absolute","value":4302715},"matched_basic_blocks":[{"address":{"type":"absolute","value":4420128}},{"address":{"type":"absolute","value":4420210}},{"address":{"type":"absolute","value":4420232}},{"address":{"type":"absolute","value":4420320}},{"address":{"type":"absolute","value":4420339}},{"address":{"type":"absolute","value":4420361}}]},{"address":{"type":"absolute","value":4302740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457584}},{"address":{"type":"absolute","value":4457747}}]},{"address":{"type":"absolute","value":4302745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4403728}},{"address":{"type":"absolute","value":4403799}}]},{"address":{"type":"absolute","value":4302750},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385872}},{"address":{"type":"absolute","value":4385993}},{"address":{"type":"absolute","value":4386032}}]},{"address":{"type":"absolute","value":4302770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466880}}]},{"address":{"type":"absolute","value":4302775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460736}}]},{"address":{"type":"absolute","value":4302780},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384544}}]},{"address":{"type":"absolute","value":4302785},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332976}},{"address":{"type":"absolute","value":4333263}}]},{"address":{"type":"absolute","value":4302790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368835}},{"address":{"type":"absolute","value":4368849}}]},{"address":{"type":"absolute","value":4302795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368176}}]},{"address":{"type":"absolute","value":4302810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385552}},{"address":{"type":"absolute","value":4385673}},{"address":{"type":"absolute","value":4385712}}]},{"address":{"type":"absolute","value":4302815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483824}}]},{"address":{"type":"absolute","value":4302830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4488144}},{"address":{"type":"absolute","value":4488255}},{"address":{"type":"absolute","value":4488395}},{"address":{"type":"absolute","value":4488459}},{"address":{"type":"absolute","value":4488516}},{"address":{"type":"absolute","value":4488602}}]},{"address":{"type":"absolute","value":4302835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4505408}}]},{"address":{"type":"absolute","value":4302840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383680}}]},{"address":{"type":"absolute","value":4302845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484112}}]},{"address":{"type":"absolute","value":4302860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457152}}]},{"address":{"type":"absolute","value":4302865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4346880}},{"address":{"type":"absolute","value":4346949}}]},{"address":{"type":"absolute","value":4302870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345552}}]},{"address":{"type":"absolute","value":4302875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402480}},{"address":{"type":"absolute","value":4402636}}]},{"address":{"type":"absolute","value":4302880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383536}}]},{"address":{"type":"absolute","value":4302885},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506263}}]},{"address":{"type":"absolute","value":4302890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390416}}]},{"address":{"type":"absolute","value":4302895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4410992}},{"address":{"type":"absolute","value":4411060}}]},{"address":{"type":"absolute","value":4302900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355024}}]},{"address":{"type":"absolute","value":4302910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389888}}]},{"address":{"type":"absolute","value":4302915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327280}},{"address":{"type":"absolute","value":4327478}},{"address":{"type":"absolute","value":4327714}}]},{"address":{"type":"absolute","value":4302920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379344}},{"address":{"type":"absolute","value":4379465}},{"address":{"type":"absolute","value":4379486}}]},{"address":{"type":"absolute","value":4302925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382208}},{"address":{"type":"absolute","value":4382302}},{"address":{"type":"absolute","value":4382357}}]},{"address":{"type":"absolute","value":4302930},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319600}}]},{"address":{"type":"absolute","value":4302935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486608}},{"address":{"type":"absolute","value":4486823}},{"address":{"type":"absolute","value":4486854}}]},{"address":{"type":"absolute","value":4302940},"matched_basic_blocks":[{"address":{"type":"absolute","value":4332096}}]},{"address":{"type":"absolute","value":4302950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436352}},{"address":{"type":"absolute","value":4436434}},{"address":{"type":"absolute","value":4436456}},{"address":{"type":"absolute","value":4436544}},{"address":{"type":"absolute","value":4436563}},{"address":{"type":"absolute","value":4436585}}]},{"address":{"type":"absolute","value":4302955},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391776}}]},{"address":{"type":"absolute","value":4302960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412992}},{"address":{"type":"absolute","value":4413063}}]},{"address":{"type":"absolute","value":4302965},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496112}},{"address":{"type":"absolute","value":4496130}},{"address":{"type":"absolute","value":4496151}}]},{"address":{"type":"absolute","value":4302970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4416960}},{"address":{"type":"absolute","value":4417079}},{"address":{"type":"absolute","value":4417282}},{"address":{"type":"absolute","value":4417579}}]},{"address":{"type":"absolute","value":4302975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4441659}},{"address":{"type":"absolute","value":4441681}},{"address":{"type":"absolute","value":4441774}},{"address":{"type":"absolute","value":4441793}},{"address":{"type":"absolute","value":4441815}}]},{"address":{"type":"absolute","value":4302980},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484256}}]},{"address":{"type":"absolute","value":4302995},"matched_basic_blocks":[{"address":{"type":"absolute","value":4443120}},{"address":{"type":"absolute","value":4443245}},{"address":{"type":"absolute","value":4443309}},{"address":{"type":"absolute","value":4443344}},{"address":{"type":"absolute","value":4443396}},{"address":{"type":"absolute","value":4443419}},{"address":{"type":"absolute","value":4443465}},{"address":{"type":"absolute","value":4443488}},{"address":{"type":"absolute","value":4443648}},{"address":{"type":"absolute","value":4443671}},{"address":{"type":"absolute","value":4443731}},{"address":{"type":"absolute","value":4443748}},{"address":{"type":"absolute","value":4443792}},{"address":{"type":"absolute","value":4443807}},{"address":{"type":"absolute","value":4443937}}]},{"address":{"type":"absolute","value":4303000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468080}},{"address":{"type":"absolute","value":4468243}},{"address":{"type":"absolute","value":4468582}}]},{"address":{"type":"absolute","value":4303015},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336560}},{"address":{"type":"absolute","value":4336663}}]},{"address":{"type":"absolute","value":4303020},"matched_basic_blocks":[{"address":{"type":"absolute","value":4381856}},{"address":{"type":"absolute","value":4381937}},{"address":{"type":"absolute","value":4381964}}]},{"address":{"type":"absolute","value":4303025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4398480}},{"address":{"type":"absolute","value":4398575}},{"address":{"type":"absolute","value":4398612}},{"address":{"type":"absolute","value":4398650}},{"address":{"type":"absolute","value":4398713}},{"address":{"type":"absolute","value":4398780}},{"address":{"type":"absolute","value":4398910}}]},{"address":{"type":"absolute","value":4303030},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460640}}]},{"address":{"type":"absolute","value":4303035},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498528}}]},{"address":{"type":"absolute","value":4303040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491856}}]},{"address":{"type":"absolute","value":4303050},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338144}}]},{"address":{"type":"absolute","value":4303055},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412576}},{"address":{"type":"absolute","value":4412722}}]},{"address":{"type":"absolute","value":4303060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415264}},{"address":{"type":"absolute","value":4415335}}]},{"address":{"type":"absolute","value":4303065},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353664}}]},{"address":{"type":"absolute","value":4303075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367152}}]},{"address":{"type":"absolute","value":4303095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503984}},{"address":{"type":"absolute","value":4504028}},{"address":{"type":"absolute","value":4504047}},{"address":{"type":"absolute","value":4504125}}]},{"address":{"type":"absolute","value":4303100},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338928}}]},{"address":{"type":"absolute","value":4303105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4362896}},{"address":{"type":"absolute","value":4362997}}]},{"address":{"type":"absolute","value":4303110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342896}}]},{"address":{"type":"absolute","value":4303115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470016}}]},{"address":{"type":"absolute","value":4303130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4429408}},{"address":{"type":"absolute","value":4429504}},{"address":{"type":"absolute","value":4429559}},{"address":{"type":"absolute","value":4429601}},{"address":{"type":"absolute","value":4429622}},{"address":{"type":"absolute","value":4429669}},{"address":{"type":"absolute","value":4429748}},{"address":{"type":"absolute","value":4429779}},{"address":{"type":"absolute","value":4429820}},{"address":{"type":"absolute","value":4429847}},{"address":{"type":"absolute","value":4429872}}]},{"address":{"type":"absolute","value":4303155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4339024}}]},{"address":{"type":"absolute","value":4303160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347051}},{"address":{"type":"absolute","value":4347076}},{"address":{"type":"absolute","value":4347099}}]},{"address":{"type":"absolute","value":4303165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467856}}]},{"address":{"type":"absolute","value":4303170},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506391}}]},{"address":{"type":"absolute","value":4303175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4370864}},{"address":{"type":"absolute","value":4370959}}]},{"address":{"type":"absolute","value":4303180},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349696}}]},{"address":{"type":"absolute","value":4303195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354512}}]},{"address":{"type":"absolute","value":4303200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319696}}]},{"address":{"type":"absolute","value":4303205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354224}},{"address":{"type":"absolute","value":4354293}},{"address":{"type":"absolute","value":4354311}}]},{"address":{"type":"absolute","value":4303210},"matched_basic_blocks":[{"address":{"type":"absolute","value":4416544}},{"address":{"type":"absolute","value":4416739}}]},{"address":{"type":"absolute","value":4303220},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392528}}]},{"address":{"type":"absolute","value":4303225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337088}}]},{"address":{"type":"absolute","value":4303230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365936}}]},{"address":{"type":"absolute","value":4303235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492000}}]},{"address":{"type":"absolute","value":4303265},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345392}}]},{"address":{"type":"absolute","value":4303270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4378352}},{"address":{"type":"absolute","value":4378438}},{"address":{"type":"absolute","value":4378472}},{"address":{"type":"absolute","value":4378524}},{"address":{"type":"absolute","value":4378558}},{"address":{"type":"absolute","value":4378578}},{"address":{"type":"absolute","value":4378616}},{"address":{"type":"absolute","value":4378694}}]},{"address":{"type":"absolute","value":4303275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365504}}]},{"address":{"type":"absolute","value":4303280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469600}}]},{"address":{"type":"absolute","value":4303290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471696}}]},{"address":{"type":"absolute","value":4303295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486416}},{"address":{"type":"absolute","value":4486532}}]},{"address":{"type":"absolute","value":4303305},"matched_basic_blocks":[{"address":{"type":"absolute","value":4439712}},{"address":{"type":"absolute","value":4439811}},{"address":{"type":"absolute","value":4439860}},{"address":{"type":"absolute","value":4439882}}]},{"address":{"type":"absolute","value":4303310},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363312}}]},{"address":{"type":"absolute","value":4303320},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395109}},{"address":{"type":"absolute","value":4395126}},{"address":{"type":"absolute","value":4395154}}]},{"address":{"type":"absolute","value":4303325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455520}}]},{"address":{"type":"absolute","value":4303330},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500112}},{"address":{"type":"absolute","value":4500221}}]},{"address":{"type":"absolute","value":4303335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464336}}]},{"address":{"type":"absolute","value":4303340},"matched_basic_blocks":[{"address":{"type":"absolute","value":4478688}},{"address":{"type":"absolute","value":4478762}},{"address":{"type":"absolute","value":4478807}}]},{"address":{"type":"absolute","value":4303355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392944}},{"address":{"type":"absolute","value":4393019}},{"address":{"type":"absolute","value":4393067}},{"address":{"type":"absolute","value":4393115}}]},{"address":{"type":"absolute","value":4303365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466768}}]},{"address":{"type":"absolute","value":4303375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496682}}]},{"address":{"type":"absolute","value":4303380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466992}}]},{"address":{"type":"absolute","value":4303385},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355728}},{"address":{"type":"absolute","value":4355795}},{"address":{"type":"absolute","value":4355906}}]},{"address":{"type":"absolute","value":4303400},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471408}}]},{"address":{"type":"absolute","value":4303410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4508112}},{"address":{"type":"absolute","value":4508157}}]},{"address":{"type":"absolute","value":4303415},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326128}},{"address":{"type":"absolute","value":4326217}},{"address":{"type":"absolute","value":4326351}}]},{"address":{"type":"absolute","value":4303420},"matched_basic_blocks":[{"address":{"type":"absolute","value":4502041}}]},{"address":{"type":"absolute","value":4303425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350816}}]},{"address":{"type":"absolute","value":4303430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4426087}},{"address":{"type":"absolute","value":4426109}},{"address":{"type":"absolute","value":4426227}},{"address":{"type":"absolute","value":4426265}},{"address":{"type":"absolute","value":4426287}}]},{"address":{"type":"absolute","value":4303450},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469840}}]},{"address":{"type":"absolute","value":4303455},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360496}}]},{"address":{"type":"absolute","value":4303460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460912}},{"address":{"type":"absolute","value":4460960}},{"address":{"type":"absolute","value":4461024}},{"address":{"type":"absolute","value":4461072}},{"address":{"type":"absolute","value":4461120}}]},{"address":{"type":"absolute","value":4303470},"matched_basic_blocks":[{"address":{"type":"absolute","value":4454424}},{"address":{"type":"absolute","value":4454473}},{"address":{"type":"absolute","value":4454529}},{"address":{"type":"absolute","value":4454542}}]},{"address":{"type":"absolute","value":4303475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354368}},{"address":{"type":"absolute","value":4354437}},{"address":{"type":"absolute","value":4354455}}]},{"address":{"type":"absolute","value":4303480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455664}}]},{"address":{"type":"absolute","value":4303485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334976}}]},{"address":{"type":"absolute","value":4303490},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493744}},{"address":{"type":"absolute","value":4493940}},{"address":{"type":"absolute","value":4494023}}]},{"address":{"type":"absolute","value":4303495},"matched_basic_blocks":[{"address":{"type":"absolute","value":4495216}},{"address":{"type":"absolute","value":4495325}},{"address":{"type":"absolute","value":4495358}}]},{"address":{"type":"absolute","value":4303505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4372176}},{"address":{"type":"absolute","value":4372261}},{"address":{"type":"absolute","value":4372285}},{"address":{"type":"absolute","value":4372302}},{"address":{"type":"absolute","value":4372317}},{"address":{"type":"absolute","value":4372330}},{"address":{"type":"absolute","value":4372432}},{"address":{"type":"absolute","value":4372549}},{"address":{"type":"absolute","value":4372570}},{"address":{"type":"absolute","value":4372661}},{"address":{"type":"absolute","value":4372700}},{"address":{"type":"absolute","value":4372720}},{"address":{"type":"absolute","value":4372741}},{"address":{"type":"absolute","value":4372799}}]},{"address":{"type":"absolute","value":4303510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4407312}},{"address":{"type":"absolute","value":4407445}},{"address":{"type":"absolute","value":4407626}},{"address":{"type":"absolute","value":4407894}}]},{"address":{"type":"absolute","value":4303520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355344}}]},{"address":{"type":"absolute","value":4303525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471904}}]},{"address":{"type":"absolute","value":4303530},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388880}}]},{"address":{"type":"absolute","value":4303535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392736}}]},{"address":{"type":"absolute","value":4303540},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394672}},{"address":{"type":"absolute","value":4394740}}]},{"address":{"type":"absolute","value":4303550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4501044}},{"address":{"type":"absolute","value":4501051}}]},{"address":{"type":"absolute","value":4303555},"matched_basic_blocks":[{"address":{"type":"absolute","value":4435731}},{"address":{"type":"absolute","value":4435753}},{"address":{"type":"absolute","value":4435846}},{"address":{"type":"absolute","value":4435865}},{"address":{"type":"absolute","value":4435887}}]},{"address":{"type":"absolute","value":4303575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490480}}]},{"address":{"type":"absolute","value":4303580},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343184}}]},{"address":{"type":"absolute","value":4303585},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452768}}]},{"address":{"type":"absolute","value":4303595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342176}},{"address":{"type":"absolute","value":4342257}},{"address":{"type":"absolute","value":4342284}}]},{"address":{"type":"absolute","value":4303615},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388752}}]},{"address":{"type":"absolute","value":4303620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347355}},{"address":{"type":"absolute","value":4347380}},{"address":{"type":"absolute","value":4347403}}]},{"address":{"type":"absolute","value":4303635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384976}}]},{"address":{"type":"absolute","value":4303640},"matched_basic_blocks":[{"address":{"type":"absolute","value":4335312}}]},{"address":{"type":"absolute","value":4303645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4437184}},{"address":{"type":"absolute","value":4437258}}]},{"address":{"type":"absolute","value":4303655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388368}}]},{"address":{"type":"absolute","value":4303660},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364080}}]},{"address":{"type":"absolute","value":4303665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483536}}]},{"address":{"type":"absolute","value":4303675},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456672}}]},{"address":{"type":"absolute","value":4303680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336736}}]},{"address":{"type":"absolute","value":4303690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349840}}]},{"address":{"type":"absolute","value":4303700},"matched_basic_blocks":[{"address":{"type":"absolute","value":4378880}},{"address":{"type":"absolute","value":4379005}}]},{"address":{"type":"absolute","value":4303710},"matched_basic_blocks":[{"address":{"type":"absolute","value":4494208}},{"address":{"type":"absolute","value":4494371}},{"address":{"type":"absolute","value":4494444}}]},{"address":{"type":"absolute","value":4303720},"matched_basic_blocks":[{"address":{"type":"absolute","value":4412864}},{"address":{"type":"absolute","value":4412935}}]},{"address":{"type":"absolute","value":4303725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452176}}]},{"address":{"type":"absolute","value":4303735},"matched_basic_blocks":[{"address":{"type":"absolute","value":4330784}},{"address":{"type":"absolute","value":4330984}},{"address":{"type":"absolute","value":4331085}}]},{"address":{"type":"absolute","value":4303745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404624}},{"address":{"type":"absolute","value":4404750}},{"address":{"type":"absolute","value":4404856}},{"address":{"type":"absolute","value":4404987}}]},{"address":{"type":"absolute","value":4303755},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469760}}]},{"address":{"type":"absolute","value":4303765},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343040}}]},{"address":{"type":"absolute","value":4303770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350896}},{"address":{"type":"absolute","value":4350980}},{"address":{"type":"absolute","value":4351001}}]},{"address":{"type":"absolute","value":4303775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4415520}},{"address":{"type":"absolute","value":4415594}},{"address":{"type":"absolute","value":4415657}}]},{"address":{"type":"absolute","value":4303780},"matched_basic_blocks":[{"address":{"type":"absolute","value":4397280}},{"address":{"type":"absolute","value":4397382}},{"address":{"type":"absolute","value":4397419}},{"address":{"type":"absolute","value":4397457}},{"address":{"type":"absolute","value":4397547}},{"address":{"type":"absolute","value":4397607}},{"address":{"type":"absolute","value":4397662}},{"address":{"type":"absolute","value":4397723}},{"address":{"type":"absolute","value":4397787}},{"address":{"type":"absolute","value":4397839}},{"address":{"type":"absolute","value":4397866}},{"address":{"type":"absolute","value":4397902}},{"address":{"type":"absolute","value":4397935}},{"address":{"type":"absolute","value":4397984}},{"address":{"type":"absolute","value":4398061}},{"address":{"type":"absolute","value":4398129}}]},{"address":{"type":"absolute","value":4303790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470976}}]},{"address":{"type":"absolute","value":4303795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4382032}},{"address":{"type":"absolute","value":4382113}},{"address":{"type":"absolute","value":4382140}}]},{"address":{"type":"absolute","value":4303800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453344}}]},{"address":{"type":"absolute","value":4303805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345280}}]},{"address":{"type":"absolute","value":4303815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338720}}]},{"address":{"type":"absolute","value":4303820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358528}}]},{"address":{"type":"absolute","value":4303825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4331328}},{"address":{"type":"absolute","value":4331454}}]},{"address":{"type":"absolute","value":4303830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500928}}]},{"address":{"type":"absolute","value":4303835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319840}}]},{"address":{"type":"absolute","value":4303840},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355456}}]},{"address":{"type":"absolute","value":4303845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498832}}]},{"address":{"type":"absolute","value":4303860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359248}}]},{"address":{"type":"absolute","value":4303865},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487296}}]},{"address":{"type":"absolute","value":4303875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496693}}]},{"address":{"type":"absolute","value":4303880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4422432}},{"address":{"type":"absolute","value":4422617}},{"address":{"type":"absolute","value":4422677}},{"address":{"type":"absolute","value":4422715}},{"address":{"type":"absolute","value":4422793}},{"address":{"type":"absolute","value":4422848}},{"address":{"type":"absolute","value":4422882}},{"address":{"type":"absolute","value":4422900}}]},{"address":{"type":"absolute","value":4303890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490832}}]},{"address":{"type":"absolute","value":4303895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4389744}}]},{"address":{"type":"absolute","value":4303905},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500832}}]},{"address":{"type":"absolute","value":4303910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4368480}}]},{"address":{"type":"absolute","value":4303915},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456784}}]},{"address":{"type":"absolute","value":4303920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343328}},{"address":{"type":"absolute","value":4343415}},{"address":{"type":"absolute","value":4343512}}]},{"address":{"type":"absolute","value":4303925},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395711}},{"address":{"type":"absolute","value":4395785}},{"address":{"type":"absolute","value":4396000}}]},{"address":{"type":"absolute","value":4303930},"matched_basic_blocks":[{"address":{"type":"absolute","value":4324896}},{"address":{"type":"absolute","value":4325016}}]},{"address":{"type":"absolute","value":4303935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363232}}]},{"address":{"type":"absolute","value":4303950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4341616}},{"address":{"type":"absolute","value":4341716}},{"address":{"type":"absolute","value":4341768}},{"address":{"type":"absolute","value":4341852}},{"address":{"type":"absolute","value":4341904}},{"address":{"type":"absolute","value":4341956}}]},{"address":{"type":"absolute","value":4303955},"matched_basic_blocks":[{"address":{"type":"absolute","value":4369171}},{"address":{"type":"absolute","value":4369185}}]},{"address":{"type":"absolute","value":4303960},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387856}}]},{"address":{"type":"absolute","value":4303965},"matched_basic_blocks":[{"address":{"type":"absolute","value":4385264}}]},{"address":{"type":"absolute","value":4303970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353520}}]},{"address":{"type":"absolute","value":4303985},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347712}}]},{"address":{"type":"absolute","value":4303990},"matched_basic_blocks":[{"address":{"type":"absolute","value":4362160}},{"address":{"type":"absolute","value":4362335}},{"address":{"type":"absolute","value":4362672}}]},{"address":{"type":"absolute","value":4304000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452480}}]},{"address":{"type":"absolute","value":4304020},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455280}}]},{"address":{"type":"absolute","value":4304030},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500624}},{"address":{"type":"absolute","value":4500644}},{"address":{"type":"absolute","value":4500682}}]},{"address":{"type":"absolute","value":4304045},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393728}}]},{"address":{"type":"absolute","value":4304060},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359920}}]},{"address":{"type":"absolute","value":4304070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498240}},{"address":{"type":"absolute","value":4498261}},{"address":{"type":"absolute","value":4498290}},{"address":{"type":"absolute","value":4498308}},{"address":{"type":"absolute","value":4498324}}]},{"address":{"type":"absolute","value":4304075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366656}}]},{"address":{"type":"absolute","value":4304080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390128}}]},{"address":{"type":"absolute","value":4304085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4420032}}]},{"address":{"type":"absolute","value":4304090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4420544}},{"address":{"type":"absolute","value":4420637}},{"address":{"type":"absolute","value":4420692}},{"address":{"type":"absolute","value":4420734}},{"address":{"type":"absolute","value":4420755}},{"address":{"type":"absolute","value":4420798}},{"address":{"type":"absolute","value":4420847}},{"address":{"type":"absolute","value":4420882}},{"address":{"type":"absolute","value":4420909}},{"address":{"type":"absolute","value":4420934}}]},{"address":{"type":"absolute","value":4304095},"matched_basic_blocks":[{"address":{"type":"absolute","value":4440156}},{"address":{"type":"absolute","value":4440178}},{"address":{"type":"absolute","value":4440288}},{"address":{"type":"absolute","value":4440307}},{"address":{"type":"absolute","value":4440329}}]},{"address":{"type":"absolute","value":4304100},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384832}}]},{"address":{"type":"absolute","value":4304105},"matched_basic_blocks":[{"address":{"type":"absolute","value":4408405}},{"address":{"type":"absolute","value":4408516}},{"address":{"type":"absolute","value":4408703}},{"address":{"type":"absolute","value":4408813}},{"address":{"type":"absolute","value":4408848}},{"address":{"type":"absolute","value":4408909}},{"address":{"type":"absolute","value":4408955}},{"address":{"type":"absolute","value":4409004}},{"address":{"type":"absolute","value":4409132}},{"address":{"type":"absolute","value":4409176}},{"address":{"type":"absolute","value":4409288}}]},{"address":{"type":"absolute","value":4304110},"matched_basic_blocks":[{"address":{"type":"absolute","value":4329792}},{"address":{"type":"absolute","value":4329942}}]},{"address":{"type":"absolute","value":4304115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356144}}]},{"address":{"type":"absolute","value":4304120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455184}}]},{"address":{"type":"absolute","value":4304125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456448}}]},{"address":{"type":"absolute","value":4304130},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387120}},{"address":{"type":"absolute","value":4387245}},{"address":{"type":"absolute","value":4387327}}]},{"address":{"type":"absolute","value":4304135},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442608}}]},{"address":{"type":"absolute","value":4304140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334176}},{"address":{"type":"absolute","value":4334225}},{"address":{"type":"absolute","value":4334245}},{"address":{"type":"absolute","value":4334261}}]},{"address":{"type":"absolute","value":4304145},"matched_basic_blocks":[{"address":{"type":"absolute","value":4396128}},{"address":{"type":"absolute","value":4396245}},{"address":{"type":"absolute","value":4396319}},{"address":{"type":"absolute","value":4396534}}]},{"address":{"type":"absolute","value":4304150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390512}}]},{"address":{"type":"absolute","value":4304155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461680}},{"address":{"type":"absolute","value":4461793}},{"address":{"type":"absolute","value":4461845}}]},{"address":{"type":"absolute","value":4304160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387424}},{"address":{"type":"absolute","value":4387636}}]},{"address":{"type":"absolute","value":4304165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404240}},{"address":{"type":"absolute","value":4404311}}]},{"address":{"type":"absolute","value":4304175},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366512}}]},{"address":{"type":"absolute","value":4304185},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359536}}]},{"address":{"type":"absolute","value":4304190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383024}}]},{"address":{"type":"absolute","value":4304195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388112}}]},{"address":{"type":"absolute","value":4304205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4500570}}]},{"address":{"type":"absolute","value":4304215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358960}}]},{"address":{"type":"absolute","value":4304225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4417968}},{"address":{"type":"absolute","value":4418097}},{"address":{"type":"absolute","value":4418231}},{"address":{"type":"absolute","value":4418498}}]},{"address":{"type":"absolute","value":4304235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467504}}]},{"address":{"type":"absolute","value":4304240},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354096}},{"address":{"type":"absolute","value":4354172}}]},{"address":{"type":"absolute","value":4304250},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492144}}]},{"address":{"type":"absolute","value":4304265},"matched_basic_blocks":[{"address":{"type":"absolute","value":4463632}}]},{"address":{"type":"absolute","value":4304270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509104}}]},{"address":{"type":"absolute","value":4304275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482864}},{"address":{"type":"absolute","value":4482958}},{"address":{"type":"absolute","value":4483013}}]},{"address":{"type":"absolute","value":4304280},"matched_basic_blocks":[{"address":{"type":"absolute","value":4458224}},{"address":{"type":"absolute","value":4458607}}]},{"address":{"type":"absolute","value":4304300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491696}},{"address":{"type":"absolute","value":4491794}}]},{"address":{"type":"absolute","value":4304310},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359664}}]},{"address":{"type":"absolute","value":4304315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4424896}},{"address":{"type":"absolute","value":4425015}},{"address":{"type":"absolute","value":4425156}},{"address":{"type":"absolute","value":4425244}},{"address":{"type":"absolute","value":4425265}},{"address":{"type":"absolute","value":4425282}},{"address":{"type":"absolute","value":4425303}},{"address":{"type":"absolute","value":4425320}},{"address":{"type":"absolute","value":4425341}},{"address":{"type":"absolute","value":4425512}}]},{"address":{"type":"absolute","value":4304325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481280}},{"address":{"type":"absolute","value":4481385}}]},{"address":{"type":"absolute","value":4304330},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359392}}]},{"address":{"type":"absolute","value":4304335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349344}}]},{"address":{"type":"absolute","value":4304340},"matched_basic_blocks":[{"address":{"type":"absolute","value":4328736}},{"address":{"type":"absolute","value":4328826}},{"address":{"type":"absolute","value":4328983}}]},{"address":{"type":"absolute","value":4304350},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506327}}]},{"address":{"type":"absolute","value":4304360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4512768}},{"address":{"type":"absolute","value":4512817}}]},{"address":{"type":"absolute","value":4304365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364640}},{"address":{"type":"absolute","value":4364713}},{"address":{"type":"absolute","value":4364736}},{"address":{"type":"absolute","value":4364766}}]},{"address":{"type":"absolute","value":4304370},"matched_basic_blocks":[{"address":{"type":"absolute","value":4304370}},{"address":{"type":"absolute","value":4496937}}]},{"address":{"type":"absolute","value":4304375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503360}}]},{"address":{"type":"absolute","value":4304380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492672}}]},{"address":{"type":"absolute","value":4304385},"matched_basic_blocks":[{"address":{"type":"absolute","value":4483408}}]},{"address":{"type":"absolute","value":4304390},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337344}}]},{"address":{"type":"absolute","value":4304395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366800}}]},{"address":{"type":"absolute","value":4304400},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351072}}]},{"address":{"type":"absolute","value":4304405},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393616}}]},{"address":{"type":"absolute","value":4304410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402144}}]},{"address":{"type":"absolute","value":4304430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391264}}]},{"address":{"type":"absolute","value":4304440},"matched_basic_blocks":[{"address":{"type":"absolute","value":4441149}},{"address":{"type":"absolute","value":4441171}},{"address":{"type":"absolute","value":4441327}},{"address":{"type":"absolute","value":4441346}},{"address":{"type":"absolute","value":4441368}}]},{"address":{"type":"absolute","value":4304445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337008}}]},{"address":{"type":"absolute","value":4304460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4505472}}]},{"address":{"type":"absolute","value":4304465},"matched_basic_blocks":[{"address":{"type":"absolute","value":4479728}},{"address":{"type":"absolute","value":4479847}},{"address":{"type":"absolute","value":4479868}},{"address":{"type":"absolute","value":4479970}},{"address":{"type":"absolute","value":4479985}},{"address":{"type":"absolute","value":4480020}}]},{"address":{"type":"absolute","value":4304470},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496670}}]},{"address":{"type":"absolute","value":4304475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395536}}]},{"address":{"type":"absolute","value":4304480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496673}},{"address":{"type":"absolute","value":4496679}}]},{"address":{"type":"absolute","value":4304490},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472112}},{"address":{"type":"absolute","value":4472276}},{"address":{"type":"absolute","value":4472415}}]},{"address":{"type":"absolute","value":4304500},"matched_basic_blocks":[{"address":{"type":"absolute","value":4352736}}]},{"address":{"type":"absolute","value":4304505},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356304}}]},{"address":{"type":"absolute","value":4304520},"matched_basic_blocks":[{"address":{"type":"absolute","value":4410192}},{"address":{"type":"absolute","value":4410324}},{"address":{"type":"absolute","value":4410411}},{"address":{"type":"absolute","value":4410441}},{"address":{"type":"absolute","value":4410511}},{"address":{"type":"absolute","value":4410530}},{"address":{"type":"absolute","value":4410552}},{"address":{"type":"absolute","value":4410627}},{"address":{"type":"absolute","value":4410654}},{"address":{"type":"absolute","value":4410681}},{"address":{"type":"absolute","value":4410697}},{"address":{"type":"absolute","value":4410716}},{"address":{"type":"absolute","value":4410733}}]},{"address":{"type":"absolute","value":4304535},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509456}}]},{"address":{"type":"absolute","value":4304540},"matched_basic_blocks":[{"address":{"type":"absolute","value":4319984}},{"address":{"type":"absolute","value":4320206}},{"address":{"type":"absolute","value":4320236}},{"address":{"type":"absolute","value":4320295}},{"address":{"type":"absolute","value":4320984}},{"address":{"type":"absolute","value":4321151}},{"address":{"type":"absolute","value":4321886}},{"address":{"type":"absolute","value":4322182}},{"address":{"type":"absolute","value":4322298}},{"address":{"type":"absolute","value":4322327}},{"address":{"type":"absolute","value":4322392}},{"address":{"type":"absolute","value":4322434}},{"address":{"type":"absolute","value":4322476}},{"address":{"type":"absolute","value":4322564}},{"address":{"type":"absolute","value":4322877}},{"address":{"type":"absolute","value":4322904}},{"address":{"type":"absolute","value":4323003}},{"address":{"type":"absolute","value":4323026}}]},{"address":{"type":"absolute","value":4304545},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327184}}]},{"address":{"type":"absolute","value":4304550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4436080}},{"address":{"type":"absolute","value":4436193}}]},{"address":{"type":"absolute","value":4304570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462352}},{"address":{"type":"absolute","value":4462425}},{"address":{"type":"absolute","value":4462441}}]},{"address":{"type":"absolute","value":4304595},"matched_basic_blocks":[{"address":{"type":"absolute","value":4397104}}]},{"address":{"type":"absolute","value":4304605},"matched_basic_blocks":[{"address":{"type":"absolute","value":4373088}},{"address":{"type":"absolute","value":4373245}},{"address":{"type":"absolute","value":4373296}},{"address":{"type":"absolute","value":4373371}},{"address":{"type":"absolute","value":4373404}},{"address":{"type":"absolute","value":4373464}},{"address":{"type":"absolute","value":4373487}},{"address":{"type":"absolute","value":4373645}},{"address":{"type":"absolute","value":4373688}},{"address":{"type":"absolute","value":4373730}},{"address":{"type":"absolute","value":4373799}},{"address":{"type":"absolute","value":4373832}},{"address":{"type":"absolute","value":4373981}},{"address":{"type":"absolute","value":4374024}},{"address":{"type":"absolute","value":4374044}},{"address":{"type":"absolute","value":4374062}},{"address":{"type":"absolute","value":4374089}},{"address":{"type":"absolute","value":4374159}},{"address":{"type":"absolute","value":4374321}}]},{"address":{"type":"absolute","value":4304610},"matched_basic_blocks":[{"address":{"type":"absolute","value":4462832}}]},{"address":{"type":"absolute","value":4304620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325232}},{"address":{"type":"absolute","value":4325315}}]},{"address":{"type":"absolute","value":4304625},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401024}},{"address":{"type":"absolute","value":4401081}},{"address":{"type":"absolute","value":4401144}}]},{"address":{"type":"absolute","value":4304630},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457904}},{"address":{"type":"absolute","value":4457997}}]},{"address":{"type":"absolute","value":4304635},"matched_basic_blocks":[{"address":{"type":"absolute","value":4414368}},{"address":{"type":"absolute","value":4414487}},{"address":{"type":"absolute","value":4414651}},{"address":{"type":"absolute","value":4414803}}]},{"address":{"type":"absolute","value":4304645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4405280}},{"address":{"type":"absolute","value":4405496}},{"address":{"type":"absolute","value":4405530}},{"address":{"type":"absolute","value":4405551}},{"address":{"type":"absolute","value":4405613}},{"address":{"type":"absolute","value":4405664}}]},{"address":{"type":"absolute","value":4304660},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453056}}]},{"address":{"type":"absolute","value":4304665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487136}}]},{"address":{"type":"absolute","value":4304670},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498473}}]},{"address":{"type":"absolute","value":4304685},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393952}},{"address":{"type":"absolute","value":4394059}}]},{"address":{"type":"absolute","value":4304690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4397008}}]},{"address":{"type":"absolute","value":4304705},"matched_basic_blocks":[{"address":{"type":"absolute","value":4338288}}]},{"address":{"type":"absolute","value":4304715},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337616}}]},{"address":{"type":"absolute","value":4304725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498740}},{"address":{"type":"absolute","value":4498766}}]},{"address":{"type":"absolute","value":4304735},"matched_basic_blocks":[{"address":{"type":"absolute","value":4324470}},{"address":{"type":"absolute","value":4324504}},{"address":{"type":"absolute","value":4324604}},{"address":{"type":"absolute","value":4324623}},{"address":{"type":"absolute","value":4324645}}]},{"address":{"type":"absolute","value":4304740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4442267}},{"address":{"type":"absolute","value":4442289}},{"address":{"type":"absolute","value":4442382}},{"address":{"type":"absolute","value":4442401}},{"address":{"type":"absolute","value":4442423}}]},{"address":{"type":"absolute","value":4304745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452384}}]},{"address":{"type":"absolute","value":4304750},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344976}}]},{"address":{"type":"absolute","value":4304770},"matched_basic_blocks":[{"address":{"type":"absolute","value":4507625}},{"address":{"type":"absolute","value":4507895}}]},{"address":{"type":"absolute","value":4304775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325872}},{"address":{"type":"absolute","value":4326043}}]},{"address":{"type":"absolute","value":4304780},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467632}}]},{"address":{"type":"absolute","value":4304785},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394272}},{"address":{"type":"absolute","value":4394387}},{"address":{"type":"absolute","value":4394488}}]},{"address":{"type":"absolute","value":4304790},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350048}}]},{"address":{"type":"absolute","value":4304795},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357968}}]},{"address":{"type":"absolute","value":4304805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4407024}},{"address":{"type":"absolute","value":4407165}}]},{"address":{"type":"absolute","value":4304810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453152}}]},{"address":{"type":"absolute","value":4304830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4333744}}]},{"address":{"type":"absolute","value":4304835},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383280}}]},{"address":{"type":"absolute","value":4304845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4487456}},{"address":{"type":"absolute","value":4487567}},{"address":{"type":"absolute","value":4487707}},{"address":{"type":"absolute","value":4487774}},{"address":{"type":"absolute","value":4487834}},{"address":{"type":"absolute","value":4487914}}]},{"address":{"type":"absolute","value":4304850},"matched_basic_blocks":[{"address":{"type":"absolute","value":4357456}}]},{"address":{"type":"absolute","value":4304860},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334784}},{"address":{"type":"absolute","value":4334864}},{"address":{"type":"absolute","value":4334880}}]},{"address":{"type":"absolute","value":4304870},"matched_basic_blocks":[{"address":{"type":"absolute","value":4495872}},{"address":{"type":"absolute","value":4495944}},{"address":{"type":"absolute","value":4495964}},{"address":{"type":"absolute","value":4495992}}]},{"address":{"type":"absolute","value":4304875},"matched_basic_blocks":[{"address":{"type":"absolute","value":4360272}}]},{"address":{"type":"absolute","value":4304880},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337888}}]},{"address":{"type":"absolute","value":4304890},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401200}},{"address":{"type":"absolute","value":4401257}},{"address":{"type":"absolute","value":4401320}}]},{"address":{"type":"absolute","value":4304895},"matched_basic_blocks":[{"address":{"type":"absolute","value":4508544}}]},{"address":{"type":"absolute","value":4304900},"matched_basic_blocks":[{"address":{"type":"absolute","value":4334000}}]},{"address":{"type":"absolute","value":4304910},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366944}}]},{"address":{"type":"absolute","value":4304920},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336384}},{"address":{"type":"absolute","value":4336487}}]},{"address":{"type":"absolute","value":4304930},"matched_basic_blocks":[{"address":{"type":"absolute","value":4366080}}]},{"address":{"type":"absolute","value":4304935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351168}}]},{"address":{"type":"absolute","value":4304940},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401472}}]},{"address":{"type":"absolute","value":4304945},"matched_basic_blocks":[{"address":{"type":"absolute","value":4421563}},{"address":{"type":"absolute","value":4421585}},{"address":{"type":"absolute","value":4421673}},{"address":{"type":"absolute","value":4421692}},{"address":{"type":"absolute","value":4421714}}]},{"address":{"type":"absolute","value":4304950},"matched_basic_blocks":[{"address":{"type":"absolute","value":4367872}}]},{"address":{"type":"absolute","value":4304965},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348368}},{"address":{"type":"absolute","value":4348441}},{"address":{"type":"absolute","value":4348566}},{"address":{"type":"absolute","value":4348599}},{"address":{"type":"absolute","value":4348631}}]},{"address":{"type":"absolute","value":4304970},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364336}}]},{"address":{"type":"absolute","value":4304975},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361440}},{"address":{"type":"absolute","value":4361603}},{"address":{"type":"absolute","value":4361942}}]},{"address":{"type":"absolute","value":4304980},"matched_basic_blocks":[{"address":{"type":"absolute","value":4365216}}]},{"address":{"type":"absolute","value":4304995},"matched_basic_blocks":[{"address":{"type":"absolute","value":4330096}},{"address":{"type":"absolute","value":4330314}},{"address":{"type":"absolute","value":4330346}},{"address":{"type":"absolute","value":4330478}},{"address":{"type":"absolute","value":4330517}},{"address":{"type":"absolute","value":4330565}}]},{"address":{"type":"absolute","value":4305005},"matched_basic_blocks":[{"address":{"type":"absolute","value":4381168}},{"address":{"type":"absolute","value":4381309}},{"address":{"type":"absolute","value":4381359}},{"address":{"type":"absolute","value":4381459}},{"address":{"type":"absolute","value":4381486}}]},{"address":{"type":"absolute","value":4305010},"matched_basic_blocks":[{"address":{"type":"absolute","value":4393280}},{"address":{"type":"absolute","value":4393355}},{"address":{"type":"absolute","value":4393403}},{"address":{"type":"absolute","value":4393451}}]},{"address":{"type":"absolute","value":4305025},"matched_basic_blocks":[{"address":{"type":"absolute","value":4456576}}]},{"address":{"type":"absolute","value":4305040},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358816}}]},{"address":{"type":"absolute","value":4305045},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471552}}]},{"address":{"type":"absolute","value":4305050},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492352}}]},{"address":{"type":"absolute","value":4305055},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390608}}]},{"address":{"type":"absolute","value":4305065},"matched_basic_blocks":[{"address":{"type":"absolute","value":4421136}},{"address":{"type":"absolute","value":4421228}},{"address":{"type":"absolute","value":4421277}},{"address":{"type":"absolute","value":4421312}},{"address":{"type":"absolute","value":4421334}}]},{"address":{"type":"absolute","value":4305070},"matched_basic_blocks":[{"address":{"type":"absolute","value":4348176}},{"address":{"type":"absolute","value":4348279}}]},{"address":{"type":"absolute","value":4305075},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364480}}]},{"address":{"type":"absolute","value":4305080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457312}}]},{"address":{"type":"absolute","value":4305085},"matched_basic_blocks":[{"address":{"type":"absolute","value":4343680}},{"address":{"type":"absolute","value":4343801}},{"address":{"type":"absolute","value":4343840}}]},{"address":{"type":"absolute","value":4305090},"matched_basic_blocks":[{"address":{"type":"absolute","value":4345776}}]},{"address":{"type":"absolute","value":4305115},"matched_basic_blocks":[{"address":{"type":"absolute","value":4484720}},{"address":{"type":"absolute","value":4484841}},{"address":{"type":"absolute","value":4484880}}]},{"address":{"type":"absolute","value":4305120},"matched_basic_blocks":[{"address":{"type":"absolute","value":4479264}},{"address":{"type":"absolute","value":4479513}}]},{"address":{"type":"absolute","value":4305125},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371888}}]},{"address":{"type":"absolute","value":4305140},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391664}}]},{"address":{"type":"absolute","value":4305145},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452960}}]},{"address":{"type":"absolute","value":4305150},"matched_basic_blocks":[{"address":{"type":"absolute","value":4460080}},{"address":{"type":"absolute","value":4460189}}]},{"address":{"type":"absolute","value":4305155},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486096}}]},{"address":{"type":"absolute","value":4305160},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404496}},{"address":{"type":"absolute","value":4404567}}]},{"address":{"type":"absolute","value":4305165},"matched_basic_blocks":[{"address":{"type":"absolute","value":4461920}}]},{"address":{"type":"absolute","value":4305185},"matched_basic_blocks":[{"address":{"type":"absolute","value":4354782}},{"address":{"type":"absolute","value":4354852}}]},{"address":{"type":"absolute","value":4305190},"matched_basic_blocks":[{"address":{"type":"absolute","value":4395330}},{"address":{"type":"absolute","value":4395444}}]},{"address":{"type":"absolute","value":4305195},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493160}},{"address":{"type":"absolute","value":4493175}},{"address":{"type":"absolute","value":4493263}}]},{"address":{"type":"absolute","value":4305205},"matched_basic_blocks":[{"address":{"type":"absolute","value":4384112}}]},{"address":{"type":"absolute","value":4305220},"matched_basic_blocks":[{"address":{"type":"absolute","value":4329072}},{"address":{"type":"absolute","value":4329213}}]},{"address":{"type":"absolute","value":4305225},"matched_basic_blocks":[{"address":{"type":"absolute","value":4353376}}]},{"address":{"type":"absolute","value":4305230},"matched_basic_blocks":[{"address":{"type":"absolute","value":4331600}},{"address":{"type":"absolute","value":4331908}}]},{"address":{"type":"absolute","value":4305235},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401872}}]},{"address":{"type":"absolute","value":4305250},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347600}}]},{"address":{"type":"absolute","value":4305255},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337472}}]},{"address":{"type":"absolute","value":4305260},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4305270},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455760}}]},{"address":{"type":"absolute","value":4305275},"matched_basic_blocks":[{"address":{"type":"absolute","value":4410064}},{"address":{"type":"absolute","value":4410136}}]},{"address":{"type":"absolute","value":4305285},"matched_basic_blocks":[{"address":{"type":"absolute","value":4342624}}]},{"address":{"type":"absolute","value":4305290},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464672}}]},{"address":{"type":"absolute","value":4305295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4480832}},{"address":{"type":"absolute","value":4480949}}]},{"address":{"type":"absolute","value":4305300},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356576}}]},{"address":{"type":"absolute","value":4305315},"matched_basic_blocks":[{"address":{"type":"absolute","value":4374784}},{"address":{"type":"absolute","value":4374858}},{"address":{"type":"absolute","value":4374979}},{"address":{"type":"absolute","value":4375086}},{"address":{"type":"absolute","value":4375103}},{"address":{"type":"absolute","value":4375245}}]},{"address":{"type":"absolute","value":4305325},"matched_basic_blocks":[{"address":{"type":"absolute","value":4347168}},{"address":{"type":"absolute","value":4347242}}]},{"address":{"type":"absolute","value":4305330},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459909}},{"address":{"type":"absolute","value":4459957}},{"address":{"type":"absolute","value":4460005}}]},{"address":{"type":"absolute","value":4305335},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349488}}]},{"address":{"type":"absolute","value":4305345},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325088}}]},{"address":{"type":"absolute","value":4305350},"matched_basic_blocks":[{"address":{"type":"absolute","value":4488976}},{"address":{"type":"absolute","value":4489038}},{"address":{"type":"absolute","value":4489075}}]},{"address":{"type":"absolute","value":4305355},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467360}}]},{"address":{"type":"absolute","value":4305360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4375622}},{"address":{"type":"absolute","value":4375684}},{"address":{"type":"absolute","value":4375761}},{"address":{"type":"absolute","value":4375907}},{"address":{"type":"absolute","value":4376003}},{"address":{"type":"absolute","value":4376023}},{"address":{"type":"absolute","value":4376083}},{"address":{"type":"absolute","value":4376194}},{"address":{"type":"absolute","value":4376216}},{"address":{"type":"absolute","value":4376378}}]},{"address":{"type":"absolute","value":4305365},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355248}}]},{"address":{"type":"absolute","value":4305375},"matched_basic_blocks":[{"address":{"type":"absolute","value":4359792}}]},{"address":{"type":"absolute","value":4305380},"matched_basic_blocks":[{"address":{"type":"absolute","value":4349616}}]},{"address":{"type":"absolute","value":4305390},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383408}}]},{"address":{"type":"absolute","value":4305395},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490656}}]},{"address":{"type":"absolute","value":4305405},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392176}}]},{"address":{"type":"absolute","value":4305410},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506528}}]},{"address":{"type":"absolute","value":4305425},"matched_basic_blocks":[{"address":{"type":"absolute","value":4452672}}]},{"address":{"type":"absolute","value":4305430},"matched_basic_blocks":[{"address":{"type":"absolute","value":4383968}}]},{"address":{"type":"absolute","value":4305435},"matched_basic_blocks":[{"address":{"type":"absolute","value":4392032}}]},{"address":{"type":"absolute","value":4305445},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472944}},{"address":{"type":"absolute","value":4473065}},{"address":{"type":"absolute","value":4473126}},{"address":{"type":"absolute","value":4473188}},{"address":{"type":"absolute","value":4473504}},{"address":{"type":"absolute","value":4473562}},{"address":{"type":"absolute","value":4474105}},{"address":{"type":"absolute","value":4474342}},{"address":{"type":"absolute","value":4474419}},{"address":{"type":"absolute","value":4474537}},{"address":{"type":"absolute","value":4474823}},{"address":{"type":"absolute","value":4474945}},{"address":{"type":"absolute","value":4475078}}]},{"address":{"type":"absolute","value":4305460},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358304}}]},{"address":{"type":"absolute","value":4305465},"matched_basic_blocks":[{"address":{"type":"absolute","value":4387984}}]},{"address":{"type":"absolute","value":4305475},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336816}},{"address":{"type":"absolute","value":4336919}}]},{"address":{"type":"absolute","value":4305480},"matched_basic_blocks":[{"address":{"type":"absolute","value":4356960}}]},{"address":{"type":"absolute","value":4305485},"matched_basic_blocks":[{"address":{"type":"absolute","value":4400112}},{"address":{"type":"absolute","value":4400207}},{"address":{"type":"absolute","value":4400244}},{"address":{"type":"absolute","value":4400282}},{"address":{"type":"absolute","value":4400345}},{"address":{"type":"absolute","value":4400423}},{"address":{"type":"absolute","value":4400598}}]},{"address":{"type":"absolute","value":4305495},"matched_basic_blocks":[{"address":{"type":"absolute","value":4376930}},{"address":{"type":"absolute","value":4376992}},{"address":{"type":"absolute","value":4377069}},{"address":{"type":"absolute","value":4377300}},{"address":{"type":"absolute","value":4377329}},{"address":{"type":"absolute","value":4377342}},{"address":{"type":"absolute","value":4377435}},{"address":{"type":"absolute","value":4377535}},{"address":{"type":"absolute","value":4377613}},{"address":{"type":"absolute","value":4377652}},{"address":{"type":"absolute","value":4377672}},{"address":{"type":"absolute","value":4377724}},{"address":{"type":"absolute","value":4377746}},{"address":{"type":"absolute","value":4377908}}]},{"address":{"type":"absolute","value":4305500},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390720}}]},{"address":{"type":"absolute","value":4305510},"matched_basic_blocks":[{"address":{"type":"absolute","value":4344688}}]},{"address":{"type":"absolute","value":4305515},"matched_basic_blocks":[{"address":{"type":"absolute","value":4498864}}]},{"address":{"type":"absolute","value":4305525},"matched_basic_blocks":[{"address":{"type":"absolute","value":4496673}}]},{"address":{"type":"absolute","value":4305550},"matched_basic_blocks":[{"address":{"type":"absolute","value":4423856}},{"address":{"type":"absolute","value":4423975}},{"address":{"type":"absolute","value":4424165}},{"address":{"type":"absolute","value":4424339}},{"address":{"type":"absolute","value":4424506}}]},{"address":{"type":"absolute","value":4305555},"matched_basic_blocks":[{"address":{"type":"absolute","value":4419184}},{"address":{"type":"absolute","value":4419255}}]},{"address":{"type":"absolute","value":4305560},"matched_basic_blocks":[{"address":{"type":"absolute","value":4438304}},{"address":{"type":"absolute","value":4438604}},{"address":{"type":"absolute","value":4438635}},{"address":{"type":"absolute","value":4438761}},{"address":{"type":"absolute","value":4438780}},{"address":{"type":"absolute","value":4438833}}]},{"address":{"type":"absolute","value":4305565},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485808}}]},{"address":{"type":"absolute","value":4305570},"matched_basic_blocks":[{"address":{"type":"absolute","value":4449920}},{"address":{"type":"absolute","value":4450064}},{"address":{"type":"absolute","value":4450116}},{"address":{"type":"absolute","value":4450165}},{"address":{"type":"absolute","value":4450253}},{"address":{"type":"absolute","value":4450276}},{"address":{"type":"absolute","value":4450328}},{"address":{"type":"absolute","value":4450351}},{"address":{"type":"absolute","value":4450426}},{"address":{"type":"absolute","value":4450449}},{"address":{"type":"absolute","value":4450618}},{"address":{"type":"absolute","value":4450641}},{"address":{"type":"absolute","value":4450707}},{"address":{"type":"absolute","value":4450866}},{"address":{"type":"absolute","value":4450881}},{"address":{"type":"absolute","value":4451017}}]},{"address":{"type":"absolute","value":4305575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4490369}},{"address":{"type":"absolute","value":4490378}},{"address":{"type":"absolute","value":4490389}},{"address":{"type":"absolute","value":4490427}}]},{"address":{"type":"absolute","value":4305580},"matched_basic_blocks":[{"address":{"type":"absolute","value":4358192}}]},{"address":{"type":"absolute","value":4305600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4458816}},{"address":{"type":"absolute","value":4458938}}]},{"address":{"type":"absolute","value":4305610},"matched_basic_blocks":[{"address":{"type":"absolute","value":4493008}}]},{"address":{"type":"absolute","value":4305620},"matched_basic_blocks":[{"address":{"type":"absolute","value":4506192}}]},{"address":{"type":"absolute","value":4305630},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485424}}]},{"address":{"type":"absolute","value":4305645},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485680}}]},{"address":{"type":"absolute","value":4305655},"matched_basic_blocks":[{"address":{"type":"absolute","value":4437792}},{"address":{"type":"absolute","value":4437988}},{"address":{"type":"absolute","value":4438016}}]},{"address":{"type":"absolute","value":4305665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4391552}}]},{"address":{"type":"absolute","value":4305675},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482688}},{"address":{"type":"absolute","value":4482769}},{"address":{"type":"absolute","value":4482796}}]},{"address":{"type":"absolute","value":4305680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4485904}}]},{"address":{"type":"absolute","value":4305685},"matched_basic_blocks":[{"address":{"type":"absolute","value":4503296}}]},{"address":{"type":"absolute","value":4305690},"matched_basic_blocks":[{"address":{"type":"absolute","value":4409968}}]},{"address":{"type":"absolute","value":4305695},"matched_basic_blocks":[{"address":{"type":"absolute","value":4463968}},{"address":{"type":"absolute","value":4464072}},{"address":{"type":"absolute","value":4464092}}]},{"address":{"type":"absolute","value":4305700},"matched_basic_blocks":[{"address":{"type":"absolute","value":4491040}},{"address":{"type":"absolute","value":4491104}},{"address":{"type":"absolute","value":4491149}},{"address":{"type":"absolute","value":4491215}},{"address":{"type":"absolute","value":4491269}},{"address":{"type":"absolute","value":4491304}},{"address":{"type":"absolute","value":4491358}},{"address":{"type":"absolute","value":4491408}}]},{"address":{"type":"absolute","value":4305705},"matched_basic_blocks":[{"address":{"type":"absolute","value":4337696}},{"address":{"type":"absolute","value":4337769}},{"address":{"type":"absolute","value":4337792}},{"address":{"type":"absolute","value":4337822}}]},{"address":{"type":"absolute","value":4305715},"matched_basic_blocks":[{"address":{"type":"absolute","value":4386192}},{"address":{"type":"absolute","value":4386313}},{"address":{"type":"absolute","value":4386352}}]},{"address":{"type":"absolute","value":4305720},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486192}}]},{"address":{"type":"absolute","value":4305725},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464224}}]},{"address":{"type":"absolute","value":4305730},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486304}}]},{"address":{"type":"absolute","value":4305735},"matched_basic_blocks":[{"address":{"type":"absolute","value":4364208}}]},{"address":{"type":"absolute","value":4305740},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464784}},{"address":{"type":"absolute","value":4464907}}]},{"address":{"type":"absolute","value":4305745},"matched_basic_blocks":[{"address":{"type":"absolute","value":4388624}}]},{"address":{"type":"absolute","value":4305765},"matched_basic_blocks":[{"address":{"type":"absolute","value":4451456}},{"address":{"type":"absolute","value":4451556}},{"address":{"type":"absolute","value":4451613}},{"address":{"type":"absolute","value":4451723}},{"address":{"type":"absolute","value":4451743}},{"address":{"type":"absolute","value":4451798}},{"address":{"type":"absolute","value":4451815}},{"address":{"type":"absolute","value":4451888}},{"address":{"type":"absolute","value":4451905}},{"address":{"type":"absolute","value":4451923}}]},{"address":{"type":"absolute","value":4305775},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509200}}]},{"address":{"type":"absolute","value":4305800},"matched_basic_blocks":[{"address":{"type":"absolute","value":4390224}}]},{"address":{"type":"absolute","value":4305805},"matched_basic_blocks":[{"address":{"type":"absolute","value":4355600}}]},{"address":{"type":"absolute","value":4305810},"matched_basic_blocks":[{"address":{"type":"absolute","value":4492784}},{"address":{"type":"absolute","value":4492863}}]},{"address":{"type":"absolute","value":4305815},"matched_basic_blocks":[{"address":{"type":"absolute","value":4406309}},{"address":{"type":"absolute","value":4406343}},{"address":{"type":"absolute","value":4406686}}]},{"address":{"type":"absolute","value":4305820},"matched_basic_blocks":[{"address":{"type":"absolute","value":4510963}},{"address":{"type":"absolute","value":4511016}},{"address":{"type":"absolute","value":4511030}},{"address":{"type":"absolute","value":4511051}},{"address":{"type":"absolute","value":4511063}},{"address":{"type":"absolute","value":4511071}},{"address":{"type":"absolute","value":4511167}},{"address":{"type":"absolute","value":4511468}},{"address":{"type":"absolute","value":4511703}}]},{"address":{"type":"absolute","value":4305825},"matched_basic_blocks":[{"address":{"type":"absolute","value":4453248}}]},{"address":{"type":"absolute","value":4305830},"matched_basic_blocks":[{"address":{"type":"absolute","value":4404368}},{"address":{"type":"absolute","value":4404439}}]},{"address":{"type":"absolute","value":4305845},"matched_basic_blocks":[{"address":{"type":"absolute","value":4328288}},{"address":{"type":"absolute","value":4328380}},{"address":{"type":"absolute","value":4328505}},{"address":{"type":"absolute","value":4328542}}]},{"address":{"type":"absolute","value":4305850},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470832}}]},{"address":{"type":"absolute","value":4305855},"matched_basic_blocks":[{"address":{"type":"absolute","value":4363072}}]},{"address":{"type":"absolute","value":4310928},"matched_basic_blocks":[{"address":{"type":"absolute","value":4310928}}]},{"address":{"type":"absolute","value":4311056},"matched_basic_blocks":[{"address":{"type":"absolute","value":4311056}}]},{"address":{"type":"absolute","value":4311408},"matched_basic_blocks":[{"address":{"type":"absolute","value":4311408}}]},{"address":{"type":"absolute","value":4312432},"matched_basic_blocks":[{"address":{"type":"absolute","value":4312432}}]},{"address":{"type":"absolute","value":4325724},"matched_basic_blocks":[{"address":{"type":"absolute","value":4325779}}]},{"address":{"type":"absolute","value":4326006},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326043}}]},{"address":{"type":"absolute","value":4326736},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326736}},{"address":{"type":"absolute","value":4326806}}]},{"address":{"type":"absolute","value":4326864},"matched_basic_blocks":[{"address":{"type":"absolute","value":4326864}}]},{"address":{"type":"absolute","value":4327024},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327024}},{"address":{"type":"absolute","value":4327087}},{"address":{"type":"absolute","value":4327121}}]},{"address":{"type":"absolute","value":4327622},"matched_basic_blocks":[{"address":{"type":"absolute","value":4327714}}]},{"address":{"type":"absolute","value":4336159},"matched_basic_blocks":[{"address":{"type":"absolute","value":4336166}}]},{"address":{"type":"absolute","value":4361215},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361215}}]},{"address":{"type":"absolute","value":4361935},"matched_basic_blocks":[{"address":{"type":"absolute","value":4361935}}]},{"address":{"type":"absolute","value":4362665},"matched_basic_blocks":[{"address":{"type":"absolute","value":4362665}}]},{"address":{"type":"absolute","value":4371168},"matched_basic_blocks":[{"address":{"type":"absolute","value":4371168}},{"address":{"type":"absolute","value":4371256}},{"address":{"type":"absolute","value":4371299}},{"address":{"type":"absolute","value":4371378}},{"address":{"type":"absolute","value":4371412}},{"address":{"type":"absolute","value":4371552}},{"address":{"type":"absolute","value":4371642}}]},{"address":{"type":"absolute","value":4379632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379708}},{"address":{"type":"absolute","value":4379773}},{"address":{"type":"absolute","value":4379820}}]},{"address":{"type":"absolute","value":4379904},"matched_basic_blocks":[{"address":{"type":"absolute","value":4379973}},{"address":{"type":"absolute","value":4380040}}]},{"address":{"type":"absolute","value":4380112},"matched_basic_blocks":[{"address":{"type":"absolute","value":4380112}},{"address":{"type":"absolute","value":4380209}}]},{"address":{"type":"absolute","value":4380272},"matched_basic_blocks":[{"address":{"type":"absolute","value":4380272}},{"address":{"type":"absolute","value":4380340}}]},{"address":{"type":"absolute","value":4394451},"matched_basic_blocks":[{"address":{"type":"absolute","value":4394488}}]},{"address":{"type":"absolute","value":4396848},"matched_basic_blocks":[{"address":{"type":"absolute","value":4396848}},{"address":{"type":"absolute","value":4396911}},{"address":{"type":"absolute","value":4396945}}]},{"address":{"type":"absolute","value":4401568},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401568}}]},{"address":{"type":"absolute","value":4401680},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401680}}]},{"address":{"type":"absolute","value":4401776},"matched_basic_blocks":[{"address":{"type":"absolute","value":4401776}}]},{"address":{"type":"absolute","value":4402832},"matched_basic_blocks":[{"address":{"type":"absolute","value":4402832}},{"address":{"type":"absolute","value":4402951}},{"address":{"type":"absolute","value":4403360}}]},{"address":{"type":"absolute","value":4418944},"matched_basic_blocks":[{"address":{"type":"absolute","value":4419050}}]},{"address":{"type":"absolute","value":4440528},"matched_basic_blocks":[{"address":{"type":"absolute","value":4440631}},{"address":{"type":"absolute","value":4440653}},{"address":{"type":"absolute","value":4440741}},{"address":{"type":"absolute","value":4440760}},{"address":{"type":"absolute","value":4440782}}]},{"address":{"type":"absolute","value":4455904},"matched_basic_blocks":[{"address":{"type":"absolute","value":4455904}},{"address":{"type":"absolute","value":4456043}},{"address":{"type":"absolute","value":4456060}},{"address":{"type":"absolute","value":4456086}}]},{"address":{"type":"absolute","value":4458064},"matched_basic_blocks":[{"address":{"type":"absolute","value":4458064}},{"address":{"type":"absolute","value":4458158}}]},{"address":{"type":"absolute","value":4459008},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459008}},{"address":{"type":"absolute","value":4459203}}]},{"address":{"type":"absolute","value":4459296},"matched_basic_blocks":[{"address":{"type":"absolute","value":4459296}},{"address":{"type":"absolute","value":4459364}}]},{"address":{"type":"absolute","value":4464512},"matched_basic_blocks":[{"address":{"type":"absolute","value":4464512}}]},{"address":{"type":"absolute","value":4466544},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466544}}]},{"address":{"type":"absolute","value":4466656},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466656}}]},{"address":{"type":"absolute","value":4466768},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466768}}]},{"address":{"type":"absolute","value":4466992},"matched_basic_blocks":[{"address":{"type":"absolute","value":4466992}}]},{"address":{"type":"absolute","value":4467216},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467216}}]},{"address":{"type":"absolute","value":4467632},"matched_basic_blocks":[{"address":{"type":"absolute","value":4467632}}]},{"address":{"type":"absolute","value":4468080},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468080}},{"address":{"type":"absolute","value":4468243}},{"address":{"type":"absolute","value":4468582}}]},{"address":{"type":"absolute","value":4468575},"matched_basic_blocks":[{"address":{"type":"absolute","value":4468575}}]},{"address":{"type":"absolute","value":4469295},"matched_basic_blocks":[{"address":{"type":"absolute","value":4469295}}]},{"address":{"type":"absolute","value":4470448},"matched_basic_blocks":[{"address":{"type":"absolute","value":4470448}},{"address":{"type":"absolute","value":4470521}},{"address":{"type":"absolute","value":4470544}},{"address":{"type":"absolute","value":4470574}}]},{"address":{"type":"absolute","value":4471696},"matched_basic_blocks":[{"address":{"type":"absolute","value":4471696}}]},{"address":{"type":"absolute","value":4472852},"matched_basic_blocks":[{"address":{"type":"absolute","value":4472854}},{"address":{"type":"absolute","value":4472955}},{"address":{"type":"absolute","value":4473065}},{"address":{"type":"absolute","value":4473126}},{"address":{"type":"absolute","value":4473188}},{"address":{"type":"absolute","value":4473504}},{"address":{"type":"absolute","value":4473562}},{"address":{"type":"absolute","value":4474105}},{"address":{"type":"absolute","value":4474342}},{"address":{"type":"absolute","value":4474419}},{"address":{"type":"absolute","value":4474537}},{"address":{"type":"absolute","value":4474823}},{"address":{"type":"absolute","value":4474945}},{"address":{"type":"absolute","value":4475078}}]},{"address":{"type":"absolute","value":4476272},"matched_basic_blocks":[{"address":{"type":"absolute","value":4476272}},{"address":{"type":"absolute","value":4476418}},{"address":{"type":"absolute","value":4476451}},{"address":{"type":"absolute","value":4476628}},{"address":{"type":"absolute","value":4476669}}]},{"address":{"type":"absolute","value":4480208},"matched_basic_blocks":[{"address":{"type":"absolute","value":4480208}},{"address":{"type":"absolute","value":4480442}},{"address":{"type":"absolute","value":4480471}},{"address":{"type":"absolute","value":4480571}}]},{"address":{"type":"absolute","value":4481456},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481532}},{"address":{"type":"absolute","value":4481597}},{"address":{"type":"absolute","value":4481644}}]},{"address":{"type":"absolute","value":4481728},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481797}},{"address":{"type":"absolute","value":4481864}}]},{"address":{"type":"absolute","value":4481936},"matched_basic_blocks":[{"address":{"type":"absolute","value":4481936}},{"address":{"type":"absolute","value":4482131}}]},{"address":{"type":"absolute","value":4482224},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482224}},{"address":{"type":"absolute","value":4482321}}]},{"address":{"type":"absolute","value":4482384},"matched_basic_blocks":[{"address":{"type":"absolute","value":4482384}},{"address":{"type":"absolute","value":4482452}}]},{"address":{"type":"absolute","value":4486000},"matched_basic_blocks":[{"address":{"type":"absolute","value":4486000}}]},{"address":{"type":"absolute","value":4489616},"matched_basic_blocks":[{"address":{"type":"absolute","value":4489675}},{"address":{"type":"absolute","value":4489695}},{"address":{"type":"absolute","value":4489712}},{"address":{"type":"absolute","value":4489732}},{"address":{"type":"absolute","value":4489868}},{"address":{"type":"absolute","value":4489893}},{"address":{"type":"absolute","value":4490004}},{"address":{"type":"absolute","value":4490031}},{"address":{"type":"absolute","value":4490072}}]},{"address":{"type":"absolute","value":4502963},"matched_basic_blocks":[{"address":{"type":"absolute","value":4502963}}]},{"address":{"type":"absolute","value":4508544},"matched_basic_blocks":[{"address":{"type":"absolute","value":4508544}}]},{"address":{"type":"absolute","value":4509056},"matched_basic_blocks":[{"address":{"type":"absolute","value":4509056}}]},{"address":{"type":"absolute","value":4521360},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350816}}]},{"address":{"type":"absolute","value":4521368},"matched_basic_blocks":[{"address":{"type":"absolute","value":4350896}},{"address":{"type":"absolute","value":4350980}},{"address":{"type":"absolute","value":4351001}}]},{"address":{"type":"absolute","value":4521600},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351168}}]},{"address":{"type":"absolute","value":4525888},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4525896},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4526192},"matched_basic_blocks":[{"address":{"type":"absolute","value":4351168}}]},{"address":{"type":"absolute","value":4526200},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4526211},"matched_basic_blocks":[{"address":{"type":"absolute","value":4457232}}]},{"address":{"type":"absolute","value":4532208},"matched_basic_blocks":[{"address":{"type":"absolute","value":4532208}}]}]},"feature_counts":{"file":2659,"functions":[{"address":{"type":"absolute","value":4300810},"count":31},{"address":{"type":"absolute","value":4300815},"count":32},{"address":{"type":"absolute","value":4300820},"count":36},{"address":{"type":"absolute","value":4300825},"count":39},{"address":{"type":"absolute","value":4300835},"count":29},{"address":{"type":"absolute","value":4300840},"count":61},{"address":{"type":"absolute","value":4300850},"count":57},{"address":{"type":"absolute","value":4300855},"count":28},{"address":{"type":"absolute","value":4300865},"count":47},{"address":{"type":"absolute","value":4300870},"count":33},{"address":{"type":"absolute","value":4300875},"count":45},{"address":{"type":"absolute","value":4300880},"count":26},{"address":{"type":"absolute","value":4300885},"count":37},{"address":{"type":"absolute","value":4300890},"count":40},{"address":{"type":"absolute","value":4300895},"count":55},{"address":{"type":"absolute","value":4300900},"count":35},{"address":{"type":"absolute","value":4300905},"count":109},{"address":{"type":"absolute","value":4300910},"count":37},{"address":{"type":"absolute","value":4300915},"count":42},{"address":{"type":"absolute","value":4300925},"count":36},{"address":{"type":"absolute","value":4300930},"count":8},{"address":{"type":"absolute","value":4300935},"count":9},{"address":{"type":"absolute","value":4300945},"count":31},{"address":{"type":"absolute","value":4300950},"count":35},{"address":{"type":"absolute","value":4300955},"count":10},{"address":{"type":"absolute","value":4300960},"count":35},{"address":{"type":"absolute","value":4300965},"count":8},{"address":{"type":"absolute","value":4300975},"count":53},{"address":{"type":"absolute","value":4300980},"count":71},{"address":{"type":"absolute","value":4300985},"count":29},{"address":{"type":"absolute","value":4300990},"count":26},{"address":{"type":"absolute","value":4300995},"count":8},{"address":{"type":"absolute","value":4301000},"count":13},{"address":{"type":"absolute","value":4301005},"count":60},{"address":{"type":"absolute","value":4301010},"count":37},{"address":{"type":"absolute","value":4301020},"count":9},{"address":{"type":"absolute","value":4301025},"count":115},{"address":{"type":"absolute","value":4301035},"count":25},{"address":{"type":"absolute","value":4301050},"count":32},{"address":{"type":"absolute","value":4301055},"count":33},{"address":{"type":"absolute","value":4301060},"count":53},{"address":{"type":"absolute","value":4301070},"count":32},{"address":{"type":"absolute","value":4301075},"count":36},{"address":{"type":"absolute","value":4301080},"count":31},{"address":{"type":"absolute","value":4301085},"count":37},{"address":{"type":"absolute","value":4301090},"count":30},{"address":{"type":"absolute","value":4301095},"count":54},{"address":{"type":"absolute","value":4301100},"count":12},{"address":{"type":"absolute","value":4301110},"count":49},{"address":{"type":"absolute","value":4301115},"count":35},{"address":{"type":"absolute","value":4301120},"count":52},{"address":{"type":"absolute","value":4301125},"count":68},{"address":{"type":"absolute","value":4301130},"count":8},{"address":{"type":"absolute","value":4301135},"count":26},{"address":{"type":"absolute","value":4301140},"count":90},{"address":{"type":"absolute","value":4301150},"count":61},{"address":{"type":"absolute","value":4301155},"count":38},{"address":{"type":"absolute","value":4301160},"count":56},{"address":{"type":"absolute","value":4301165},"count":32},{"address":{"type":"absolute","value":4301170},"count":11},{"address":{"type":"absolute","value":4301175},"count":9},{"address":{"type":"absolute","value":4301180},"count":11},{"address":{"type":"absolute","value":4301190},"count":33},{"address":{"type":"absolute","value":4301195},"count":43},{"address":{"type":"absolute","value":4301200},"count":65},{"address":{"type":"absolute","value":4301205},"count":35},{"address":{"type":"absolute","value":4301210},"count":61},{"address":{"type":"absolute","value":4301215},"count":36},{"address":{"type":"absolute","value":4301220},"count":37},{"address":{"type":"absolute","value":4301230},"count":36},{"address":{"type":"absolute","value":4301240},"count":60},{"address":{"type":"absolute","value":4301245},"count":36},{"address":{"type":"absolute","value":4301255},"count":35},{"address":{"type":"absolute","value":4301265},"count":62},{"address":{"type":"absolute","value":4301270},"count":38},{"address":{"type":"absolute","value":4301275},"count":54},{"address":{"type":"absolute","value":4301280},"count":66},{"address":{"type":"absolute","value":4301290},"count":8},{"address":{"type":"absolute","value":4301295},"count":8},{"address":{"type":"absolute","value":4301300},"count":34},{"address":{"type":"absolute","value":4301305},"count":43},{"address":{"type":"absolute","value":4301310},"count":34},{"address":{"type":"absolute","value":4301315},"count":29},{"address":{"type":"absolute","value":4301320},"count":27},{"address":{"type":"absolute","value":4301330},"count":9},{"address":{"type":"absolute","value":4301335},"count":36},{"address":{"type":"absolute","value":4301345},"count":9},{"address":{"type":"absolute","value":4301350},"count":8},{"address":{"type":"absolute","value":4301355},"count":76},{"address":{"type":"absolute","value":4301370},"count":54},{"address":{"type":"absolute","value":4301375},"count":8},{"address":{"type":"absolute","value":4301380},"count":57},{"address":{"type":"absolute","value":4301385},"count":29},{"address":{"type":"absolute","value":4301390},"count":34},{"address":{"type":"absolute","value":4301395},"count":47},{"address":{"type":"absolute","value":4301405},"count":41},{"address":{"type":"absolute","value":4301410},"count":37},{"address":{"type":"absolute","value":4301415},"count":18},{"address":{"type":"absolute","value":4301420},"count":51},{"address":{"type":"absolute","value":4301425},"count":35},{"address":{"type":"absolute","value":4301435},"count":26},{"address":{"type":"absolute","value":4301440},"count":43},{"address":{"type":"absolute","value":4301445},"count":29},{"address":{"type":"absolute","value":4301455},"count":41},{"address":{"type":"absolute","value":4301460},"count":59},{"address":{"type":"absolute","value":4301470},"count":8},{"address":{"type":"absolute","value":4301475},"count":12},{"address":{"type":"absolute","value":4301480},"count":37},{"address":{"type":"absolute","value":4301485},"count":43},{"address":{"type":"absolute","value":4301505},"count":51},{"address":{"type":"absolute","value":4301510},"count":37},{"address":{"type":"absolute","value":4301515},"count":49},{"address":{"type":"absolute","value":4301520},"count":81},{"address":{"type":"absolute","value":4301525},"count":35},{"address":{"type":"absolute","value":4301530},"count":9},{"address":{"type":"absolute","value":4301535},"count":39},{"address":{"type":"absolute","value":4301545},"count":78},{"address":{"type":"absolute","value":4301550},"count":34},{"address":{"type":"absolute","value":4301555},"count":84},{"address":{"type":"absolute","value":4301565},"count":20},{"address":{"type":"absolute","value":4301570},"count":52},{"address":{"type":"absolute","value":4301575},"count":35},{"address":{"type":"absolute","value":4301580},"count":27},{"address":{"type":"absolute","value":4301585},"count":35},{"address":{"type":"absolute","value":4301590},"count":37},{"address":{"type":"absolute","value":4301595},"count":29},{"address":{"type":"absolute","value":4301600},"count":60},{"address":{"type":"absolute","value":4301605},"count":37},{"address":{"type":"absolute","value":4301615},"count":50},{"address":{"type":"absolute","value":4301620},"count":9},{"address":{"type":"absolute","value":4301625},"count":64},{"address":{"type":"absolute","value":4301630},"count":31},{"address":{"type":"absolute","value":4301635},"count":29},{"address":{"type":"absolute","value":4301640},"count":20},{"address":{"type":"absolute","value":4301650},"count":35},{"address":{"type":"absolute","value":4301655},"count":27},{"address":{"type":"absolute","value":4301665},"count":32},{"address":{"type":"absolute","value":4301675},"count":12},{"address":{"type":"absolute","value":4301690},"count":27},{"address":{"type":"absolute","value":4301695},"count":35},{"address":{"type":"absolute","value":4301700},"count":8},{"address":{"type":"absolute","value":4301710},"count":36},{"address":{"type":"absolute","value":4301715},"count":8},{"address":{"type":"absolute","value":4301725},"count":35},{"address":{"type":"absolute","value":4301730},"count":32},{"address":{"type":"absolute","value":4301735},"count":11},{"address":{"type":"absolute","value":4301740},"count":37},{"address":{"type":"absolute","value":4301750},"count":20},{"address":{"type":"absolute","value":4301755},"count":37},{"address":{"type":"absolute","value":4301760},"count":55},{"address":{"type":"absolute","value":4301765},"count":26},{"address":{"type":"absolute","value":4301770},"count":14},{"address":{"type":"absolute","value":4301780},"count":8},{"address":{"type":"absolute","value":4301785},"count":103},{"address":{"type":"absolute","value":4301790},"count":30},{"address":{"type":"absolute","value":4301795},"count":8},{"address":{"type":"absolute","value":4301800},"count":12},{"address":{"type":"absolute","value":4301810},"count":29},{"address":{"type":"absolute","value":4301815},"count":39},{"address":{"type":"absolute","value":4301820},"count":26},{"address":{"type":"absolute","value":4301825},"count":36},{"address":{"type":"absolute","value":4301835},"count":102},{"address":{"type":"absolute","value":4301860},"count":43},{"address":{"type":"absolute","value":4301865},"count":31},{"address":{"type":"absolute","value":4301870},"count":35},{"address":{"type":"absolute","value":4301875},"count":29},{"address":{"type":"absolute","value":4301880},"count":25},{"address":{"type":"absolute","value":4301885},"count":36},{"address":{"type":"absolute","value":4301895},"count":32},{"address":{"type":"absolute","value":4301900},"count":34},{"address":{"type":"absolute","value":4301905},"count":67},{"address":{"type":"absolute","value":4301910},"count":37},{"address":{"type":"absolute","value":4301915},"count":160},{"address":{"type":"absolute","value":4301925},"count":29},{"address":{"type":"absolute","value":4301935},"count":10},{"address":{"type":"absolute","value":4301940},"count":56},{"address":{"type":"absolute","value":4301950},"count":32},{"address":{"type":"absolute","value":4301955},"count":37},{"address":{"type":"absolute","value":4301960},"count":57},{"address":{"type":"absolute","value":4301965},"count":20},{"address":{"type":"absolute","value":4301970},"count":36},{"address":{"type":"absolute","value":4301985},"count":34},{"address":{"type":"absolute","value":4301995},"count":33},{"address":{"type":"absolute","value":4302000},"count":29},{"address":{"type":"absolute","value":4302015},"count":33},{"address":{"type":"absolute","value":4302020},"count":65},{"address":{"type":"absolute","value":4302035},"count":37},{"address":{"type":"absolute","value":4302040},"count":54},{"address":{"type":"absolute","value":4302045},"count":8},{"address":{"type":"absolute","value":4302050},"count":12},{"address":{"type":"absolute","value":4302060},"count":35},{"address":{"type":"absolute","value":4302065},"count":8},{"address":{"type":"absolute","value":4302070},"count":19},{"address":{"type":"absolute","value":4302075},"count":27},{"address":{"type":"absolute","value":4302080},"count":18},{"address":{"type":"absolute","value":4302085},"count":55},{"address":{"type":"absolute","value":4302100},"count":47},{"address":{"type":"absolute","value":4302105},"count":44},{"address":{"type":"absolute","value":4302110},"count":55},{"address":{"type":"absolute","value":4302115},"count":31},{"address":{"type":"absolute","value":4302120},"count":28},{"address":{"type":"absolute","value":4302125},"count":59},{"address":{"type":"absolute","value":4302130},"count":41},{"address":{"type":"absolute","value":4302135},"count":8},{"address":{"type":"absolute","value":4302140},"count":35},{"address":{"type":"absolute","value":4302150},"count":29},{"address":{"type":"absolute","value":4302155},"count":33},{"address":{"type":"absolute","value":4302160},"count":46},{"address":{"type":"absolute","value":4302165},"count":73},{"address":{"type":"absolute","value":4302170},"count":69},{"address":{"type":"absolute","value":4302175},"count":37},{"address":{"type":"absolute","value":4302180},"count":26},{"address":{"type":"absolute","value":4302190},"count":59},{"address":{"type":"absolute","value":4302200},"count":35},{"address":{"type":"absolute","value":4302205},"count":24},{"address":{"type":"absolute","value":4302210},"count":12},{"address":{"type":"absolute","value":4302215},"count":47},{"address":{"type":"absolute","value":4302225},"count":33},{"address":{"type":"absolute","value":4302230},"count":35},{"address":{"type":"absolute","value":4302235},"count":60},{"address":{"type":"absolute","value":4302240},"count":8},{"address":{"type":"absolute","value":4302245},"count":32},{"address":{"type":"absolute","value":4302250},"count":26},{"address":{"type":"absolute","value":4302255},"count":37},{"address":{"type":"absolute","value":4302260},"count":56},{"address":{"type":"absolute","value":4302265},"count":9},{"address":{"type":"absolute","value":4302270},"count":26},{"address":{"type":"absolute","value":4302275},"count":39},{"address":{"type":"absolute","value":4302280},"count":29},{"address":{"type":"absolute","value":4302285},"count":48},{"address":{"type":"absolute","value":4302290},"count":37},{"address":{"type":"absolute","value":4302295},"count":36},{"address":{"type":"absolute","value":4302300},"count":47},{"address":{"type":"absolute","value":4302305},"count":60},{"address":{"type":"absolute","value":4302320},"count":37},{"address":{"type":"absolute","value":4302325},"count":29},{"address":{"type":"absolute","value":4302335},"count":26},{"address":{"type":"absolute","value":4302340},"count":30},{"address":{"type":"absolute","value":4302345},"count":17},{"address":{"type":"absolute","value":4302350},"count":27},{"address":{"type":"absolute","value":4302355},"count":49},{"address":{"type":"absolute","value":4302360},"count":41},{"address":{"type":"absolute","value":4302365},"count":35},{"address":{"type":"absolute","value":4302370},"count":36},{"address":{"type":"absolute","value":4302375},"count":41},{"address":{"type":"absolute","value":4302380},"count":32},{"address":{"type":"absolute","value":4302395},"count":27},{"address":{"type":"absolute","value":4302400},"count":12},{"address":{"type":"absolute","value":4302405},"count":8},{"address":{"type":"absolute","value":4302410},"count":37},{"address":{"type":"absolute","value":4302415},"count":9},{"address":{"type":"absolute","value":4302420},"count":64},{"address":{"type":"absolute","value":4302425},"count":41},{"address":{"type":"absolute","value":4302430},"count":28},{"address":{"type":"absolute","value":4302435},"count":35},{"address":{"type":"absolute","value":4302440},"count":26},{"address":{"type":"absolute","value":4302445},"count":35},{"address":{"type":"absolute","value":4302450},"count":54},{"address":{"type":"absolute","value":4302460},"count":37},{"address":{"type":"absolute","value":4302465},"count":43},{"address":{"type":"absolute","value":4302470},"count":60},{"address":{"type":"absolute","value":4302475},"count":54},{"address":{"type":"absolute","value":4302480},"count":69},{"address":{"type":"absolute","value":4302495},"count":66},{"address":{"type":"absolute","value":4302510},"count":35},{"address":{"type":"absolute","value":4302525},"count":29},{"address":{"type":"absolute","value":4302530},"count":29},{"address":{"type":"absolute","value":4302535},"count":51},{"address":{"type":"absolute","value":4302550},"count":11},{"address":{"type":"absolute","value":4302555},"count":16},{"address":{"type":"absolute","value":4302560},"count":27},{"address":{"type":"absolute","value":4302565},"count":42},{"address":{"type":"absolute","value":4302570},"count":35},{"address":{"type":"absolute","value":4302585},"count":34},{"address":{"type":"absolute","value":4302590},"count":12},{"address":{"type":"absolute","value":4302595},"count":46},{"address":{"type":"absolute","value":4302600},"count":8},{"address":{"type":"absolute","value":4302605},"count":8},{"address":{"type":"absolute","value":4302610},"count":46},{"address":{"type":"absolute","value":4302615},"count":57},{"address":{"type":"absolute","value":4302620},"count":39},{"address":{"type":"absolute","value":4302635},"count":72},{"address":{"type":"absolute","value":4302640},"count":29},{"address":{"type":"absolute","value":4302645},"count":35},{"address":{"type":"absolute","value":4302655},"count":46},{"address":{"type":"absolute","value":4302665},"count":26},{"address":{"type":"absolute","value":4302670},"count":34},{"address":{"type":"absolute","value":4302675},"count":28},{"address":{"type":"absolute","value":4302685},"count":65},{"address":{"type":"absolute","value":4302690},"count":37},{"address":{"type":"absolute","value":4302695},"count":8},{"address":{"type":"absolute","value":4302700},"count":49},{"address":{"type":"absolute","value":4302705},"count":64},{"address":{"type":"absolute","value":4302710},"count":42},{"address":{"type":"absolute","value":4302715},"count":53},{"address":{"type":"absolute","value":4302725},"count":8},{"address":{"type":"absolute","value":4302730},"count":8},{"address":{"type":"absolute","value":4302740},"count":50},{"address":{"type":"absolute","value":4302745},"count":37},{"address":{"type":"absolute","value":4302750},"count":54},{"address":{"type":"absolute","value":4302755},"count":14},{"address":{"type":"absolute","value":4302765},"count":39},{"address":{"type":"absolute","value":4302770},"count":29},{"address":{"type":"absolute","value":4302775},"count":29},{"address":{"type":"absolute","value":4302780},"count":36},{"address":{"type":"absolute","value":4302785},"count":52},{"address":{"type":"absolute","value":4302790},"count":36},{"address":{"type":"absolute","value":4302795},"count":35},{"address":{"type":"absolute","value":4302800},"count":8},{"address":{"type":"absolute","value":4302810},"count":54},{"address":{"type":"absolute","value":4302815},"count":35},{"address":{"type":"absolute","value":4302825},"count":8},{"address":{"type":"absolute","value":4302830},"count":78},{"address":{"type":"absolute","value":4302835},"count":24},{"address":{"type":"absolute","value":4302840},"count":35},{"address":{"type":"absolute","value":4302845},"count":36},{"address":{"type":"absolute","value":4302860},"count":26},{"address":{"type":"absolute","value":4302865},"count":30},{"address":{"type":"absolute","value":4302870},"count":29},{"address":{"type":"absolute","value":4302875},"count":38},{"address":{"type":"absolute","value":4302880},"count":35},{"address":{"type":"absolute","value":4302885},"count":24},{"address":{"type":"absolute","value":4302890},"count":31},{"address":{"type":"absolute","value":4302895},"count":32},{"address":{"type":"absolute","value":4302900},"count":50},{"address":{"type":"absolute","value":4302910},"count":37},{"address":{"type":"absolute","value":4302915},"count":63},{"address":{"type":"absolute","value":4302920},"count":55},{"address":{"type":"absolute","value":4302925},"count":54},{"address":{"type":"absolute","value":4302930},"count":26},{"address":{"type":"absolute","value":4302935},"count":52},{"address":{"type":"absolute","value":4302940},"count":30},{"address":{"type":"absolute","value":4302950},"count":53},{"address":{"type":"absolute","value":4302955},"count":32},{"address":{"type":"absolute","value":4302960},"count":37},{"address":{"type":"absolute","value":4302965},"count":38},{"address":{"type":"absolute","value":4302970},"count":67},{"address":{"type":"absolute","value":4302975},"count":51},{"address":{"type":"absolute","value":4302980},"count":36},{"address":{"type":"absolute","value":4302995},"count":98},{"address":{"type":"absolute","value":4303000},"count":57},{"address":{"type":"absolute","value":4303015},"count":42},{"address":{"type":"absolute","value":4303020},"count":35},{"address":{"type":"absolute","value":4303025},"count":74},{"address":{"type":"absolute","value":4303030},"count":31},{"address":{"type":"absolute","value":4303035},"count":15},{"address":{"type":"absolute","value":4303040},"count":36},{"address":{"type":"absolute","value":4303050},"count":34},{"address":{"type":"absolute","value":4303055},"count":43},{"address":{"type":"absolute","value":4303060},"count":37},{"address":{"type":"absolute","value":4303065},"count":35},{"address":{"type":"absolute","value":4303075},"count":36},{"address":{"type":"absolute","value":4303080},"count":8},{"address":{"type":"absolute","value":4303085},"count":10},{"address":{"type":"absolute","value":4303090},"count":8},{"address":{"type":"absolute","value":4303095},"count":52},{"address":{"type":"absolute","value":4303100},"count":32},{"address":{"type":"absolute","value":4303105},"count":43},{"address":{"type":"absolute","value":4303110},"count":35},{"address":{"type":"absolute","value":4303115},"count":32},{"address":{"type":"absolute","value":4303130},"count":68},{"address":{"type":"absolute","value":4303140},"count":10},{"address":{"type":"absolute","value":4303145},"count":12},{"address":{"type":"absolute","value":4303155},"count":43},{"address":{"type":"absolute","value":4303160},"count":56},{"address":{"type":"absolute","value":4303165},"count":39},{"address":{"type":"absolute","value":4303170},"count":24},{"address":{"type":"absolute","value":4303175},"count":41},{"address":{"type":"absolute","value":4303180},"count":34},{"address":{"type":"absolute","value":4303190},"count":8},{"address":{"type":"absolute","value":4303195},"count":39},{"address":{"type":"absolute","value":4303200},"count":31},{"address":{"type":"absolute","value":4303205},"count":32},{"address":{"type":"absolute","value":4303210},"count":47},{"address":{"type":"absolute","value":4303220},"count":37},{"address":{"type":"absolute","value":4303225},"count":26},{"address":{"type":"absolute","value":4303230},"count":34},{"address":{"type":"absolute","value":4303235},"count":36},{"address":{"type":"absolute","value":4303245},"count":18},{"address":{"type":"absolute","value":4303265},"count":43},{"address":{"type":"absolute","value":4303270},"count":61},{"address":{"type":"absolute","value":4303275},"count":34},{"address":{"type":"absolute","value":4303280},"count":26},{"address":{"type":"absolute","value":4303285},"count":20},{"address":{"type":"absolute","value":4303290},"count":37},{"address":{"type":"absolute","value":4303295},"count":41},{"address":{"type":"absolute","value":4303305},"count":45},{"address":{"type":"absolute","value":4303310},"count":26},{"address":{"type":"absolute","value":4303320},"count":42},{"address":{"type":"absolute","value":4303325},"count":34},{"address":{"type":"absolute","value":4303330},"count":47},{"address":{"type":"absolute","value":4303335},"count":38},{"address":{"type":"absolute","value":4303340},"count":36},{"address":{"type":"absolute","value":4303350},"count":8},{"address":{"type":"absolute","value":4303355},"count":63},{"address":{"type":"absolute","value":4303365},"count":29},{"address":{"type":"absolute","value":4303375},"count":14},{"address":{"type":"absolute","value":4303380},"count":37},{"address":{"type":"absolute","value":4303385},"count":37},{"address":{"type":"absolute","value":4303400},"count":35},{"address":{"type":"absolute","value":4303410},"count":56},{"address":{"type":"absolute","value":4303415},"count":64},{"address":{"type":"absolute","value":4303420},"count":27},{"address":{"type":"absolute","value":4303425},"count":26},{"address":{"type":"absolute","value":4303430},"count":68},{"address":{"type":"absolute","value":4303450},"count":32},{"address":{"type":"absolute","value":4303455},"count":40},{"address":{"type":"absolute","value":4303460},"count":55},{"address":{"type":"absolute","value":4303465},"count":15},{"address":{"type":"absolute","value":4303470},"count":58},{"address":{"type":"absolute","value":4303475},"count":32},{"address":{"type":"absolute","value":4303480},"count":28},{"address":{"type":"absolute","value":4303485},"count":37},{"address":{"type":"absolute","value":4303490},"count":53},{"address":{"type":"absolute","value":4303495},"count":43},{"address":{"type":"absolute","value":4303505},"count":74},{"address":{"type":"absolute","value":4303510},"count":68},{"address":{"type":"absolute","value":4303520},"count":29},{"address":{"type":"absolute","value":4303525},"count":36},{"address":{"type":"absolute","value":4303530},"count":37},{"address":{"type":"absolute","value":4303535},"count":37},{"address":{"type":"absolute","value":4303540},"count":45},{"address":{"type":"absolute","value":4303550},"count":48},{"address":{"type":"absolute","value":4303555},"count":61},{"address":{"type":"absolute","value":4303575},"count":38},{"address":{"type":"absolute","value":4303580},"count":36},{"address":{"type":"absolute","value":4303585},"count":31},{"address":{"type":"absolute","value":4303595},"count":35},{"address":{"type":"absolute","value":4303605},"count":8},{"address":{"type":"absolute","value":4303615},"count":30},{"address":{"type":"absolute","value":4303620},"count":52},{"address":{"type":"absolute","value":4303625},"count":11},{"address":{"type":"absolute","value":4303630},"count":12},{"address":{"type":"absolute","value":4303635},"count":36},{"address":{"type":"absolute","value":4303640},"count":34},{"address":{"type":"absolute","value":4303645},"count":31},{"address":{"type":"absolute","value":4303650},"count":21},{"address":{"type":"absolute","value":4303655},"count":29},{"address":{"type":"absolute","value":4303660},"count":33},{"address":{"type":"absolute","value":4303665},"count":35},{"address":{"type":"absolute","value":4303675},"count":29},{"address":{"type":"absolute","value":4303680},"count":26},{"address":{"type":"absolute","value":4303690},"count":37},{"address":{"type":"absolute","value":4303700},"count":49},{"address":{"type":"absolute","value":4303710},"count":51},{"address":{"type":"absolute","value":4303715},"count":8},{"address":{"type":"absolute","value":4303720},"count":37},{"address":{"type":"absolute","value":4303725},"count":34},{"address":{"type":"absolute","value":4303735},"count":57},{"address":{"type":"absolute","value":4303745},"count":53},{"address":{"type":"absolute","value":4303755},"count":26},{"address":{"type":"absolute","value":4303765},"count":36},{"address":{"type":"absolute","value":4303770},"count":46},{"address":{"type":"absolute","value":4303775},"count":40},{"address":{"type":"absolute","value":4303780},"count":93},{"address":{"type":"absolute","value":4303790},"count":34},{"address":{"type":"absolute","value":4303795},"count":35},{"address":{"type":"absolute","value":4303800},"count":50},{"address":{"type":"absolute","value":4303805},"count":29},{"address":{"type":"absolute","value":4303815},"count":36},{"address":{"type":"absolute","value":4303820},"count":37},{"address":{"type":"absolute","value":4303825},"count":49},{"address":{"type":"absolute","value":4303830},"count":14},{"address":{"type":"absolute","value":4303835},"count":31},{"address":{"type":"absolute","value":4303840},"count":39},{"address":{"type":"absolute","value":4303845},"count":14},{"address":{"type":"absolute","value":4303855},"count":12},{"address":{"type":"absolute","value":4303860},"count":27},{"address":{"type":"absolute","value":4303865},"count":43},{"address":{"type":"absolute","value":4303870},"count":30},{"address":{"type":"absolute","value":4303875},"count":20},{"address":{"type":"absolute","value":4303880},"count":80},{"address":{"type":"absolute","value":4303890},"count":37},{"address":{"type":"absolute","value":4303895},"count":37},{"address":{"type":"absolute","value":4303905},"count":20},{"address":{"type":"absolute","value":4303910},"count":35},{"address":{"type":"absolute","value":4303915},"count":43},{"address":{"type":"absolute","value":4303920},"count":54},{"address":{"type":"absolute","value":4303925},"count":61},{"address":{"type":"absolute","value":4303930},"count":43},{"address":{"type":"absolute","value":4303935},"count":26},{"address":{"type":"absolute","value":4303940},"count":8},{"address":{"type":"absolute","value":4303945},"count":13},{"address":{"type":"absolute","value":4303950},"count":75},{"address":{"type":"absolute","value":4303955},"count":36},{"address":{"type":"absolute","value":4303960},"count":29},{"address":{"type":"absolute","value":4303965},"count":36},{"address":{"type":"absolute","value":4303970},"count":35},{"address":{"type":"absolute","value":4303985},"count":37},{"address":{"type":"absolute","value":4303990},"count":63},{"address":{"type":"absolute","value":4304000},"count":29},{"address":{"type":"absolute","value":4304015},"count":8},{"address":{"type":"absolute","value":4304020},"count":34},{"address":{"type":"absolute","value":4304025},"count":8},{"address":{"type":"absolute","value":4304030},"count":28},{"address":{"type":"absolute","value":4304040},"count":13},{"address":{"type":"absolute","value":4304045},"count":29},{"address":{"type":"absolute","value":4304060},"count":34},{"address":{"type":"absolute","value":4304065},"count":10},{"address":{"type":"absolute","value":4304070},"count":42},{"address":{"type":"absolute","value":4304075},"count":35},{"address":{"type":"absolute","value":4304080},"count":28},{"address":{"type":"absolute","value":4304085},"count":26},{"address":{"type":"absolute","value":4304090},"count":65},{"address":{"type":"absolute","value":4304095},"count":63},{"address":{"type":"absolute","value":4304100},"count":36},{"address":{"type":"absolute","value":4304105},"count":107},{"address":{"type":"absolute","value":4304110},"count":47},{"address":{"type":"absolute","value":4304115},"count":35},{"address":{"type":"absolute","value":4304120},"count":26},{"address":{"type":"absolute","value":4304125},"count":31},{"address":{"type":"absolute","value":4304130},"count":60},{"address":{"type":"absolute","value":4304135},"count":26},{"address":{"type":"absolute","value":4304140},"count":37},{"address":{"type":"absolute","value":4304145},"count":71},{"address":{"type":"absolute","value":4304150},"count":31},{"address":{"type":"absolute","value":4304155},"count":40},{"address":{"type":"absolute","value":4304160},"count":63},{"address":{"type":"absolute","value":4304165},"count":37},{"address":{"type":"absolute","value":4304175},"count":35},{"address":{"type":"absolute","value":4304185},"count":34},{"address":{"type":"absolute","value":4304190},"count":29},{"address":{"type":"absolute","value":4304195},"count":29},{"address":{"type":"absolute","value":4304205},"count":20},{"address":{"type":"absolute","value":4304215},"count":37},{"address":{"type":"absolute","value":4304220},"count":8},{"address":{"type":"absolute","value":4304225},"count":78},{"address":{"type":"absolute","value":4304235},"count":34},{"address":{"type":"absolute","value":4304240},"count":38},{"address":{"type":"absolute","value":4304245},"count":9},{"address":{"type":"absolute","value":4304250},"count":37},{"address":{"type":"absolute","value":4304255},"count":8},{"address":{"type":"absolute","value":4304260},"count":8},{"address":{"type":"absolute","value":4304265},"count":39},{"address":{"type":"absolute","value":4304270},"count":25},{"address":{"type":"absolute","value":4304275},"count":54},{"address":{"type":"absolute","value":4304280},"count":45},{"address":{"type":"absolute","value":4304295},"count":8},{"address":{"type":"absolute","value":4304300},"count":48},{"address":{"type":"absolute","value":4304305},"count":8},{"address":{"type":"absolute","value":4304310},"count":34},{"address":{"type":"absolute","value":4304315},"count":68},{"address":{"type":"absolute","value":4304325},"count":45},{"address":{"type":"absolute","value":4304330},"count":27},{"address":{"type":"absolute","value":4304335},"count":34},{"address":{"type":"absolute","value":4304340},"count":64},{"address":{"type":"absolute","value":4304350},"count":24},{"address":{"type":"absolute","value":4304355},"count":8},{"address":{"type":"absolute","value":4304360},"count":78},{"address":{"type":"absolute","value":4304365},"count":37},{"address":{"type":"absolute","value":4304370},"count":12},{"address":{"type":"absolute","value":4304375},"count":15},{"address":{"type":"absolute","value":4304380},"count":29},{"address":{"type":"absolute","value":4304385},"count":29},{"address":{"type":"absolute","value":4304390},"count":33},{"address":{"type":"absolute","value":4304395},"count":35},{"address":{"type":"absolute","value":4304400},"count":30},{"address":{"type":"absolute","value":4304405},"count":29},{"address":{"type":"absolute","value":4304410},"count":57},{"address":{"type":"absolute","value":4304415},"count":9},{"address":{"type":"absolute","value":4304430},"count":46},{"address":{"type":"absolute","value":4304440},"count":72},{"address":{"type":"absolute","value":4304445},"count":26},{"address":{"type":"absolute","value":4304460},"count":17},{"address":{"type":"absolute","value":4304465},"count":67},{"address":{"type":"absolute","value":4304470},"count":20},{"address":{"type":"absolute","value":4304475},"count":31},{"address":{"type":"absolute","value":4304480},"count":25},{"address":{"type":"absolute","value":4304490},"count":51},{"address":{"type":"absolute","value":4304495},"count":12},{"address":{"type":"absolute","value":4304500},"count":40},{"address":{"type":"absolute","value":4304505},"count":35},{"address":{"type":"absolute","value":4304510},"count":8},{"address":{"type":"absolute","value":4304515},"count":12},{"address":{"type":"absolute","value":4304520},"count":88},{"address":{"type":"absolute","value":4304535},"count":27},{"address":{"type":"absolute","value":4304540},"count":300},{"address":{"type":"absolute","value":4304545},"count":26},{"address":{"type":"absolute","value":4304550},"count":41},{"address":{"type":"absolute","value":4304560},"count":8},{"address":{"type":"absolute","value":4304570},"count":35},{"address":{"type":"absolute","value":4304580},"count":10},{"address":{"type":"absolute","value":4304595},"count":33},{"address":{"type":"absolute","value":4304605},"count":100},{"address":{"type":"absolute","value":4304610},"count":39},{"address":{"type":"absolute","value":4304620},"count":48},{"address":{"type":"absolute","value":4304625},"count":39},{"address":{"type":"absolute","value":4304630},"count":38},{"address":{"type":"absolute","value":4304635},"count":61},{"address":{"type":"absolute","value":4304645},"count":76},{"address":{"type":"absolute","value":4304650},"count":12},{"address":{"type":"absolute","value":4304660},"count":29},{"address":{"type":"absolute","value":4304665},"count":43},{"address":{"type":"absolute","value":4304670},"count":24},{"address":{"type":"absolute","value":4304675},"count":32},{"address":{"type":"absolute","value":4304680},"count":8},{"address":{"type":"absolute","value":4304685},"count":42},{"address":{"type":"absolute","value":4304690},"count":32},{"address":{"type":"absolute","value":4304705},"count":34},{"address":{"type":"absolute","value":4304710},"count":9},{"address":{"type":"absolute","value":4304715},"count":26},{"address":{"type":"absolute","value":4304725},"count":30},{"address":{"type":"absolute","value":4304730},"count":12},{"address":{"type":"absolute","value":4304735},"count":80},{"address":{"type":"absolute","value":4304740},"count":51},{"address":{"type":"absolute","value":4304745},"count":31},{"address":{"type":"absolute","value":4304750},"count":28},{"address":{"type":"absolute","value":4304755},"count":8},{"address":{"type":"absolute","value":4304770},"count":55},{"address":{"type":"absolute","value":4304775},"count":38},{"address":{"type":"absolute","value":4304780},"count":39},{"address":{"type":"absolute","value":4304785},"count":46},{"address":{"type":"absolute","value":4304790},"count":37},{"address":{"type":"absolute","value":4304795},"count":33},{"address":{"type":"absolute","value":4304800},"count":13},{"address":{"type":"absolute","value":4304805},"count":44},{"address":{"type":"absolute","value":4304810},"count":32},{"address":{"type":"absolute","value":4304815},"count":8},{"address":{"type":"absolute","value":4304820},"count":12},{"address":{"type":"absolute","value":4304830},"count":29},{"address":{"type":"absolute","value":4304835},"count":29},{"address":{"type":"absolute","value":4304845},"count":63},{"address":{"type":"absolute","value":4304850},"count":35},{"address":{"type":"absolute","value":4304860},"count":38},{"address":{"type":"absolute","value":4304870},"count":42},{"address":{"type":"absolute","value":4304875},"count":39},{"address":{"type":"absolute","value":4304880},"count":31},{"address":{"type":"absolute","value":4304890},"count":39},{"address":{"type":"absolute","value":4304895},"count":14},{"address":{"type":"absolute","value":4304900},"count":33},{"address":{"type":"absolute","value":4304910},"count":36},{"address":{"type":"absolute","value":4304920},"count":43},{"address":{"type":"absolute","value":4304930},"count":35},{"address":{"type":"absolute","value":4304935},"count":35},{"address":{"type":"absolute","value":4304940},"count":26},{"address":{"type":"absolute","value":4304945},"count":49},{"address":{"type":"absolute","value":4304950},"count":35},{"address":{"type":"absolute","value":4304955},"count":9},{"address":{"type":"absolute","value":4304965},"count":48},{"address":{"type":"absolute","value":4304970},"count":32},{"address":{"type":"absolute","value":4304975},"count":57},{"address":{"type":"absolute","value":4304980},"count":34},{"address":{"type":"absolute","value":4304995},"count":78},{"address":{"type":"absolute","value":4305005},"count":54},{"address":{"type":"absolute","value":4305010},"count":63},{"address":{"type":"absolute","value":4305025},"count":28},{"address":{"type":"absolute","value":4305030},"count":10},{"address":{"type":"absolute","value":4305040},"count":37},{"address":{"type":"absolute","value":4305045},"count":35},{"address":{"type":"absolute","value":4305050},"count":37},{"address":{"type":"absolute","value":4305055},"count":29},{"address":{"type":"absolute","value":4305065},"count":46},{"address":{"type":"absolute","value":4305070},"count":41},{"address":{"type":"absolute","value":4305075},"count":26},{"address":{"type":"absolute","value":4305080},"count":39},{"address":{"type":"absolute","value":4305085},"count":54},{"address":{"type":"absolute","value":4305090},"count":36},{"address":{"type":"absolute","value":4305095},"count":8},{"address":{"type":"absolute","value":4305115},"count":54},{"address":{"type":"absolute","value":4305120},"count":51},{"address":{"type":"absolute","value":4305125},"count":27},{"address":{"type":"absolute","value":4305130},"count":8},{"address":{"type":"absolute","value":4305140},"count":33},{"address":{"type":"absolute","value":4305145},"count":31},{"address":{"type":"absolute","value":4305150},"count":46},{"address":{"type":"absolute","value":4305155},"count":31},{"address":{"type":"absolute","value":4305160},"count":37},{"address":{"type":"absolute","value":4305165},"count":37},{"address":{"type":"absolute","value":4305170},"count":8},{"address":{"type":"absolute","value":4305185},"count":58},{"address":{"type":"absolute","value":4305190},"count":49},{"address":{"type":"absolute","value":4305195},"count":44},{"address":{"type":"absolute","value":4305205},"count":35},{"address":{"type":"absolute","value":4305210},"count":8},{"address":{"type":"absolute","value":4305220},"count":46},{"address":{"type":"absolute","value":4305225},"count":35},{"address":{"type":"absolute","value":4305230},"count":54},{"address":{"type":"absolute","value":4305235},"count":41},{"address":{"type":"absolute","value":4305245},"count":8},{"address":{"type":"absolute","value":4305250},"count":29},{"address":{"type":"absolute","value":4305255},"count":31},{"address":{"type":"absolute","value":4305260},"count":26},{"address":{"type":"absolute","value":4305270},"count":34},{"address":{"type":"absolute","value":4305275},"count":35},{"address":{"type":"absolute","value":4305280},"count":12},{"address":{"type":"absolute","value":4305285},"count":29},{"address":{"type":"absolute","value":4305290},"count":28},{"address":{"type":"absolute","value":4305295},"count":44},{"address":{"type":"absolute","value":4305300},"count":40},{"address":{"type":"absolute","value":4305310},"count":18},{"address":{"type":"absolute","value":4305315},"count":57},{"address":{"type":"absolute","value":4305320},"count":8},{"address":{"type":"absolute","value":4305325},"count":40},{"address":{"type":"absolute","value":4305330},"count":51},{"address":{"type":"absolute","value":4305335},"count":33},{"address":{"type":"absolute","value":4305340},"count":8},{"address":{"type":"absolute","value":4305345},"count":29},{"address":{"type":"absolute","value":4305350},"count":35},{"address":{"type":"absolute","value":4305355},"count":27},{"address":{"type":"absolute","value":4305360},"count":86},{"address":{"type":"absolute","value":4305365},"count":28},{"address":{"type":"absolute","value":4305370},"count":12},{"address":{"type":"absolute","value":4305375},"count":34},{"address":{"type":"absolute","value":4305380},"count":26},{"address":{"type":"absolute","value":4305390},"count":29},{"address":{"type":"absolute","value":4305395},"count":38},{"address":{"type":"absolute","value":4305405},"count":36},{"address":{"type":"absolute","value":4305410},"count":25},{"address":{"type":"absolute","value":4305425},"count":31},{"address":{"type":"absolute","value":4305430},"count":35},{"address":{"type":"absolute","value":4305435},"count":36},{"address":{"type":"absolute","value":4305445},"count":159},{"address":{"type":"absolute","value":4305450},"count":20},{"address":{"type":"absolute","value":4305460},"count":29},{"address":{"type":"absolute","value":4305465},"count":29},{"address":{"type":"absolute","value":4305475},"count":41},{"address":{"type":"absolute","value":4305480},"count":36},{"address":{"type":"absolute","value":4305485},"count":75},{"address":{"type":"absolute","value":4305490},"count":12},{"address":{"type":"absolute","value":4305495},"count":105},{"address":{"type":"absolute","value":4305500},"count":29},{"address":{"type":"absolute","value":4305510},"count":37},{"address":{"type":"absolute","value":4305515},"count":15},{"address":{"type":"absolute","value":4305525},"count":23},{"address":{"type":"absolute","value":4305535},"count":8},{"address":{"type":"absolute","value":4305550},"count":63},{"address":{"type":"absolute","value":4305555},"count":37},{"address":{"type":"absolute","value":4305560},"count":74},{"address":{"type":"absolute","value":4305565},"count":28},{"address":{"type":"absolute","value":4305570},"count":100},{"address":{"type":"absolute","value":4305575},"count":39},{"address":{"type":"absolute","value":4305580},"count":29},{"address":{"type":"absolute","value":4305585},"count":14},{"address":{"type":"absolute","value":4305600},"count":41},{"address":{"type":"absolute","value":4305610},"count":29},{"address":{"type":"absolute","value":4305620},"count":24},{"address":{"type":"absolute","value":4305630},"count":29},{"address":{"type":"absolute","value":4305635},"count":8},{"address":{"type":"absolute","value":4305645},"count":30},{"address":{"type":"absolute","value":4305650},"count":8},{"address":{"type":"absolute","value":4305655},"count":51},{"address":{"type":"absolute","value":4305660},"count":8},{"address":{"type":"absolute","value":4305665},"count":33},{"address":{"type":"absolute","value":4305675},"count":35},{"address":{"type":"absolute","value":4305680},"count":28},{"address":{"type":"absolute","value":4305685},"count":17},{"address":{"type":"absolute","value":4305690},"count":26},{"address":{"type":"absolute","value":4305695},"count":35},{"address":{"type":"absolute","value":4305700},"count":51},{"address":{"type":"absolute","value":4305705},"count":37},{"address":{"type":"absolute","value":4305715},"count":54},{"address":{"type":"absolute","value":4305720},"count":29},{"address":{"type":"absolute","value":4305725},"count":26},{"address":{"type":"absolute","value":4305730},"count":29},{"address":{"type":"absolute","value":4305735},"count":33},{"address":{"type":"absolute","value":4305740},"count":46},{"address":{"type":"absolute","value":4305745},"count":30},{"address":{"type":"absolute","value":4305750},"count":11},{"address":{"type":"absolute","value":4305765},"count":65},{"address":{"type":"absolute","value":4305775},"count":28},{"address":{"type":"absolute","value":4305780},"count":13},{"address":{"type":"absolute","value":4305785},"count":34},{"address":{"type":"absolute","value":4305790},"count":19},{"address":{"type":"absolute","value":4305800},"count":28},{"address":{"type":"absolute","value":4305805},"count":29},{"address":{"type":"absolute","value":4305810},"count":37},{"address":{"type":"absolute","value":4305815},"count":55},{"address":{"type":"absolute","value":4305820},"count":111},{"address":{"type":"absolute","value":4305825},"count":31},{"address":{"type":"absolute","value":4305830},"count":37},{"address":{"type":"absolute","value":4305840},"count":8},{"address":{"type":"absolute","value":4305845},"count":49},{"address":{"type":"absolute","value":4305850},"count":34},{"address":{"type":"absolute","value":4305855},"count":26},{"address":{"type":"absolute","value":4310928},"count":27},{"address":{"type":"absolute","value":4311056},"count":64},{"address":{"type":"absolute","value":4311408},"count":110},{"address":{"type":"absolute","value":4312432},"count":64},{"address":{"type":"absolute","value":4325724},"count":20},{"address":{"type":"absolute","value":4326006},"count":20},{"address":{"type":"absolute","value":4326736},"count":39},{"address":{"type":"absolute","value":4326864},"count":27},{"address":{"type":"absolute","value":4327024},"count":48},{"address":{"type":"absolute","value":4327568},"count":17},{"address":{"type":"absolute","value":4327622},"count":25},{"address":{"type":"absolute","value":4336094},"count":13},{"address":{"type":"absolute","value":4336159},"count":23},{"address":{"type":"absolute","value":4361150},"count":13},{"address":{"type":"absolute","value":4361215},"count":23},{"address":{"type":"absolute","value":4361870},"count":13},{"address":{"type":"absolute","value":4361935},"count":23},{"address":{"type":"absolute","value":4362600},"count":13},{"address":{"type":"absolute","value":4362665},"count":23},{"address":{"type":"absolute","value":4371168},"count":83},{"address":{"type":"absolute","value":4379632},"count":54},{"address":{"type":"absolute","value":4379904},"count":52},{"address":{"type":"absolute","value":4380112},"count":39},{"address":{"type":"absolute","value":4380272},"count":38},{"address":{"type":"absolute","value":4394451},"count":20},{"address":{"type":"absolute","value":4396848},"count":48},{"address":{"type":"absolute","value":4401568},"count":28},{"address":{"type":"absolute","value":4401680},"count":24},{"address":{"type":"absolute","value":4401776},"count":28},{"address":{"type":"absolute","value":4402832},"count":62},{"address":{"type":"absolute","value":4418944},"count":42},{"address":{"type":"absolute","value":4440528},"count":53},{"address":{"type":"absolute","value":4455904},"count":49},{"address":{"type":"absolute","value":4458064},"count":39},{"address":{"type":"absolute","value":4459008},"count":47},{"address":{"type":"absolute","value":4459296},"count":38},{"address":{"type":"absolute","value":4464512},"count":30},{"address":{"type":"absolute","value":4466544},"count":26},{"address":{"type":"absolute","value":4466656},"count":26},{"address":{"type":"absolute","value":4466768},"count":28},{"address":{"type":"absolute","value":4466992},"count":36},{"address":{"type":"absolute","value":4467216},"count":26},{"address":{"type":"absolute","value":4467632},"count":38},{"address":{"type":"absolute","value":4468080},"count":56},{"address":{"type":"absolute","value":4468510},"count":13},{"address":{"type":"absolute","value":4468575},"count":23},{"address":{"type":"absolute","value":4469230},"count":13},{"address":{"type":"absolute","value":4469295},"count":23},{"address":{"type":"absolute","value":4470448},"count":37},{"address":{"type":"absolute","value":4472852},"count":157},{"address":{"type":"absolute","value":4476272},"count":69},{"address":{"type":"absolute","value":4480208},"count":70},{"address":{"type":"absolute","value":4481456},"count":54},{"address":{"type":"absolute","value":4481728},"count":52},{"address":{"type":"absolute","value":4481936},"count":46},{"address":{"type":"absolute","value":4482224},"count":39},{"address":{"type":"absolute","value":4482384},"count":38},{"address":{"type":"absolute","value":4486000},"count":30},{"address":{"type":"absolute","value":4489616},"count":64},{"address":{"type":"absolute","value":4499520},"count":12},{"address":{"type":"absolute","value":4500326},"count":17},{"address":{"type":"absolute","value":4500365},"count":14},{"address":{"type":"absolute","value":4502963},"count":14},{"address":{"type":"absolute","value":4502990},"count":21},{"address":{"type":"absolute","value":4505102},"count":14},{"address":{"type":"absolute","value":4505121},"count":12},{"address":{"type":"absolute","value":4505600},"count":10},{"address":{"type":"absolute","value":4508544},"count":13},{"address":{"type":"absolute","value":4509056},"count":13},{"address":{"type":"absolute","value":4521360},"count":25},{"address":{"type":"absolute","value":4521368},"count":45},{"address":{"type":"absolute","value":4521600},"count":34},{"address":{"type":"absolute","value":4525888},"count":25},{"address":{"type":"absolute","value":4525896},"count":25},{"address":{"type":"absolute","value":4526192},"count":34},{"address":{"type":"absolute","value":4526200},"count":25},{"address":{"type":"absolute","value":4526211},"count":25},{"address":{"type":"absolute","value":4532208},"count":23}]},"library_functions":[{"address":{"type":"absolute","value":4319584},"name":"?"},{"address":{"type":"absolute","value":4325718},"name":"?"},{"address":{"type":"absolute","value":4326000},"name":"?"},{"address":{"type":"absolute","value":4394445},"name":"?"},{"address":{"type":"absolute","value":4471696},"name":"?GetPaltteMinSize@CMFCRibbonPanel@@IBE?AVCSize@@XZ"},{"address":{"type":"absolute","value":4497888},"name":"@_RTC_AllocaHelper@12"},{"address":{"type":"absolute","value":4497952},"name":"@_RTC_CheckStackVars2@12"},{"address":{"type":"absolute","value":4498592},"name":"__except_handler4"},{"address":{"type":"absolute","value":4498896},"name":"?find_pe_section@@YAPAU_IMAGE_SECTION_HEADER@@QAEI@Z"},{"address":{"type":"absolute","value":4499088},"name":"?is_potentially_valid_image_base@@YA_NQAX@Z"},{"address":{"type":"absolute","value":4499344},"name":"___scrt_dllmain_after_initialize_c"},{"address":{"type":"absolute","value":4499408},"name":"___scrt_dllmain_before_initialize_c"},{"address":{"type":"absolute","value":4499456},"name":"___scrt_dllmain_crt_thread_attach"},{"address":{"type":"absolute","value":4499552},"name":"___scrt_dllmain_exception_filter"},{"address":{"type":"absolute","value":4499648},"name":"___scrt_dllmain_uninitialize_c"},{"address":{"type":"absolute","value":4499712},"name":"___scrt_dllmain_uninitialize_critical"},{"address":{"type":"absolute","value":4500752},"name":"_at_quick_exit"},{"address":{"type":"absolute","value":4501648},"name":"___report_securityfailureEx"},{"address":{"type":"absolute","value":4502240},"name":"?pre_c_initialization@@YAHXZ"},{"address":{"type":"absolute","value":4502464},"name":"?post_pgo_initialization@@YAHXZ"},{"address":{"type":"absolute","value":4502480},"name":"?pre_cpp_initialization@@YAXXZ"},{"address":{"type":"absolute","value":4502512},"name":"?__scrt_common_main@@YAHXZ"},{"address":{"type":"absolute","value":4502544},"name":"?__scrt_common_main_seh@@YAHXZ"},{"address":{"type":"absolute","value":4503216},"name":"?invoke_main@@YAHXZ"},{"address":{"type":"absolute","value":4503408},"name":"?DebuggerProbe@@YA_NK@Z"},{"address":{"type":"absolute","value":4503488},"name":"?DebuggerRuntime@@YA_NKHPAXPB_W@Z"},{"address":{"type":"absolute","value":4503872},"name":"?_RTC_Failure@@YAXPAXH@Z"},{"address":{"type":"absolute","value":4504208},"name":"?_getMemBlockDataString@@YAXPAD0PBDI@Z"},{"address":{"type":"absolute","value":4504352},"name":"?_strlen_priv@@YAIPBD@Z"},{"address":{"type":"absolute","value":4504384},"name":"?failwithmessage@@YAXPAXHHPBD@Z"},{"address":{"type":"absolute","value":4505024},"name":"?notify_debugger@@YAXABUtagEXCEPTION_VISUALCPP_DEBUG_INFO@@@Z"},{"address":{"type":"absolute","value":4505184},"name":"__RTC_UninitUse"},{"address":{"type":"absolute","value":4505552},"name":"__RTC_GetErrDesc"},{"address":{"type":"absolute","value":4505696},"name":"__RTC_SetErrorType"},{"address":{"type":"absolute","value":4508000},"name":"___scrt_get_show_window_mode"},{"address":{"type":"absolute","value":4508512},"name":"?"},{"address":{"type":"absolute","value":4508576},"name":"__guard_icall_checks_enforced"},{"address":{"type":"absolute","value":4508640},"name":"___get_entropy"},{"address":{"type":"absolute","value":4509488},"name":"?GetPdbDll@@YAPAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":4509888},"name":"?GetPdbDllFromInstallPath@@YAPAUHINSTANCE__@@XZ"},{"address":{"type":"absolute","value":4510640},"name":"?GetPdbDllPathFromFilePath@@YAHPB_WPA_WI@Z"},{"address":{"type":"absolute","value":4512048},"name":"__except_handler4_noexcept"}],"apicall_count":1163,"import_count":638}},"rules":{"calculate modulo 256 via x86 assembly":{"meta":{"name":"calculate modulo 256 via x86 assembly","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"instruction"},"attack":[],"mbc":[{"parts":["Data","Modulo"],"objective":"Data","behavior":"Modulo","method":"","id":"C0058"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4049A9"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: calculate modulo 256 via x86 assembly\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: instruction\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Data::Modulo [C0058]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4049A9\n  features:\n    #  and ecx, 800000FFh\n    #  and ecx, 0FFh\n    - and:\n      - mnemonic: and\n      - or:\n        - number: 0x800000FF\n        - number: 0xFF\n","matches":[[{"type":"absolute","value":4399475},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":4399475}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483903}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":255}},"children":[],"locations":[{"type":"absolute","value":4399475}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: delay execution\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@ramen0x3f\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\n    examples:\n      - al-khaser_x86.exe_:0x449770\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.Sleep\n          - api: kernel32.SleepEx\n          - api: kernel32.WaitForSingleObject\n          - api: kernel32.SignalObjectAndWait\n          - api: kernel32.WaitForSingleObjectEx\n          - api: kernel32.WaitForMultipleObjects\n          - api: kernel32.WaitForMultipleObjectsEx\n          - api: kernel32.RegisterWaitForSingleObject\n          - api: WaitOnAddress\n          - api: user32.MsgWaitForMultipleObjects\n          - api: user32.MsgWaitForMultipleObjectsEx\n          - api: NtDelayExecution\n          - api: KeWaitForSingleObject\n          - api: KeDelayExecutionThread\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - or:\n          - api: sleep\n          - api: usleep\n","matches":[[{"type":"absolute","value":4414048},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4414140}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4447403},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4447427}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4332836},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4332840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4402572}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4496130},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[{"type":"absolute","value":4496136}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443807},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4443828}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4493940},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4493954}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4494371},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4494379}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4395785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4395798}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4396319},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4396332}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4495964},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4495974}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450881},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObject"}},"children":[],"locations":[{"type":"absolute","value":4450905}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: open process\n    authors:\n      - 0x534a@mailbox.org\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Open Process [C0065]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - or:\n      - api: kernel32.OpenProcess\n      - api: NtOpenProcess\n      - api: ZwOpenProcess\n","matches":[[{"type":"absolute","value":4446487},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4446517}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4352064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4352077}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4448742},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4448798}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4486608},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4486704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443309},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4443322}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4393952},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4394007}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450064},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4450094}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4476451},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4476474}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate memory":{"meta":{"name":"allocate memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate memory\n    authors:\n      - 0x534a@mailbox.org\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA  # ntdll.NtAllocateVirtualMemory\n  features:\n    - or:\n      - api: kernel32.VirtualAlloc\n      - api: kernel32.VirtualAllocEx\n      - api: kernel32.VirtualAllocExNuma\n      - api: NtAllocateVirtualMemory\n      - api: ZwAllocateVirtualMemory\n      - api: NtMapViewOfSection\n      - api: ZwMapViewOfSection\n      - and:\n        - match: link function at runtime on Windows\n        - or:\n          - string: \"VirtualAlloc\"\n          - string: \"VirtualAllocEx\"\n          - string: \"VirtualAllocExNuma\"\n          - string: \"NtAllocateVirtualMemory\"\n          - string: \"ZwAllocateVirtualMemory\"\n          - string: \"NtMapViewOfSection\"\n          - string: \"ZwMapViewOfSection\"\n","matches":[[{"type":"absolute","value":4446875},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4447016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4448846},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4448970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4399152},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399225}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4399284},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4444488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4444514}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4445082},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4445118}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4327280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4327449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443488},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398553}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398612},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398628}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4326128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4326191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397419},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397435}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4330096},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4330217}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400112},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400185}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400244},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450449},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4450590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RW memory":{"meta":{"name":"allocate or change RW memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate or change RW memory\n    authors:\n      - 0x534a@mailbox.org\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - and:\n      - or:\n        - match: allocate memory\n        - match: change memory protection\n      - or:\n        - number: 0x4 = PAGE_READWRITE\n        # lea     r9d, [rcx+4]  ; flProtect\n        # call    cs:VirtualAlloc\n        - instruction:\n          - mnemonic: lea\n          - offset: 0x4 = PAGE_READWRITE\n","matches":[[{"type":"absolute","value":4446875},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4447016}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4446875}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4446996}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4448846},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4448970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4448846}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4448947}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4399152},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399225}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399152}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4399211}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4444488},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4444514}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4444488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4444500}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4443488},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4443606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398480},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398553}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4398480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4398539}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398612},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4398628}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4398612}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4398614}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4326128},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4326191}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4326128}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4326177}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4397280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4397346}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397419},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4397435}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4397419}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4397421}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4330096},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4330217}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4330096}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4330179},{"type":"absolute","value":4330204}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4401872},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":4401979}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4401872}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4401968}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400112},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400185}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4400112}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4400171}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400244},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4400260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4400244}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4400246}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4450449},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4450590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4450449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4450570}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Program Files directory":{"meta":{"name":"get Program Files directory","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[],"references":[],"examples":["BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get Program Files directory\n    namespace: host-interaction/file-system\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    examples:\n      - BC452CC1128CCF7FA9F76D83CDA79132740414973600FED14509749FE946816E:0x407880\n  features:\n    - and:\n      - or:\n        - number: 0x26 = CSIDL_PROGRAM_FILES\n        - number: 0x2A = CSIDL_PROGRAM_FILESX86\n      - or:\n        - api: shell32.SHGetFolderPath\n        - api: shell32.SHGetFolderLocation\n        - api: shell32.SHGetSpecialFolderPath\n        - api: shell32.SHGetSpecialFolderLocation\n","matches":[[{"type":"absolute","value":4426650},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":4426654}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4426665}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4437988},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"CSIDL_PROGRAM_FILES"}},"children":[],"locations":[{"type":"absolute","value":4437992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":42,"description":"CSIDL_PROGRAM_FILESX86"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4438003}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process image filename":{"meta":{"name":"get process image filename","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\nrule:\n  meta:\n    name: get process image filename\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.K32GetProcessImageFileName\n          - api: kernel32.GetProcessImageFileName\n      - and:\n        - api: System.Diagnostics.Process::GetCurrentProcess\n        - property/read: System.Diagnostics.Process::MainModule\n        - property/read: System.Diagnostics.ProcessModule::FileName\n","matches":[[{"type":"absolute","value":4369433},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4369574}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4352146},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4352176}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304370},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4304370}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4496937},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32GetProcessImageFileName"}},"children":[],"locations":[{"type":"absolute","value":4496937}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcessImageFileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetCurrentProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::MainModule"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModule::FileName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open thread":{"meta":{"name":"open thread","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Open Thread"],"objective":"Process","behavior":"Open Thread","method":"","id":"C0066"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: open thread\n    authors:\n      - 0x534a@mailbox.org\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Open Thread [C0066]\n    examples:\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C\n  features:\n    - or:\n      - api: kernel32.OpenThread\n      - api: NtOpenThread\n      - api: ZwOpenThread\n","matches":[[{"type":"absolute","value":4449187},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":4449203}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4472638},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenThread"}},"children":[],"locations":[{"type":"absolute","value":4472651}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get Explorer PID":{"meta":{"name":"get Explorer PID","namespace":"host-interaction/process/list","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp"],"examples":["al-khaser_x86.exe_:0x425210"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get Explorer PID\n    namespace: host-interaction/process/list\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ParentProcess.cpp\n    examples:\n      - al-khaser_x86.exe_:0x425210\n  features:\n    - and:\n      - api: GetShellWindow\n      - api: GetWindowThreadProcessId\n","matches":[[{"type":"absolute","value":4346384},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetShellWindow"}},"children":[],"locations":[{"type":"absolute","value":4346449}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowThreadProcessId"}},"children":[],"locations":[{"type":"absolute","value":4346463}],"captures":{}}],"locations":[],"captures":{}}]]},"allocate or change RWX memory":{"meta":{"name":"allocate or change RWX memory","namespace":"host-interaction/process/inject","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: allocate or change RWX memory\n    namespace: host-interaction/process/inject\n    authors:\n      - \"@mr-tz\"\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Memory::Allocate Memory [C0007]\n    examples:\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n      # ntdll\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA\n  features:\n    - and:\n      - or:\n        - match: allocate memory\n        - match: change memory protection\n      - or:\n        - number: 0x40 = PAGE_EXECUTE_READWRITE\n        # lea     r9d, [rcx+40h]  ; flProtect\n        # call    cs:VirtualAlloc\n        - instruction:\n          - mnemonic: lea\n          - offset: 0x40 = PAGE_EXECUTE_READWRITE\n","matches":[[{"type":"absolute","value":4399284},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399284}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4399286}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4445082},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4445118}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445082}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4445084}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4327280},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4327449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4327280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4327436}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unexpected memory writes":{"meta":{"name":"check for unexpected memory writes","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Memory Write Watching"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Memory Write Watching","id":"B0001.010"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp"],"examples":["al-khaser_x86.exe_:0x431EBC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for unexpected memory writes\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Memory Write Watching [B0001.010]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/WriteWatch.cpp\n    examples:\n      - al-khaser_x86.exe_:0x431EBC\n  features:\n    - and:\n      - api: kernel32.GetWriteWatch\n      - number: 0x0\n","matches":[[{"type":"absolute","value":4399631},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4399663}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4399661}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4398713},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4398763}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4398761},{"type":"absolute","value":4398718}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397866},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4397885}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4397872},{"type":"absolute","value":4397874},{"type":"absolute","value":4397883},{"type":"absolute","value":4397876}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4397935},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4397967}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4397965}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4400345},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWriteWatch"}},"children":[],"locations":[{"type":"absolute","value":4400406}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0}},"children":[],"locations":[{"type":"absolute","value":4400404},{"type":"absolute","value":4400365}],"captures":{}}],"locations":[],"captures":{}}]]},"check for OutputDebugString error":{"meta":{"name":"check for OutputDebugString error","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","OutputDebugString"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"OutputDebugString","id":"B0001.016"}],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_:0x401020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for OutputDebugString error\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]\n    examples:\n      - Practical Malware Analysis Lab 16-02.exe_:0x401020\n  features:\n    - and:\n      - api: kernel32.SetLastError\n      - api: kernel32.GetLastError\n      - api: kernel32.OutputDebugString\n","matches":[[{"type":"absolute","value":4333602},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetLastError"}},"children":[],"locations":[{"type":"absolute","value":4333608}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetLastError"}},"children":[],"locations":[{"type":"absolute","value":4333643}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4333628}],"captures":{}}],"locations":[],"captures":{}}]]},"create process on Windows":{"meta":{"name":"create process on Windows","namespace":"host-interaction/process/create","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process"],"objective":"Process","behavior":"Create Process","method":"","id":"C0017"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x406DB0","Practical Malware Analysis Lab 01-04.exe_:0x4011FC","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create process on Windows\n    namespace: host-interaction/process/create\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Create Process [C0017]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: kernel32.WinExec\n      - api: kernel32.CreateProcess\n      - api: shell32.ShellExecute\n      - api: shell32.ShellExecuteEx\n      - api: advapi32.CreateProcessAsUser\n      - api: advapi32.CreateProcessWithLogon\n      - api: advapi32.CreateProcessWithToken\n      - api: kernel32.CreateProcessInternal\n      - api: ntdll.NtCreateUserProcess\n      - api: ntdll.NtCreateProcess\n      - api: ntdll.NtCreateProcessEx\n      - api: ntdll.ZwCreateProcess\n      - api: ZwCreateProcessEx\n      - api: ntdll.ZwCreateUserProcess\n      - api: ntdll.RtlCreateUserProcess\n      - api: System.Diagnostics.Process::Start\n","matches":[[{"type":"absolute","value":4444419},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WinExec"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":4444453}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecute"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ShellExecuteEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithLogon"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessWithToken"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessInternal"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateProcessEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Start"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create process suspended":{"meta":{"name":"create process suspended","namespace":"host-interaction/process/create","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Process","Create Suspended Process"],"objective":"Process","behavior":"Create Process","method":"Create Suspended Process","id":"C0017.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create process suspended\n    namespace: host-interaction/process/create\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Create Process::Create Suspended Process [C0017.003]\n    examples:\n      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n  features:\n    - and:\n      - or:\n        - number: 0x08000004 = CREATE_NO_WINDOW | CREATE_SUSPENDED\n        - number: 4 = CREATE_SUSPENDED\n      - or:\n        - api: kernel32.CreateProcess\n        - api: advapi32.CreateProcessAsUser\n","matches":[[{"type":"absolute","value":4444419},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":134217732,"description":"CREATE_NO_WINDOW | CREATE_SUSPENDED"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"CREATE_SUSPENDED"}},"children":[],"locations":[{"type":"absolute","value":4444439}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":4444453}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open file\n    authors:\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Create File [C0016]\n    examples:\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\n  features:\n    - or:\n      - api: CreateFile\n      - api: CreateFileEx\n      - api: IoCreateFile\n      - api: IoCreateFileEx\n      - api: ZwOpenFile\n      - api: ZwCreateFile\n      - api: NtOpenFile\n      - api: NtCreateFile\n      - api: LZCreateFile\n      - api: LZOpenFile\n      - api: fopen\n      - api: fopen64\n      - api: fdopen\n      - api: freopen\n      - api: open\n      - api: openat\n","matches":[[{"type":"absolute","value":4444623},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4444696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4437416},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4437444}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4426109},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4426137}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4408516},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4408608}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4408909},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4408933}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4409132},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4409154}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"resume thread":{"meta":{"name":"resume thread","namespace":"host-interaction/thread/resume","authors":["0x534a@mailbox.org","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Resume Thread"],"objective":"Process","behavior":"Resume Thread","method":"","id":"C0054"}],"references":[],"examples":["Practical Malware Analysis Lab 12-02.exe_:0x4010EA","787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x4044C7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: resume thread\n    namespace: host-interaction/thread/resume\n    authors:\n      - 0x534a@mailbox.org\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Resume Thread [C0054]\n    examples:\n      - Practical Malware Analysis Lab 12-02.exe_:0x4010EA\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x4044C7\n  features:\n    - or:\n      - api: kernel32.ResumeThread\n      - api: ntdll.NtResumeThread\n      - api: ntdll.ZwResumeThread\n      - api: System.Threading.Thread::Resume\n","matches":[[{"type":"absolute","value":4445368},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ResumeThread"}},"children":[],"locations":[{"type":"absolute","value":4445485}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Resume"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"PEB access":{"meta":{"name":"PEB access","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block","id":"B0001.019"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp"],"examples":["al-khaser_x86.exe_:0x420D20"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: PEB access\n    authors:\n      - michael.hunhoff@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires characteristic, offset, mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block [B0001.019]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp\n    examples:\n      - al-khaser_x86.exe_:0x420D20\n  features:\n    - or:\n      - characteristic: peb access\n      - and:\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L41\n        - arch: i386\n        - characteristic: fs access\n        - or:\n          # in 0f5d5d07c6533bc6d991836ce79daaa1\n          # then we have:\n          #\n          #     xor edx, edx\n          #     mov edx, fs:[edx+30h]\n          - offset: 0x30\n          - instruction:\n            # in the case of CallObfuscator, gs:[rax]\n            - mnemonic: add\n            - number: 0x30\n      - and:\n        - arch: amd64\n        - characteristic: gs access\n        - or:\n          - offset: 0x60\n          - instruction:\n            - mnemonic: add\n            - number: 0x60\n      - and:\n        # WoW64 PEB address is fetched via the WoW64 Thread Environment Block (TEB) at FS:[0x18]-0x2000\n        # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtGlobalFlag.cpp#L45\n        - characteristic: fs access\n        - instruction:\n          - mnemonic: sub\n          - number: 0x2000\n","matches":[[{"type":"absolute","value":4402352},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347051},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347380},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4328736},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4328802}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4328826},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328826}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"sub"}},"children":[],"locations":[{"type":"absolute","value":4328832}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8192}},"children":[],"locations":[{"type":"absolute","value":4328832}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328832}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328826}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[{"type":"absolute","value":4328843}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4410192},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4410298}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4410298}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4410298}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4325232},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file attributes":{"meta":{"name":"get file attributes","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["File System","Get File Attributes"],"objective":"File System","behavior":"Get File Attributes","method":"","id":"C0049"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x180019824","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get file attributes\n    namespace: host-interaction/file-system/meta\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Get File Attributes [C0049]\n    examples:\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x180019824\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0\n  features:\n    - or:\n      - api: kernel32.GetFileAttributes\n      - api: ZwQueryDirectoryFile\n      - api: ZwQueryInformationFile\n      - api: NtQueryDirectoryFile\n      - api: NtQueryInformationFile\n      - api: System.IO.File::GetAttributes\n      - api: System.IO.File::GetCreationTime\n      - api: System.IO.File::GetCreationTimeUtc\n      - api: System.IO.File::GetLastAccessTime\n      - api: System.IO.File::GetLastAccessTimeUtc\n      - api: System.IO.File::GetLastWriteTime\n      - api: System.IO.File::GetLastWriteTimeUtc\n      - property/read: System.IO.FileSystemInfo::Attributes\n      - api: stat\n      - api: fstat\n      - api: lstat\n      - api: fstatat\n","matches":[[{"type":"absolute","value":4491536},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491582}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4491696},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491742}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for trap flag exception":{"meta":{"name":"check for trap flag exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp"],"examples":["al-khaser_x86.exe_:0x431680","al-khaser_x64.exe_:0x140030CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for trap flag exception\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/TrapFlag.cpp\n    examples:\n      - al-khaser_x86.exe_:0x431680\n      - al-khaser_x64.exe_:0x140030CB0\n  features:\n    - and:\n      - or:\n        - description: read/write EFLAGS register\n        - and:\n          - mnemonic: pushf\n          - mnemonic: popf\n        - and:\n          - mnemonic: pushfd\n          - mnemonic: popfd\n        - and:\n          - mnemonic: pushfq\n          - mnemonic: popfq\n      - or:\n        - description: set trap flag\n        - instruction:\n          - mnemonic: or\n          - number: 0x100\n        - instruction:\n          - mnemonic: bts\n          - number: 0x8\n","matches":[[{"type":"absolute","value":4396672},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"set trap flag"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"or"}},"children":[],"locations":[{"type":"absolute","value":4396755}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":256}},"children":[],"locations":[{"type":"absolute","value":4396755}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4396755}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for trap flag exception/8f42090aeea146eb877b2bb5d3621373"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"read/write EFLAGS register"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushf"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popf"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfd"}},"children":[],"locations":[{"type":"absolute","value":4396747}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfd"}},"children":[],"locations":[{"type":"absolute","value":4396767}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"pushfq"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"popfq"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create or open registry key\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Operating System::Registry::Create Registry Key [C0036.004]\n      - Operating System::Registry::Open Registry Key [C0036.003]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\n      - 493167E85E45363D09495D0841C30648:0x404D60\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: advapi32.RegOpenKey\n      - api: advapi32.RegOpenKeyEx\n      - api: advapi32.RegCreateKey\n      - api: advapi32.RegCreateKeyEx\n      - api: advapi32.RegOpenCurrentUser\n      - api: advapi32.RegOpenKeyTransacted\n      - api: advapi32.RegOpenUserClassesRoot\n      - api: advapi32.RegCreateKeyTransacted\n      - api: ZwOpenKey\n      - api: ZwOpenKeyEx\n      - api: ZwCreateKey\n      - api: ZwOpenKeyTransacted\n      - api: ZwOpenKeyTransactedEx\n      - api: ZwCreateKeyTransacted\n      - api: NtOpenKey\n      - api: NtCreateKey\n      - api: SHRegOpenUSKey\n      - api: SHRegCreateUSKey\n      - api: RtlCreateRegistryKey\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\n","matches":[[{"type":"absolute","value":4478944},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":4479054}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4479264},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":4479374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"change memory protection":{"meta":{"name":"change memory protection","authors":["@mr-tz"],"scopes":{"static":"basic block","dynamic":"call"},"attack":[],"mbc":[{"parts":["Memory","Change Memory Protection"],"objective":"Memory","behavior":"Change Memory Protection","method":"","id":"C0008"}],"references":[],"examples":["Practical Malware Analysis Lab 11-02.dll_:0x10001203"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: change memory protection\n    authors:\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Memory::Change Memory Protection [C0008]\n    examples:\n      - Practical Malware Analysis Lab 11-02.dll_:0x10001203\n  features:\n    - or:\n      - api: kernel32.VirtualProtect\n      - api: kernel32.VirtualProtectEx\n      - api: NtProtectVirtualMemory\n      - api: ZwProtectVirtualMemory\n      - and:\n        - match: link function at runtime on Windows\n        - or:\n          - string: \"VirtualProtect\"\n          - string: \"VirtualProtectEx\"\n          - string: \"NtProtectVirtualMemory\"\n          - string: \"ZwProtectVirtualMemory\"\n","matches":[[{"type":"absolute","value":4327478},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":4327516}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4401872},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtect"}},"children":[],"locations":[{"type":"absolute","value":4401979}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtect"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualProtectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwProtectVirtualMemory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create thread":{"meta":{"name":"create thread","namespace":"host-interaction/thread/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Create Thread"],"objective":"Process","behavior":"Create Thread","method":"","id":"C0038"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x10001DA0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create thread\n    namespace: host-interaction/thread/create\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - joakim@intezer.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Create Thread [C0038]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.CreateThread\n          - api: _beginthread\n          - api: _beginthreadex\n          - api: PsCreateSystemThread\n          - api: SHCreateThread\n          - api: SHCreateThreadWithHandle\n          - api: kernel32.CreateRemoteThread\n          - api: kernel32.CreateRemoteThreadEx\n          - api: RtlCreateUserThread\n          - api: ntdll.NtCreateThread\n          - api: ntdll.NtCreateThreadEx\n          - api: ntdll.ZwCreateThread\n          - api: ntdll.ZwCreateThreadEx\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - api: pthread_create\n      - and:\n        - api: System.Threading.Thread::Start\n        - optional:\n          - api: System.Threading.Thread::ctor\n","matches":[[{"type":"absolute","value":4443748},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":4443770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4396128},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[{"type":"absolute","value":4396192}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap flags":{"meta":{"name":"get process heap flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get process heap flags\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_Flags.cpp#L13\n    examples:\n      - al-khaser_x86.exe_:0x425470\n  features:\n    - and:\n      - match: PEB access\n      - or:\n        - and:\n          - arch: i386\n          - number: 0x18 = PEB->ProcessHeap\n          - or:\n            - number: 0x40 = ProcessHeap->HeapFlags >= Vista\n            - number: 0xC = ProcessHeap->HeapFlags < Vista\n        - and:\n          - arch: amd64\n          - number: 0x30 = PEB->ProcessHeap\n          - or:\n            - number: 0x70 = ProcessHeap->HeapFlags >= Vista\n            - number: 0x14 = ProcessHeap->HeapFlags < Vista\n","matches":[[{"type":"absolute","value":4347051},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347057}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":4347068}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347051}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"ProcessHeap->HeapFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":20,"description":"ProcessHeap->HeapFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"access PEB ldr_data":{"meta":{"name":"access PEB ldr_data","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm","https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8"],"examples":["3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: access PEB ldr_data\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    references:\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb_ldr_data.htm\n      - https://github.com/d35ha/CallObfuscator/blob/5834aff9ff4511f1408ae4ce80b79737af4ae77b/ShellCode/shell_x64.asm#L8\n    examples:\n      - 3FDFB2D522E7DEECAAAF2F87420F7E75:0x4117B7\n  features:\n    - or:\n      - and:\n        - arch: i386\n        - description: x32\n\n        - match: PEB access\n\n        # x86 Windows uses fs:0 to access the TIB which contains SEH information at offset 0\n        # checking for fs:0 and a (possibly unrelated) number or offset often results in false positives\n\n        - offset: 0x0C = PEB.LDR_DATA\n\n        - or:\n          - description: resolve a module list\n          - offset: 0x0C = PEB.LDR_DATA.InLoadOrderModuleList\n          - offset: 0x14 = PEB.LDR_DATA.InMemoryOrderModuleList\n          - offset: 0x1C = PEB.LDR_DATA.InInitializationOrderModuleList\n\n      - and:\n        - arch: amd64\n        - description: x64\n\n        - match: PEB access\n\n        - offset: 0x18 = PEB.LDR_DATA\n\n        - or:\n          - description: resolve a module list\n          - offset: 0x10 = PEB.LDR_DATA.InLoadOrderModuleList\n          - offset: 0x20 = PEB.LDR_DATA.InMemoryOrderModuleList\n          - offset: 0x30 = PEB.LDR_DATA.InInitializationOrderModuleList\n","matches":[[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402144},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402258}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402268}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get ntdll base address":{"meta":{"name":"get ntdll base address","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":["https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm"],"examples":["67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x40694A"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get ntdll base address\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    references:\n      - https://idafchev.github.io/exploit/2017/09/26/writing_windows_shellcode.html\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/ldr_data_table_entry.htm\n    examples:\n      - 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d:0x40694A\n  features:\n    - and:\n      # PEB -> PEB.Ldr -> PEB_LDR_DATA.InLoadOrderModuleList.Flink\n      - match: access PEB ldr_data\n      # -> current module\n      - count(offset(0)): 1\n      # -> ntdll -> LDR_DATA_TABLE_ENTRY.DllBase\n      - or:\n        - and:\n          - arch: i386\n          - offset: 0x18 = LDR_DATA_TABLE_ENTRY.DllBase\n        - and:\n          - arch: amd64\n          - offset: 0x30 = LDR_DATA_TABLE_ENTRY.DllBase\n","matches":[[{"type":"absolute","value":4347076},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4347093}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347076}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":4347091}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":4347082}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402144},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"access PEB ldr_data"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and","description":"x32"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402209}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":20,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":28,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[{"type":"absolute","value":4402258}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"x64"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402184}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"PEB.LDR_DATA"}},"children":[],"locations":[{"type":"absolute","value":4402268}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or","description":"resolve a module list"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"PEB.LDR_DATA.InLoadOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":32,"description":"PEB.LDR_DATA.InMemoryOrderModuleList"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"PEB.LDR_DATA.InInitializationOrderModuleList"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402144}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":1,"max":1,"child":{"type":"offset","offset":0}}},"children":[],"locations":[{"type":"absolute","value":4402280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[{"type":"absolute","value":4402268}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48,"description":"LDR_DATA_TABLE_ENTRY.DllBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get process heap force flags":{"meta":{"name":"get process heap force flags","namespace":"host-interaction/process","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14"],"examples":["al-khaser_x86.exe_:0x425470"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get process heap force flags\n    namespace: host-interaction/process\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiDebug/ProcessHeap_ForceFlags.cpp#L14\n    examples:\n      - al-khaser_x86.exe_:0x425470\n  features:\n    - and:\n      - match: PEB access\n      - or:\n        - and:\n          - arch: i386\n          - number: 0x18 = PEB->ProcessHeap\n          - or:\n            - number: 0x44 = ProcessHeap->ForceFlags >= Vista\n            - number: 0x10 = ProcessHeap->ForceFlags < Vista\n        - and:\n          - arch: amd64\n          - number: 0x30 = PEB->ProcessHeap\n          - or:\n            - number: 0x74 = ProcessHeap->ForceFlags >= Vista\n            - number: 0x18 = ProcessHeap->ForceFlags < Vista\n","matches":[[{"type":"absolute","value":4347355},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347361}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[{"type":"absolute","value":4347372}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347355}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347361}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4347380},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347386}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":68,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347397}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":48,"description":"PEB->ProcessHeap"}},"children":[],"locations":[{"type":"absolute","value":4347380}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":116,"description":"ProcessHeap->ForceFlags >= Vista"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"ProcessHeap->ForceFlags < Vista"}},"children":[],"locations":[{"type":"absolute","value":4347386}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via IOCTL":{"meta":{"name":"interact with driver via IOCTL","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x40108c"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: interact with driver via IOCTL\n    namespace: host-interaction/driver\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    examples:\n      - Practical Malware Analysis Lab 10-03.exe_:0x40108c\n  features:\n    - or:\n      - api: DeviceIoControl\n","matches":[[{"type":"absolute","value":4408703},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4408754}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4408955},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4408982}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4409176},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4409203}],"captures":{}}],"locations":[],"captures":{}}]]},"acquire debug privileges":{"meta":{"name":"acquire debug privileges","namespace":"host-interaction/process/modify","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x401174"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: acquire debug privileges\n    namespace: host-interaction/process/modify\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: thread\n    att&ck:\n      - Privilege Escalation::Access Token Manipulation [T1134]\n    examples:\n      - Practical Malware Analysis Lab 01-04.exe_:0x401174\n  features:\n    - and:\n      - string: \"SeDebugPrivilege\"\n      - optional:\n        - match: modify access privileges\n","matches":[[{"type":"absolute","value":4479868},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"SeDebugPrivilege"}},"children":[],"locations":[{"type":"absolute","value":4479906}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"modify access privileges"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB BeingDebugged flag":{"meta":{"name":"check for PEB BeingDebugged flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"basic block"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block BeingDebugged"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block BeingDebugged","id":"B0001.035"}],"references":["Practical Malware Analysis, Chapter 16, p. 353"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for PEB BeingDebugged flag\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires offset features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block BeingDebugged [B0001.035]\n    references:\n      - Practical Malware Analysis, Chapter 16, p. 353\n    examples:\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\n  features:\n    - and:\n      - match: PEB access\n      - offset: 2 = PEB.BeingDebugged\n","matches":[[{"type":"absolute","value":4325232},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4325272}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4325232}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":2,"description":"PEB.BeingDebugged"}},"children":[],"locations":[{"type":"absolute","value":4325284}],"captures":{}}],"locations":[],"captures":{}}]]},"contain loop":{"meta":{"name":"contain loop","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[],"references":[],"examples":["08AC667C65D36D6542917655571E61C8:0x406EAA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain loop\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    examples:\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - characteristic: loop\n      - characteristic: tight loop\n      - characteristic: recursive call\n","matches":[[{"type":"absolute","value":4300810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300810}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300840},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300840}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300895},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300895}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300915}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300975},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300975}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4300980},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4300980}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301110},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301110}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301120}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301140}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301150}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301200},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301200}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301265},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301265}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301275},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301275}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301420},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301420}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301460},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301460}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301545},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301545}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301625},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301625}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301760}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301785}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301835},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301835}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301905},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301905}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301915}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302020},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302110},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302110}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302160}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302165},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302165}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302190},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302190}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302215},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302215}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302260},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302285},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302285}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302305},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302305}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302375},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[{"type":"absolute","value":4502144}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302420},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302420}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302425},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302425}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302450},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302450}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302480}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302495},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302495}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302535},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302535}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302635},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302635}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302675},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302675}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302685},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302685}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302705}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302715}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302750}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302810},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302810}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302830},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302830}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302950},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302965},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302965}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302970}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302975},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4302975}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303130},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303130}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303270},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303270}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303355},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303355}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303430},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303430}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303460},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303460}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303470},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303470}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303505},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303505}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303510}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303745},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303745}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303880},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303880}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303920},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303920}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303925},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303925}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303950},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303950}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304070},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304070}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304090},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304090}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304095},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304095}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304105},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304105}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304145},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304145}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304225},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304225}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304440},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304440}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304520}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304535},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304535}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304605},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304605}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304635},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304635}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304645},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304645}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304725},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304725}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304735},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304735}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304740}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304845},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304845}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304945},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304945}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304995},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4304995}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305005}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305010},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305010}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305085}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305115},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305115}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305195}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305315}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305330},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305330}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305360},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305360}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305495},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305495}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305550}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305560}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305575},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305575}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305715},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305715}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305785}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305815},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305820},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305820}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305845},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4305845}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4371168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4371168}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4379632},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4379632}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4379904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4379904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4402832}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4440528},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4440528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4455904},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4455904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4476272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4476272}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4481456},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4481456}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4481728},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4481728}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4489616},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4489616}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for unmoving mouse cursor":{"meta":{"name":"check for unmoving mouse cursor","namespace":"anti-analysis/anti-vm/vm-detection","authors":["BitsOfBinary"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","User Activity Based Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"User Activity Based Checks","id":"T1497.002"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection","Human User Check"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"Human User Check","id":"B0009.012"}],"references":["https://www.joesecurity.org/blog/5852460122427342172"],"examples":["d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for unmoving mouse cursor\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - BitsOfBinary\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection::Human User Check [B0009.012]\n    references:\n      - https://www.joesecurity.org/blog/5852460122427342172\n    examples:\n      - d7ff81ff775d4ab50d31ac1e962c8c4dea7ff9f280aa2b42ddd06760a5665002:0x401118\n  features:\n    - and:\n      - count(api(user32.GetCursorPos)): 2 or more\n","matches":[[{"type":"absolute","value":4300960},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetCursorPos"}}},"children":[],"locations":[{"type":"absolute","value":4414120},{"type":"absolute","value":4414159}],"captures":{}}],"locations":[],"captures":{}}]]},"reference WMI statements":{"meta":{"name":"reference WMI statements","namespace":"collection/database/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Collection","Data from Information Repositories"],"tactic":"Collection","technique":"Data from Information Repositories","subtechnique":"","id":"T1213"}],"mbc":[],"references":[],"examples":["al-khaser_x86.exe_:0x433490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference WMI statements\n    namespace: collection/database/wmi\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Data from Information Repositories [T1213]\n    examples:\n      - al-khaser_x86.exe_:0x433490\n  features:\n    - or:\n      - string: /SELECT\\s+\\*\\s+FROM\\s+CIM_./\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_./\n      - string: /SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./\n","matches":[[{"type":"absolute","value":4301005},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4432807}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":4432807}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404152}],"captures":{"SELECT * FROM CIM_Sensor":[{"type":"absolute","value":4404152}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301150},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4430647}],"captures":{"SELECT * FROM Win32_NetworkAdapterConfiguration":[{"type":"absolute","value":4430647}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301280},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4411735}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":4411735}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415176}],"captures":{"SELECT * FROM Win32_PerfFormattedData_Counters_ThermalZoneInformation":[{"type":"absolute","value":4415176}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301520},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4427093}],"captures":{"SELECT * FROM Win32_NTEventlogFile":[{"type":"absolute","value":4427093}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404024}],"captures":{"SELECT * FROM CIM_PhysicalConnector":[{"type":"absolute","value":4404024}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301910},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415432}],"captures":{"SELECT * FROM Win32_PortConnector":[{"type":"absolute","value":4415432}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302035},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4418856}],"captures":{"SELECT * FROM Win32_SMBIOSMemory":[{"type":"absolute","value":4418856}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302085},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415911}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":4415911}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302175},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4403896}],"captures":{"SELECT * FROM CIM_NumericSensor":[{"type":"absolute","value":4403896}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302320},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4402744}],"captures":{"SELECT * FROM Win32_CacheMemory":[{"type":"absolute","value":4402744}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302480},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4431799}],"captures":{"SELECT * FROM Win32_PnPEntity":[{"type":"absolute","value":4431799}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302685},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4433607}],"captures":{"SELECT * FROM Win32_PnPDevice":[{"type":"absolute","value":4433607}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302705},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4413239}],"captures":{"SELECT * FROM Win32_ComputerSystem":[{"type":"absolute","value":4413239}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302745},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4403768}],"captures":{"SELECT * FROM CIM_Memory":[{"type":"absolute","value":4403768}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302960},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4413032}],"captures":{"SELECT * FROM Win32_MemoryDevice":[{"type":"absolute","value":4413032}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302970},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4417079}],"captures":{"SELECT * FROM Win32_BIOS":[{"type":"absolute","value":4417079}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4415304}],"captures":{"SELECT * FROM Win32_PhysicalMemory":[{"type":"absolute","value":4415304}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303510},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4407445}],"captures":{"SELECT * FROM Win32_LogicalDisk":[{"type":"absolute","value":4407445}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303720},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4412904}],"captures":{"SELECT * FROM Win32_MemoryArray":[{"type":"absolute","value":4412904}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303745},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4404750}],"captures":{"SELECT * FROM Win32_Fan":[{"type":"absolute","value":4404750}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304165},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404280}],"captures":{"SELECT * FROM CIM_Slot":[{"type":"absolute","value":4404280}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304315},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4425015}],"captures":{"SELECT * FROM Win32_Bus":[{"type":"absolute","value":4425015}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304635},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4414487}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":4414487}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305160},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404536}],"captures":{"SELECT * FROM CIM_VoltageSensor":[{"type":"absolute","value":4404536}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4423975}],"captures":{"SELECT * FROM Win32_BaseBoard":[{"type":"absolute","value":4423975}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4419224}],"captures":{"SELECT * FROM Win32_VoltageProbe":[{"type":"absolute","value":4419224}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305815},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[{"type":"absolute","value":4406343}],"captures":{"SELECT * FROM MSAcpi_ThermalZoneTemperature":[{"type":"absolute","value":4406343}]}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305830},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[{"type":"absolute","value":4404408}],"captures":{"SELECT * FROM CIM_TemperatureSensor":[{"type":"absolute","value":4404408}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4402832},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+CIM_./"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_./"}},"children":[],"locations":[{"type":"absolute","value":4402951}],"captures":{"SELECT * FROM Win32_VideoController":[{"type":"absolute","value":4402951}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+MSAcpi_./"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write process memory":{"meta":{"name":"write process memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Defense Evasion","Process Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"","id":"T1055"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: write process memory\n    authors:\n      - moritz.raabe@mandiant.com\n    lib: true\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Defense Evasion::Process Injection [T1055]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\n  features:\n    - or:\n      - api: kernel32.WriteProcessMemory\n      - api: ntdll.NtWriteVirtualMemory\n      - api: ntdll.ZwWriteVirtualMemory\n      - api: NtWow64WriteVirtualMemory64\n","matches":[[{"type":"absolute","value":4301025},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4447116}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4449068}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4445204},{"type":"absolute","value":4445350},{"type":"absolute","value":4445407}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4443714}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305570},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4450690}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"link function at runtime on Windows":{"meta":{"name":"link function at runtime on Windows","namespace":"linking/runtime-linking","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x404130","Practical Malware Analysis Lab 01-04.exe_:0x401350"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: link function at runtime on Windows\n    namespace: linking/runtime-linking\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x404130\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\n  features:\n    - and:\n      - os: windows\n      - or:\n        - api: kernel32.GetProcAddress\n        - api: ntdll.LdrGetProcedureAddress\n      - optional:\n        - characteristic: indirect call\n        - api: kernel32.LoadLibrary\n        - api: kernel32.GetModuleHandle\n        - api: kernel32.GetModuleHandleEx\n        - api: ntdll.LdrLoadDll\n","matches":[[{"type":"absolute","value":4301025},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4446824},{"type":"absolute","value":4446683},{"type":"absolute","value":4446726}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4447337},{"type":"absolute","value":4447291}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4446569},{"type":"absolute","value":4446621}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4448694}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4448619}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4445034}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4445069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4445020}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302420},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4453977}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":4453918}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302465},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4442097}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4442047}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4443443}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4443374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305570},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4450300},{"type":"absolute","value":4450398},{"type":"absolute","value":4450199}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4450769},{"type":"absolute","value":4450815}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4450225},{"type":"absolute","value":4450143}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305765},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4451770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[{"type":"absolute","value":4451695}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305820},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4511151}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4511233},{"type":"absolute","value":4511395},{"type":"absolute","value":4511580},{"type":"absolute","value":4511560},{"type":"absolute","value":4511690},{"type":"absolute","value":4511499},{"type":"absolute","value":4511275},{"type":"absolute","value":4511786},{"type":"absolute","value":4511600},{"type":"absolute","value":4511540},{"type":"absolute","value":4511317},{"type":"absolute","value":4511446},{"type":"absolute","value":4511196},{"type":"absolute","value":4511356}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305845},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4328463}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrGetProcedureAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LoadLibrary"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LdrLoadDll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query environment variable":{"meta":{"name":"query environment variable","namespace":"host-interaction/environment-variable","authors":["michael.hunhoff@mandiant.com","@_re_fox"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["Practical Malware Analysis Lab 14-02.exe_:0x401880","0761142efbda6c4b1e801223de723578:0x65483490"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query environment variable\n    namespace: host-interaction/environment-variable\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@_re_fox\"\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - Practical Malware Analysis Lab 14-02.exe_:0x401880\n      - 0761142efbda6c4b1e801223de723578:0x65483490\n  features:\n    - or:\n      - api: kernel32.GetEnvironmentVariable\n      - api: kernel32.GetEnvironmentStrings\n      - api: kernel32.ExpandEnvironmentStrings\n      - api: msvcr90.getenv\n      - api: msvcrt.getenv\n      - api: System.Environment::GetEnvironmentVariable\n      - api: System.Environment::GetEnvironmentVariables\n      - api: System.Environment::ExpandEnvironmentVariables\n","matches":[[{"type":"absolute","value":4301060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":4426635}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301125},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":4369648}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303780},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[{"type":"absolute","value":4397590}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305655},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetEnvironmentStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ExpandEnvironmentStrings"}},"children":[],"locations":[{"type":"absolute","value":4437973}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getenv"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariable"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetEnvironmentVariables"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::ExpandEnvironmentVariables"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get common file path":{"meta":{"name":"get common file path","namespace":"host-interaction/file-system","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10003415","972B219F18379907A045431303F4DA7D:0x404887"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get common file path\n    namespace: host-interaction/file-system\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\n      - 972B219F18379907A045431303F4DA7D:0x404887\n  features:\n    - or:\n      - api: kernel32.GetTempPath\n      - api: kernel32.GetTempFileName\n      - api: kernel32.GetSystemDirectory\n      - api: kernel32.GetWindowsDirectory\n      - api: kernel32.GetSystemWow64Directory\n      - api: GetAllUsersProfileDirectory\n      - api: GetAppContainerFolderPath\n      - api: GetCurrentDirectory\n      - api: GetDefaultUserProfileDirectory\n      - api: GetProfilesDirectory\n      - api: GetUserProfileDirectory\n      - api: SHGetFolderPathAndSubDir\n      - api: shell32.SHGetFolderPath\n      - api: shell32.SHGetFolderLocation\n      - api: shell32.SHGetKnownFolderPath\n      - api: shell32.SHGetSpecialFolderPath\n      - api: shell32.SHGetSpecialFolderLocation\n      - api: System.IO.Directory::GetCurrentDirectory\n      - api: System.Environment::GetFolderPath\n      - property/read: System.Environment::SystemDirectory\n      - property/read: System.Environment::CurrentDirectory\n","matches":[[{"type":"absolute","value":4301060},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4426665}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301125},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[{"type":"absolute","value":4369447}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4369477}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301545},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":4428784}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305560},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[{"type":"absolute","value":4438548}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305655},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetTempFileName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetWindowsDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemWow64Directory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAllUsersProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAppContainerFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDefaultUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProfilesDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetUserProfileDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPathAndSubDir"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetKnownFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderPath"}},"children":[],"locations":[{"type":"absolute","value":4438003}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetSpecialFolderLocation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.Directory::GetCurrentDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::GetFolderPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::SystemDirectory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::CurrentDirectory"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate process modules":{"meta":{"name":"enumerate process modules","namespace":"host-interaction/process/modules/list","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[],"references":[],"examples":["6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8","9B2FD471274C41626B75DDBB5C897877:0x100046B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate process modules\n    namespace: host-interaction/process/modules/list\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    examples:\n      - 6F99A2C8944CB02FF28C6F9CED59B161:0x419FF8\n      - 9B2FD471274C41626B75DDBB5C897877:0x100046B0\n  features:\n    - or:\n      - and:\n        - optional:\n          - or:\n            - api: kernel32.OpenProcess\n            - api: kernel32.CloseHandle\n        - or:\n          - api: kernel32.K32EnumProcessModules\n          - api: kernel32.K32EnumProcessModulesEx\n          - api: kernel32.K32EnumProcesses\n          # depending on OS version in kernel32 or psapi\n          - api: EnumProcessModules\n          - api: EnumProcessModulesEx\n          - api: EnumProcesses\n      - and:\n        - api: kernel32.Module32First\n        - api: kernel32.Module32Next\n        - optional:\n          - basic block:\n            - and:\n              - or:\n                - number: 0x8 = TH32CS_SNAPMODULE\n                - number: 0x10 = TH32CS_SNAPMODULE32\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\n              - api: kernel32.CreateToolhelp32Snapshot\n          - call:\n            - and:\n              - or:\n                - number: 0x8 = TH32CS_SNAPMODULE\n                - number: 0x10 = TH32CS_SNAPMODULE32\n                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32\n              - api: kernel32.CreateToolhelp32Snapshot\n      - and:\n        - property/read: System.Diagnostics.Process::Modules\n        - property/read: System.Diagnostics.ProcessModuleCollection::Item\n","matches":[[{"type":"absolute","value":4301120},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":4448162}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":4448221}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4448127}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[{"type":"absolute","value":4448125}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4448064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4448236}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303270},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[{"type":"absolute","value":4378515}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[{"type":"absolute","value":4378605}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4378424}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":8,"description":"TH32CS_SNAPMODULE"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":16,"description":"TH32CS_SNAPMODULE32"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":24,"description":"TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32"}},"children":[],"locations":[{"type":"absolute","value":4378422}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4378352}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4378651}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303940},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/deb8b2ecab5a49749ded4b3b54b1faaa"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[{"type":"absolute","value":4497339},{"type":"absolute","value":4303940}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305095},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/deb8b2ecab5a49749ded4b3b54b1faaa"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[{"type":"absolute","value":4497345},{"type":"absolute","value":4305095}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4476272},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Process::Modules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.ProcessModuleCollection::Item"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32First"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Module32Next"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/deb8b2ecab5a49749ded4b3b54b1faaa"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate process modules/5278f7a406a54bd3a6b33020bac04d26"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4476474}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4476570}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModules"}},"children":[],"locations":[{"type":"absolute","value":4476525}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"K32EnumProcesses"}},"children":[],"locations":[{"type":"absolute","value":4476380}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModules"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcessModulesEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumProcesses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get disk information":{"meta":{"name":"get disk information","namespace":"host-interaction/hardware/storage","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0","972B219F18379907A045431303F4DA7D:0x41064E"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get disk information\n    namespace: host-interaction/hardware/storage\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n      - 972B219F18379907A045431303F4DA7D:0x41064E\n  features:\n    - or:\n      - api: kernel32.GetDriveType\n      - api: kernel32.GetLogicalDrives\n      - api: kernel32.GetVolumeInformation\n      - api: kernel32.GetVolumeNameForVolumeMountPoint\n      - api: kernel32.GetVolumePathNamesForVolumeName\n      - api: kernel32.GetLogicalDriveStrings\n      - api: kernel32.QueryDosDevice\n      - property/read: System.IO.DriveInfo::VolumeLabel\n      - property/read: System.IO.DriveInfo::DriveType\n      - property/read: System.IO.DriveInfo::DriveFormat\n      - property/read: System.IO.DriveInfo::Name\n","matches":[[{"type":"absolute","value":4301125},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":4369690}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4371168},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDrives"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumeNameForVolumeMountPoint"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVolumePathNamesForVolumeName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetLogicalDriveStrings"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryDosDevice"}},"children":[],"locations":[{"type":"absolute","value":4371505}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::VolumeLabel"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveType"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::DriveFormat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::Name"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"print debug messages":{"meta":{"name":"print debug messages","namespace":"host-interaction/log/debug/write-event","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: print debug messages\n    namespace: host-interaction/log/debug/write-event\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x401000\n  features:\n    - or:\n      - api: DbgPrint\n      - api: kernel32.OutputDebugString\n","matches":[[{"type":"absolute","value":4301140},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4340226},{"type":"absolute","value":4340131},{"type":"absolute","value":4340483},{"type":"absolute","value":4340037},{"type":"absolute","value":4339942},{"type":"absolute","value":4340169},{"type":"absolute","value":4340201},{"type":"absolute","value":4340011},{"type":"absolute","value":4340457},{"type":"absolute","value":4340398},{"type":"absolute","value":4340537},{"type":"absolute","value":4340091}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301860},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4333628}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303925},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4395762},{"type":"absolute","value":4395925},{"type":"absolute","value":4395864},{"type":"absolute","value":4395833},{"type":"absolute","value":4395947},{"type":"absolute","value":4395886}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304145},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4396296},{"type":"absolute","value":4396481},{"type":"absolute","value":4396420},{"type":"absolute","value":4396216},{"type":"absolute","value":4396459},{"type":"absolute","value":4396398},{"type":"absolute","value":4396367}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304475},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4395583}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305190},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DbgPrint"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OutputDebugString"}},"children":[],"locations":[{"type":"absolute","value":4395400},{"type":"absolute","value":4395343}],"captures":{}}],"locations":[],"captures":{}}]]},"get system information on Windows":{"meta":{"name":"get system information on Windows","namespace":"host-interaction/os/info","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get system information on Windows\n    namespace: host-interaction/os/info\n    authors:\n      - moritz.raabe@mandiant.com\n      - joakim@intezer.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    examples:\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280\n  features:\n    - and:\n      - os: windows\n      - or:\n        - api: kernel32.GetSystemInfo\n        - api: kernel32.GetNativeSystemInfo\n        - api: NtQuerySystemInformation\n        - api: NtQuerySystemInformationEx\n        - api: ntdll.RtlGetNativeSystemInformation\n        - api: ZwQuerySystemInformation\n        - api: ZwQuerySystemInformationEx\n","matches":[[{"type":"absolute","value":4301140},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4339704}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301460},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4341064}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4327421}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305445},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4473175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4472852},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetSystemInfo"}},"children":[],"locations":[{"type":"absolute","value":4473175}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"terminate process":{"meta":{"name":"terminate process","namespace":"host-interaction/process/terminate","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Terminate Process"],"objective":"Process","behavior":"Terminate Process","method":"","id":"C0018"}],"references":[],"examples":["C91887D861D9BD4A5872249B641BC9F9:0x401A77","9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: terminate process\n    namespace: host-interaction/process/terminate\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Process::Terminate Process [C0018]\n    examples:\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\n  features:\n    - or:\n      - api: System.Diagnostics.Process::Kill\n      - api: System.Diagnostics.Process::WaitForExit\n      - api: System.Diagnostics.Process::WaitForExitAsync\n      - api: System.Environment::Exit\n      - api: System.Windows.Forms.Application::Exit\n      - api: exit\n      - api: Exit\n      - and:\n        - optional:\n          - match: open process\n        - or:\n          - api: kernel32.TerminateProcess\n          - api: ntdll.NtTerminateProcess\n          - api: kernel32.ExitProcess\n","matches":[[{"type":"absolute","value":4301210},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":4465972},{"type":"absolute","value":4465902}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301750},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[{"type":"absolute","value":4500993}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304260},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::Kill"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::WaitForExitAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Environment::Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Windows.Forms.Application::Exit"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"exit"}},"children":[],"locations":[{"type":"absolute","value":4512473},{"type":"absolute","value":4304260}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Exit"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"TerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtTerminateProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ExitProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for debugger via API":{"meta":{"name":"check for debugger via API","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","CheckRemoteDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"CheckRemoteDebuggerPresent","id":"B0001.002"},{"parts":["Anti-Behavioral Analysis","Debugger Detection","WudfIsAnyDebuggerPresent"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"WudfIsAnyDebuggerPresent","id":"B0001.031"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp"],"examples":["al-khaser_x86.exe_:0x420000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for debugger via API\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]\n      - Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp\n    examples:\n      - al-khaser_x86.exe_:0x420000\n  features:\n    - or:\n      # We're not including kernel32.IsDebuggerPresent here because some exception handlers and other compiler-inserted\n      # code may add calls to it, especially in debug builds. So, likely even with pretty good library code detection\n      # this feature could result in many false positives.\n      - api: kernel32.CheckRemoteDebuggerPresent\n      - api: WUDFPlatform.WudfIsAnyDebuggerPresent\n      - api: WUDFPlatform.WudfIsKernelDebuggerPresent\n      - api: WUDFPlatform.WudfIsUserDebuggerPresent\n      - property/read: System.Diagnostics.Debugger::IsAttached\n      - api: System.Diagnostics.Debugger::IsLogging\n","matches":[[{"type":"absolute","value":4301550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CheckRemoteDebuggerPresent"}},"children":[],"locations":[{"type":"absolute","value":4325455}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsAnyDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsKernelDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WudfIsUserDebuggerPresent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Diagnostics.Debugger::IsAttached"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Debugger::IsLogging"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check process job object":{"meta":{"name":"check process job object","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp"],"examples":["al-khaser_x86.exe_:0x426730"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check process job object\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/ProcessJob.cpp\n    examples:\n      - al-khaser_x86.exe_:0x426730\n  features:\n    - or:\n      # static\n      - and:\n        - match: contain loop\n        - basic block:\n          - and:\n            - api: kernel32.QueryInformationJobObject\n            - number: 0x3 = JobObjectBasicProcessIdList\n        - basic block:\n          - and:\n            - api: kernel32.OpenProcess\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\n      # dynamic\n      - and:\n        - call:\n          - and:\n            - api: kernel32.QueryInformationJobObject\n            - number: 0x3 = JobObjectBasicProcessIdList\n        - call:\n          - and:\n            - api: kernel32.OpenProcess\n            - number: 0x400 = PROCESS_QUERY_INFORMATION\n","matches":[[{"type":"absolute","value":4301555},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/ef039a5cc5fe470ab1c126effdb7381f"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check process job object/8d7f5c8766744f6eaad05594c6d5193c"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4301555}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4301555}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueryInformationJobObject"}},"children":[],"locations":[{"type":"absolute","value":4351957}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"JobObjectBasicProcessIdList"}},"children":[],"locations":[{"type":"absolute","value":4351953}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4351915}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4352077}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1024,"description":"PROCESS_QUERY_INFORMATION"}},"children":[],"locations":[{"type":"absolute","value":4352072}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4352064}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute anti-debugging instructions":{"meta":{"name":"execute anti-debugging instructions","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Anti-debugging Instructions"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Anti-debugging Instructions","id":"B0001.034"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x401300"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: execute anti-debugging instructions\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Anti-debugging Instructions [B0001.034]\n    examples:\n      - Practical Malware Analysis Lab 16-03.exe_:0x401300\n  features:\n    - or:\n      - count(mnemonic(rdtsc)): 2 or more\n      - mnemonic: icebp\n","matches":[[{"type":"absolute","value":4301625},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":4493440},{"type":"absolute","value":4493468}],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305195},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"icebp"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"rdtsc"}}},"children":[],"locations":[{"type":"absolute","value":4493223},{"type":"absolute","value":4493198},{"type":"absolute","value":4493175}],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate processes":{"meta":{"name":"enumerate processes","namespace":"host-interaction/process/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"},{"parts":["Discovery","Software Discovery"],"tactic":"Discovery","technique":"Software Discovery","subtechnique":"","id":"T1518"}],"mbc":[],"references":[],"examples":["2D3EDC218A90F03089CC01715A9F047F:0x403DAB","35d04ecd797041eee796f4ddaa96cae8:0x10004F34"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate processes\n    namespace: host-interaction/process/list\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n      - Discovery::Software Discovery [T1518]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403DAB\n      - 35d04ecd797041eee796f4ddaa96cae8:0x10004F34\n  features:\n    - or:\n      - api: System.Diagnostics.Process::GetProcesses\n      - and:\n        - api: kernel32.Process32First\n        - api: kernel32.Process32Next\n        - optional:\n          - basic block:\n            - and:\n              - or:\n                - number: 0xF = TH32CS_SNAPALL\n                - number: 0x2 = TH32CS_SNAPPROCESS\n              - api: kernel32.CreateToolhelp32Snapshot\n          - call:\n            - and:\n              - or:\n                - number: 0xF = TH32CS_SNAPALL\n                - number: 0x2 = TH32CS_SNAPPROCESS\n              - api: kernel32.CreateToolhelp32Snapshot\n","matches":[[{"type":"absolute","value":4301760},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Diagnostics.Process::GetProcesses"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32First"}},"children":[],"locations":[{"type":"absolute","value":4477140}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Process32Next"}},"children":[],"locations":[{"type":"absolute","value":4477265}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4477076}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":15,"description":"TH32CS_SNAPALL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"TH32CS_SNAPPROCESS"}},"children":[],"locations":[{"type":"absolute","value":4477074}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4476992}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate processes/e1aa00e9084c4c62ae782367bb762cd8"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject APC":{"meta":{"name":"inject APC","namespace":"host-interaction/process/inject","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Asynchronous Procedure Call"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Asynchronous Procedure Call","id":"T1055.004"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x140019348"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: inject APC\n    namespace: host-interaction/process/inject\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Asynchronous Procedure Call [T1055.004]\n    examples:\n      - al-khaser_x64.exe_:0x140019348\n  features:\n    - and:\n      - or:\n        - match: write process memory\n        - match: create or open section object\n        - api: kernel32.MapViewOfFile\n      - or:\n        - api: kernel32.QueueUserAPC\n        - api: ntdll.NtQueueApcThread\n      - optional:\n        - or:\n          - number: 0x1fffff = THREAD_ALL_ACCESS\n          - api: kernel32.CreateProcess\n          - api: kernel32.OpenProcess\n","matches":[[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"QueueUserAPC"}},"children":[],"locations":[{"type":"absolute","value":4449254}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueueApcThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4449068}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4301785}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"create or open section object"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"MapViewOfFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2097151,"description":"THREAD_ALL_ACCESS"}},"children":[],"locations":[{"type":"absolute","value":4448793},{"type":"absolute","value":4449198}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4448798}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate threads":{"meta":{"name":"enumerate threads","namespace":"host-interaction/thread/list","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"}],"mbc":[{"parts":["Process","Enumerate Threads"],"objective":"Process","behavior":"Enumerate Threads","method":"","id":"C0064"}],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x10006BD5"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate threads\n    namespace: host-interaction/thread/list\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    mbc:\n      - Process::Enumerate Threads [C0064]\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x10006BD5\n  features:\n    - and:\n      - api: kernel32.Thread32First\n      - api: kernel32.Thread32Next\n      - optional:\n        - basic block:\n          - and:\n            - or:\n              - number: 0x4 = TH32CS_SNAPTHREAD\n              # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot\n            - api: kernel32.CreateToolhelp32Snapshot\n        - call:\n          - and:\n            - or:\n              - number: 0x4 = TH32CS_SNAPTHREAD\n            - api: kernel32.CreateToolhelp32Snapshot\n","matches":[[{"type":"absolute","value":4301785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":4449156}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":4449364}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4449107}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":4449105}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4449103}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/aab34e81695e4e75b3f06168d3a9f0c7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302305},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32First"}},"children":[],"locations":[{"type":"absolute","value":4472615}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"Thread32Next"}},"children":[],"locations":[{"type":"absolute","value":4472739}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateToolhelp32Snapshot"}},"children":[],"locations":[{"type":"absolute","value":4472582}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"TH32CS_SNAPTHREAD"}},"children":[],"locations":[{"type":"absolute","value":4472580}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4472528}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"enumerate threads/aab34e81695e4e75b3f06168d3a9f0c7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"execute shellcode via indirect call":{"meta":{"name":"execute shellcode via indirect call","namespace":"load-code/shellcode","authors":["ronnie.salomonsen@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: execute shellcode via indirect call\n    namespace: load-code/shellcode\n    authors:\n      - ronnie.salomonsen@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    mbc:\n      - Memory::Allocate Memory [C0007]\n  features:\n    - and:\n      - match: allocate or change RWX memory\n      - or:\n        - characteristic: indirect call\n        - characteristic: cross section flow\n","matches":[[{"type":"absolute","value":4301835},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4399300}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399284}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4399286}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4399284}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4399603}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4445118}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445082}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4445084}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445082}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4445069}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4302915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[{"type":"absolute","value":4327449}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4327280}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":64,"description":"PAGE_EXECUTE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4327436}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory/dabcadd5e454446f9519e1fa31dfae8b"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4327280}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"indirect call"}},"children":[],"locations":[{"type":"absolute","value":4327549}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"cross section flow"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read file on Windows\n    namespace: host-interaction/file-system/read\n    authors:\n      - moritz.raabe@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Read File [C0051]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - and:\n            - number: 0x80000000 = GENERIC_READ\n            - match: create or open file\n        - or:\n          - api: kernel32.ReadFile\n          - api: ReadFileEx\n          - api: NtReadFile\n          - api: ZwReadFile\n          - api: LZRead\n          - api: _read\n          - api: fread\n      - api: System.IO.File::ReadAllBytes\n      - api: System.IO.File::ReadAllBytesAsync\n      - api: System.IO.File::ReadAllLines\n      - api: System.IO.File::ReadAllLinesAsync\n      - api: System.IO.File::ReadAllText\n      - api: System.IO.File::ReadAllTextAsync\n      - api: System.IO.File::ReadLines\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[{"type":"absolute","value":4444684}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[{"type":"absolute","value":4444696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4444623}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ReadFile"}},"children":[],"locations":[{"type":"absolute","value":4444904}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file size":{"meta":{"name":"get file size","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["mimikatz.exe_:0x40630D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get file size\n    namespace: host-interaction/file-system/meta\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - mimikatz.exe_:0x40630D\n  features:\n    - or:\n      - api: kernel32.GetFileSize\n      - api: kernel32.GetFileSizeEx\n      - property/read: System.IO.FileInfo::Length\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSize"}},"children":[],"locations":[{"type":"absolute","value":4444753}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetFileSizeEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileInfo::Length"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"use process replacement":{"meta":{"name":"use process replacement","namespace":"host-interaction/process/inject","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Process Hollowing"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Process Hollowing","id":"T1055.012"},{"parts":["Defense Evasion","Reflective Code Loading"],"tactic":"Defense Evasion","technique":"Reflective Code Loading","subtechnique":"","id":"T1620"}],"mbc":[],"references":["http://www.autosectools.com/process-hollowing.pdf","https://www.andreafortuna.org/2017/10/09/understanding-process-hollowing/"],"examples":["Practical Malware Analysis Lab 12-02.exe_:0x4010EA"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: use process replacement\n    namespace: host-interaction/process/inject\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Process Hollowing [T1055.012]\n      - Defense Evasion::Reflective Code Loading [T1620]\n    references:\n      - http://www.autosectools.com/process-hollowing.pdf\n      - https://www.andreafortuna.org/2017/10/09/understanding-process-hollowing/\n    examples:\n      - Practical Malware Analysis Lab 12-02.exe_:0x4010EA\n  features:\n    - and:\n      - match: create process suspended\n      - match: write process memory\n      - match: resume thread\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create process suspended"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":134217732,"description":"CREATE_NO_WINDOW | CREATE_SUSPENDED"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"CREATE_SUSPENDED"}},"children":[],"locations":[{"type":"absolute","value":4444439}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcess"}},"children":[],"locations":[{"type":"absolute","value":4444453}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateProcessAsUser"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4444419}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4445204},{"type":"absolute","value":4445350},{"type":"absolute","value":4445407}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4301915}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"resume thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"ResumeThread"}},"children":[],"locations":[{"type":"absolute","value":4445485}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwResumeThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Resume"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4445368}],"captures":{}}],"locations":[],"captures":{}}]]},"parse PE header":{"meta":{"name":"parse PE header","namespace":"load-code/pe","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Shared Modules"],"tactic":"Execution","technique":"Shared Modules","subtechnique":"","id":"T1129"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403DD0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: parse PE header\n    namespace: load-code/pe\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic, operand[1].offset features\n    att&ck:\n      - Execution::Shared Modules [T1129]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0\n  features:\n    - and:\n      - os: windows\n      - and:\n        - mnemonic: cmp\n        - or:\n          - number: 0x4550 = IMAGE_NT_SIGNATURE (PE)\n          - and:\n            - number: 0x50\n            - number: 0x45\n        - or:\n          - number: 0x5A4D = IMAGE_DOS_SIGNATURE (MZ)\n          - and:\n            - number: 0x4D\n            - number: 0x5A\n        - optional:\n          - and:\n            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n            - or:\n              - and:\n                - arch: i386\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\n                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n              - and:\n                - arch: amd64\n                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\n                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase\n          - basic block:\n            - and:\n              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew\n              - 3 or more:\n                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine\n                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections\n                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader\n                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics\n                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit\n                - or:\n                  - and:\n                    - arch: i386\n                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage\n                  - and:\n                    - arch: amd64\n                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase\n                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage\n","matches":[[{"type":"absolute","value":4301915},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4444805},{"type":"absolute","value":4444938},{"type":"absolute","value":4445580},{"type":"absolute","value":4444818},{"type":"absolute","value":4445075},{"type":"absolute","value":4445719},{"type":"absolute","value":4445210},{"type":"absolute","value":4445595},{"type":"absolute","value":4445469},{"type":"absolute","value":4444702},{"type":"absolute","value":4444715},{"type":"absolute","value":4444459},{"type":"absolute","value":4445356},{"type":"absolute","value":4444977},{"type":"absolute","value":4444594},{"type":"absolute","value":4445491},{"type":"absolute","value":4445619},{"type":"absolute","value":4445626},{"type":"absolute","value":4445504},{"type":"absolute","value":4445124},{"type":"absolute","value":4445254},{"type":"absolute","value":4445768},{"type":"absolute","value":4445001},{"type":"absolute","value":4445137},{"type":"absolute","value":4445650},{"type":"absolute","value":4444759},{"type":"absolute","value":4445657},{"type":"absolute","value":4445026},{"type":"absolute","value":4445413},{"type":"absolute","value":4444520},{"type":"absolute","value":4444910},{"type":"absolute","value":4445040},{"type":"absolute","value":4444533},{"type":"absolute","value":4444791},{"type":"absolute","value":4445688},{"type":"absolute","value":4444665},{"type":"absolute","value":4445566},{"type":"absolute","value":4445695}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":4444977}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":4444938}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":4444962},{"type":"absolute","value":4445274}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[{"type":"absolute","value":4445097}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[{"type":"absolute","value":4445001},{"type":"absolute","value":4445107},{"type":"absolute","value":4445380}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[{"type":"absolute","value":4445097}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/303ac304a9954095b738a84377f00288"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4303410},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4508129},{"type":"absolute","value":4508145},{"type":"absolute","value":4508226},{"type":"absolute","value":4508172},{"type":"absolute","value":4508205},{"type":"absolute","value":4508191}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":4508172}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":4508145}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":4508163}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/303ac304a9954095b738a84377f00288"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305820},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4511456},{"type":"absolute","value":4511075},{"type":"absolute","value":4511235},{"type":"absolute","value":4511619},{"type":"absolute","value":4511079},{"type":"absolute","value":4511464},{"type":"absolute","value":4511018},{"type":"absolute","value":4511722},{"type":"absolute","value":4511088},{"type":"absolute","value":4511473},{"type":"absolute","value":4511728},{"type":"absolute","value":4511059},{"type":"absolute","value":4510996},{"type":"absolute","value":4511734},{"type":"absolute","value":4511706},{"type":"absolute","value":4511067},{"type":"absolute","value":4511100}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":17744,"description":"IMAGE_NT_SIGNATURE (PE)"}},"children":[],"locations":[{"type":"absolute","value":4511018}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":80}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":69}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23117,"description":"IMAGE_DOS_SIGNATURE (MZ)"}},"children":[],"locations":[{"type":"absolute","value":4510991}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":77}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":90}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":60,"description":"IMAGE_DOS_HEADER.e_lfanew"}},"children":[],"locations":[{"type":"absolute","value":4511005}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":52,"description":"IMAGE_NT_HEADERS.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":80,"description":"IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"operand offset","index":1,"operand_offset":48,"description":"IMAGE_NT_HEADERS64.OptionalHeader.ImageBase"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"parse PE header/303ac304a9954095b738a84377f00288"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate services":{"meta":{"name":"enumerate services","namespace":"host-interaction/service/list","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Service Discovery"],"tactic":"Discovery","technique":"System Service Discovery","subtechnique":"","id":"T1007"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x1000B823"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate services\n    namespace: host-interaction/service/list\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Service Discovery [T1007]\n    examples:\n      - Practical Malware Analysis Lab 05-01.dll_:0x1000B823\n  features:\n    - or:\n      - api: advapi32.EnumServicesStatus\n      - api: advapi32.EnumServicesStatusEx\n      - api: advapi32.EnumDependentServices\n","matches":[[{"type":"absolute","value":4301940},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"EnumServicesStatusEx"}},"children":[],"locations":[{"type":"absolute","value":4423523},{"type":"absolute","value":4423357}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"EnumDependentServices"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"send ICMP echo request":{"meta":{"name":"send ICMP echo request","namespace":"communication/icmp","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","ICMP Communication","Echo Request"],"objective":"Communication","behavior":"ICMP Communication","method":"Echo Request","id":"C0014.002"}],"references":["https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/"],"examples":["al-khaser_x86.exe_:0x449510"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: send ICMP echo request\n    namespace: communication/icmp\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::ICMP Communication::Echo Request [C0014.002]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/\n    examples:\n      - al-khaser_x86.exe_:0x449510\n  features:\n    - and:\n      - or:\n        - api: IcmpSendEcho\n        - api: IcmpSendEcho2\n        - api: IcmpSendEcho2Ex\n        - api: Icmp6SendEcho2\n      - optional:\n        - or:\n          - api: IcmpCreateFile\n          - api: Icmp6CreateFile\n        - api: IcmpCloseHandle\n","matches":[[{"type":"absolute","value":4301960},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho"}},"children":[],"locations":[{"type":"absolute","value":4494933}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IcmpSendEcho2Ex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6SendEcho2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCreateFile"}},"children":[],"locations":[{"type":"absolute","value":4494752}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Icmp6CreateFile"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"IcmpCloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4494952},{"type":"absolute","value":4494870}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processors":{"meta":{"name":"get number of processors","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361"],"examples":["al-khaser_x86.exe_:0x432CB0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get number of processors\n    namespace: host-interaction/hardware/cpu\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires property features\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/bed03d2f849d9060c68f8d5905bd204d0cb3f593/al-khaser/AntiVM/Generic.cpp#L361\n    examples:\n      - al-khaser_x86.exe_:0x432CB0\n  features:\n    - or:\n      - and:\n        - match: PEB access\n        - or:\n          - and:\n            - arch: i386\n            - number: 0x64 = PEB->NumberOfProcessors\n          - and:\n            - arch: amd64\n            - number: 0xB8 = PEB->NumberOfProcessors\n      - property/read: System.Environment::ProcessorCount\n","matches":[[{"type":"absolute","value":4302100},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::ProcessorCount"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4402392}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402352}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":100,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[{"type":"absolute","value":4402398}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":184,"description":"PEB->NumberOfProcessors"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"connect to WMI namespace via WbemLocator":{"meta":{"name":"connect to WMI namespace via WbemLocator","namespace":"host-interaction/wmi","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Execution","Windows Management Instrumentation"],"tactic":"Execution","technique":"Windows Management Instrumentation","subtechnique":"","id":"T1047"}],"mbc":[],"references":[],"examples":["al-khaser_x64.exe_:0x14001956e","al-khaser_x86.exe_:0x00445270"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\nrule:\n  meta:\n    name: connect to WMI namespace via WbemLocator\n    namespace: host-interaction/wmi\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires offset, bytes features\n    att&ck:\n      - Execution::Windows Management Instrumentation [T1047]\n    examples:\n      - al-khaser_x64.exe_:0x14001956e\n      - al-khaser_x86.exe_:0x00445270\n  features:\n    - and:\n      - basic block:\n        - and:\n          - api: ole32.CoCreateInstance\n          - com/class: WbemLocator  # 11 F8 90 45 3A 1D D0 11 89 1F 00 AA 00 4B 2E 24 = CLSID_WbemLocator\n          - com/interface: IWbemLocator  # 87 A6 12 DC 7F 73 CF 11 88 4D 00 AA 00 4B 2E 24 = IID_IWbemLocator\n      - or:\n        - and:\n          - arch: i386\n          - offset: 0xC = ppv->ConnectServer\n        - and:\n          - arch: amd64\n          - offset: 0x18 = ppv->ConnectServer\n      - optional:\n        - string: /ROOT\\\\CIMV2/i\n        - string: /ROOT\\\\DEFAULT/i\n","matches":[[{"type":"absolute","value":4302170},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CoCreateInstance"}},"children":[],"locations":[{"type":"absolute","value":4477746}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"4590f811-1d3a-11d0-891f-00aa004b2e24","description":"CLSID_WbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"11f890453a1dd011891f00aa004b2e24","description":"CLSID_WbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":4477741}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"dc12a687-737f-11cf-884d-00aa004b2e24","description":"IID_IWbemLocator as GUID string"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"87a612dc7f73cf11884d00aa004b2e24","description":"IID_IWbemLocator as bytes"}},"children":[],"locations":[{"type":"absolute","value":4477732}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4477717}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"ppv->ConnectServer"}},"children":[],"locations":[{"type":"absolute","value":4477873}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":24,"description":"ppv->ConnectServer"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\CIMV2/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ROOT\\\\DEFAULT/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if file exists":{"meta":{"name":"check if file exists","namespace":"host-interaction/file-system/exists","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","File and Directory Discovery"],"tactic":"Discovery","technique":"File and Directory Discovery","subtechnique":"","id":"T1083"}],"mbc":[{"parts":["Discovery","File and Directory Discovery"],"objective":"Discovery","behavior":"File and Directory Discovery","method":"","id":"E1083"}],"references":[],"examples":["31600AD0D1A7EA615690DF111AE36C73:0x401284"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check if file exists\n    namespace: host-interaction/file-system/exists\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\n  features:\n    - or:\n      - basic block:\n        - and:\n          - api: kernel32.GetFileAttributes\n          - instruction:\n            - mnemonic: cmp\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\n      - basic block:\n        - and:\n          - api: kernel32.GetLastError\n          - instruction:\n            - mnemonic: cmp\n            - number: 2 = ERROR_FILE_NOT_FOUND\n      - api: shlwapi.PathFileExists\n      - api: System.IO.File::Exists\n      - property/read: System.IO.FileSystemInfo::Exists\n","matches":[[{"type":"absolute","value":4302300},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491582}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4491598}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":4491598}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491598}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491536}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/af5a8a8f525441788ddd714f50ef21c1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304300},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetFileAttributes"}},"children":[],"locations":[{"type":"absolute","value":4491742}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4491758}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4294967295,"description":"INVALID_FILE_ATTRIBUTES"}},"children":[],"locations":[{"type":"absolute","value":4491758}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491758}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4491696}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check if file exists/af5a8a8f525441788ddd714f50ef21c1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PathFileExists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::Exists"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Exists"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check if process is running under wine":{"meta":{"name":"check if process is running under wine","namespace":"anti-analysis/anti-emulation/wine","authors":["@_re_fox"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Emulator Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Emulator Detection","method":"","id":"B0004"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp"],"examples":["ccbf7cba35bab56563c0fbe4237fdc41:0x40d750"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check if process is running under wine\n    namespace: anti-analysis/anti-emulation/wine\n    authors:\n      - \"@_re_fox\"\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Emulator Detection [B0004]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Wine.cpp\n    examples:\n      - ccbf7cba35bab56563c0fbe4237fdc41:0x40d750\n  features:\n    - or:\n      - string: /SOFTWARE\\\\Wine/i\n      - and:\n        - api: GetModuleHandle\n        - api: GetProcAddress\n        - string: \"wine_get_unix_file_name\"\n        - or:\n          - string: \"kernel32.dll\"\n          - string: \"ntdll.dll\"\n","matches":[[{"type":"absolute","value":4302465},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4442047}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[{"type":"absolute","value":4442097}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[{"type":"absolute","value":4442088}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[{"type":"absolute","value":4442042}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304740},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Wine/i"}},"children":[],"locations":[{"type":"absolute","value":4442242}],"captures":{"SOFTWARE\\Wine":[{"type":"absolute","value":4442242}]}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProcAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"wine_get_unix_file_name"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"kernel32.dll"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ntdll.dll"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get OS version":{"meta":{"name":"get OS version","authors":["@mr-tz"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x401000","5f66b82558ca92e54e77f216ef4c066c:0x44580A"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get OS version\n    authors:\n      - \"@mr-tz\"\n    lib: true\n    scopes:\n      static: function\n      dynamic: call\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x401000\n      - 5f66b82558ca92e54e77f216ef4c066c:0x44580A\n  features:\n    - or:\n      - api: RtlGetVersion\n      - api: ntoskrnl.PsGetVersion\n      - api: GetVersion\n      - api: GetVersionEx\n      - api: VerifyVersionInfo\n      - api: VerSetConditionMask\n      - api: RtlGetNtVersionNumbers\n      - api: GetProductInfo\n      - and:\n        - match: PEB access\n        - or:\n          - and:\n            - arch: i386\n            - or:\n              - offset: 0xA4 = PEB->OSMajorVersion\n              - offset: 0xA8 = PEB->OSMinorVersion\n              - offset: 0xAC = PEB->OSBuildNumber\n          - and:\n            - arch: amd64\n            - or:\n              - offset: 0x118 = PEB->OSMajorVersion\n              - offset: 0x11C = PEB->OSMinorVersion\n              - offset: 0x120 = PEB->OSBuildNumber\n","matches":[[{"type":"absolute","value":4302785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":4333224}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":4333146},{"type":"absolute","value":4333131}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4305230},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsGetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetVersionEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerifyVersionInfo"}},"children":[],"locations":[{"type":"absolute","value":4331869}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VerSetConditionMask"}},"children":[],"locations":[{"type":"absolute","value":4331776},{"type":"absolute","value":4331761},{"type":"absolute","value":4331791}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlGetNtVersionNumbers"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetProductInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":164,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":168,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":172,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":280,"description":"PEB->OSMajorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":284,"description":"PEB->OSMinorVersion"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":288,"description":"PEB->OSBuildNumber"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get MAC address on Windows":{"meta":{"name":"get MAC address on Windows","namespace":"collection/network","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","echernofsky@google.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128","https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific"],"examples":["al-khaser_x64.exe_:0x14001A1BC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get MAC address on Windows\n    namespace: collection/network\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - echernofsky@google.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/Shared/Utils.cpp#L128\n      - https://evasions.checkpoint.com/techniques/network.html#check-if-mac-address-is-specific\n    examples:\n      - al-khaser_x64.exe_:0x14001A1BC\n  features:\n    - and:\n      - os: windows\n      - or:\n        - and:\n          - api: iphlpapi.GetAdaptersInfo\n          - or:\n            - offset: 0x194 = IP_ADAPTER_INFO.Address\n            - offset: 0x195 = IP_ADAPTER_INFO.Address+1\n            - offset: 0x196 = IP_ADAPTER_INFO.Address+2\n            - offset: 0x197 = IP_ADAPTER_INFO.Address+3\n            - offset: 0x198 = IP_ADAPTER_INFO.Address+4\n            - offset: 0x199 = IP_ADAPTER_INFO.Address+5\n          - optional:\n            - string: \"%02X-%02X-%02X-%02X-%02X-%02X\"\n        - and:\n          - api: iphlpapi.GetAdaptersAddresses\n          - offset: 0x2C = PhysicalAddress\n","matches":[[{"type":"absolute","value":4302830},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersInfo"}},"children":[],"locations":[{"type":"absolute","value":4488428},{"type":"absolute","value":4488286}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":404,"description":"IP_ADAPTER_INFO.Address"}},"children":[],"locations":[{"type":"absolute","value":4488521}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":405,"description":"IP_ADAPTER_INFO.Address+1"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":406,"description":"IP_ADAPTER_INFO.Address+2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":407,"description":"IP_ADAPTER_INFO.Address+3"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":408,"description":"IP_ADAPTER_INFO.Address+4"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":409,"description":"IP_ADAPTER_INFO.Address+5"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"%02X-%02X-%02X-%02X-%02X-%02X"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersAddresses"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":44,"description":"PhysicalAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for time delay via GetTickCount":{"meta":{"name":"check for time delay via GetTickCount","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Timing/Delay Check GetTickCount"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Timing/Delay Check GetTickCount","id":"B0001.032"}],"references":[],"examples":["Practical Malware Analysis Lab 16-03.exe_:0x4013d0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for time delay via GetTickCount\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]\n    examples:\n      - Practical Malware Analysis Lab 16-03.exe_:0x4013d0\n  features:\n    - and:\n      - count(api(kernel32.GetTickCount)): 2 or more\n      - basic block:\n        - and:\n          - mnemonic: sub\n          - mnemonic: cmp\n","matches":[[{"type":"absolute","value":4302875},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"sub"}},"children":[],"locations":[{"type":"absolute","value":4402483},{"type":"absolute","value":4402606},{"type":"absolute","value":4402615}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4402593},{"type":"absolute","value":4402578},{"type":"absolute","value":4402556},{"type":"absolute","value":4402620}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4402480}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"api","api":"GetTickCount"}}},"children":[],"locations":[{"type":"absolute","value":4402587},{"type":"absolute","value":4402550}],"captures":{}}],"locations":[],"captures":{}}]]},"inject thread":{"meta":{"name":"inject thread","namespace":"host-interaction/process/inject","authors":["anamaria.martinezgom@mandiant.com","0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Thread Execution Hijacking"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Thread Execution Hijacking","id":"T1055.003"},{"parts":["Defense Evasion","Reflective Code Loading"],"tactic":"Defense Evasion","technique":"Reflective Code Loading","subtechnique":"","id":"T1620"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-01.exe_:0x4010D0","2D3EDC218A90F03089CC01715A9F047F:0x4027CF"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: inject thread\n    namespace: host-interaction/process/inject\n    authors:\n      - anamaria.martinezgom@mandiant.com\n      - 0x534a@mailbox.org\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003]\n      - Defense Evasion::Reflective Code Loading [T1620]\n    examples:\n      - Practical Malware Analysis Lab 12-01.exe_:0x4010D0\n      - 2D3EDC218A90F03089CC01715A9F047F:0x4027CF\n  features:\n    - and:\n      - or:\n        - match: allocate or change RWX memory\n        - match: allocate or change RW memory\n      - match: write process memory\n      - match: create thread\n      - optional:\n        - or:\n          - match: host-interaction/process/create\n          - match: open process\n          - number: 0x3000 = MEM_COMMIT or MEM_RESERVE\n","matches":[[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4443714}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4302995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":4443770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443748}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RWX memory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4443606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4443322}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443309}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":12288,"description":"MEM_COMMIT or MEM_RESERVE"}},"children":[],"locations":[{"type":"absolute","value":4443608}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"inject dll":{"meta":{"name":"inject dll","namespace":"host-interaction/process/inject","authors":["0x534a@mailbox.org"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","Process Injection","Dynamic-link Library Injection"],"tactic":"Defense Evasion","technique":"Process Injection","subtechnique":"Dynamic-link Library Injection","id":"T1055.001"}],"mbc":[],"references":["Practical Malware Analysis, p. 676","https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis","https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf","https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf","https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/","https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf","https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: inject dll\n    namespace: host-interaction/process/inject\n    authors:\n      - 0x534a@mailbox.org\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001]\n    references:\n      - Practical Malware Analysis, p. 676\n      - https://www.researchgate.net/publication/279155742_A_Novel_Approach_to_Detect_Malware_Based_on_API_Call_Sequence_Analysis\n      - https://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf\n      - https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf\n      - https://unit42.paloaltonetworks.com/unit42-kazuar-multiplatform-espionage-backdoor-api-access/\n      - https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf\n      - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n  features:\n    - and:\n      - optional:\n        - or:\n          - match: open process\n          - match: host-interaction/process/create\n      - match: allocate or change RW memory\n      - match: write process memory\n      - and:\n        - or:\n          - api: kernel32.GetModuleHandle\n          - api: kernel32.GetModuleHandleEx\n        - string: \"/LoadLibrary[AW]/\"\n      - match: create thread\n","matches":[[{"type":"absolute","value":4302995},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"allocate memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocEx"}},"children":[],"locations":[{"type":"absolute","value":4443626}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"change memory protection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":4,"description":"PAGE_READWRITE"}},"children":[],"locations":[{"type":"absolute","value":4443606}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"allocate or change RW memory/a8c5959bbd674874a76290acfc1dbed7"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443488}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"write process memory"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"WriteProcessMemory"}},"children":[],"locations":[{"type":"absolute","value":4443714}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtWow64WriteVirtualMemory64"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4302995}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"android"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"pthread_create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::Start"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Thread::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_beginthreadex"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"PsCreateSystemThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHCreateThreadWithHandle"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThread"}},"children":[],"locations":[{"type":"absolute","value":4443770}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateRemoteThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateUserThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateThreadEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThread"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateThreadEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443748}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"open process"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"OpenProcess"}},"children":[],"locations":[{"type":"absolute","value":4443322}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4443309}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandle"}},"children":[],"locations":[{"type":"absolute","value":4443374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetModuleHandleEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LoadLibrary[AW]/"}},"children":[],"locations":[{"type":"absolute","value":4443434}],"captures":{"LoadLibraryW":[{"type":"absolute","value":4443434}]}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get memory capacity":{"meta":{"name":"get memory capacity","namespace":"host-interaction/hardware/memory","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get memory capacity\n    namespace: host-interaction/hardware/memory\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n  features:\n    - or:\n      - api: kernel32.GlobalMemoryStatus\n      - api: kernel32.GlobalMemoryStatusEx\n        # TODO kernel32.GetSystemInfo with offset\n","matches":[[{"type":"absolute","value":4303055},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatus"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GlobalMemoryStatusEx"}},"children":[],"locations":[{"type":"absolute","value":4412669}],"captures":{}}],"locations":[],"captures":{}}]]},"check for software breakpoints":{"meta":{"name":"check for software breakpoints","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Software Breakpoints"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Software Breakpoints","id":"B0001.025"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp","https://anti-debug.checkpoint.com/techniques/assembly.html"],"examples":["al-khaser_x86.exe_:0x431020"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for software breakpoints\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Software Breakpoints [B0001.025]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SoftwareBreakpoints.cpp\n      - https://anti-debug.checkpoint.com/techniques/assembly.html\n    examples:\n      - al-khaser_x86.exe_:0x431020\n  features:\n    - and:\n      - or:\n        - instruction:\n          - mnemonic: cmp\n          - number: 0xCC = INT3\n        - and:\n          - description: INT3 (long form)\n          - instruction:\n            - mnemonic: cmp\n            - number: 0xCD = INT3 (long form byte 1)\n          - instruction:\n            - mnemonic: cmp\n            - number: 0x03 = INT3 (long form byte 2)\n      - match: contain loop\n","matches":[[{"type":"absolute","value":4303320},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"contain loop"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"loop"}},"children":[],"locations":[{"type":"absolute","value":4303320}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"tight loop"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"recursive call"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4303320}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"cmp"}},"children":[],"locations":[{"type":"absolute","value":4395135}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":204,"description":"INT3"}},"children":[],"locations":[{"type":"absolute","value":4395135}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4395135}],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and","description":"INT3 (long form)"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/36afe6517a0548cd84a535955598a159"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for software breakpoints/2fb43672c6814815bcabc8701648aeae"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set console window title":{"meta":{"name":"set console window title","namespace":"host-interaction/gui/console","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Operating System","Console"],"objective":"Operating System","behavior":"Console","method":"","id":"C0033"}],"references":[],"examples":["mimikatz.exe_:0x44570F"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set console window title\n    namespace: host-interaction/gui/console\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Operating System::Console [C0033]\n    examples:\n      - mimikatz.exe_:0x44570F\n  features:\n    - or:\n      - api: kernel32.SetConsoleTitle\n","matches":[[{"type":"absolute","value":4303335},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetConsoleTitle"}},"children":[],"locations":[{"type":"absolute","value":4464383}],"captures":{}}],"locations":[],"captures":{}}]]},"check for hardware breakpoints":{"meta":{"name":"check for hardware breakpoints","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Hardware Breakpoints"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Hardware Breakpoints","id":"B0001.005"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/HardwareBreakpoints.cpp"],"examples":["al-khaser_x86.exe_:0x42035D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for hardware breakpoints\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires offset, mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints [B0001.005]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/HardwareBreakpoints.cpp\n    examples:\n      - al-khaser_x86.exe_:0x42035D\n  features:\n    - and:\n      - api: kernel32.GetThreadContext\n      - number: 0x10010 = CONTEXT_DEBUG_REGISTERS\n      - offset: 0x4 = DR0\n      - offset: 0x8 = DR1\n      - offset: 0xC = DR2\n      - offset: 0x10 = DR3\n      - count(mnemonic(cmp)): 4 or more\n","matches":[[{"type":"absolute","value":4303415},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetThreadContext"}},"children":[],"locations":[{"type":"absolute","value":4326265}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":65552,"description":"CONTEXT_DEBUG_REGISTERS"}},"children":[],"locations":[{"type":"absolute","value":4326237}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":4,"description":"DR0"}},"children":[],"locations":[{"type":"absolute","value":4326285}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":8,"description":"DR1"}},"children":[],"locations":[{"type":"absolute","value":4326294}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":12,"description":"DR2"}},"children":[],"locations":[{"type":"absolute","value":4326303}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":16,"description":"DR3"}},"children":[],"locations":[{"type":"absolute","value":4326312}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":4,"max":9223372036854775808,"child":{"type":"mnemonic","mnemonic":"cmp"}}},"children":[],"locations":[{"type":"absolute","value":4326312},{"type":"absolute","value":4326344},{"type":"absolute","value":4326285},{"type":"absolute","value":4326257},{"type":"absolute","value":4326197},{"type":"absolute","value":4326294},{"type":"absolute","value":4326271},{"type":"absolute","value":4326303},{"type":"absolute","value":4326363},{"type":"absolute","value":4326207}],"captures":{}}],"locations":[],"captures":{}}]]},"check for kernel debugger via shared user data structure":{"meta":{"name":"check for kernel debugger via shared user data structure","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"","id":"B0001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SharedUserData_KernelDebugger.cpp","http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data.htm"],"examples":["al-khaser_x86.exe_:0x430E60"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for kernel debugger via shared user data structure\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection [B0001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SharedUserData_KernelDebugger.cpp\n      - http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data.htm\n    examples:\n      - al-khaser_x86.exe_:0x430E60\n  features:\n    - and:\n      - number: 0x7FFE02D4 = UserSharedData->KdDebuggerEnabled\n      - instruction:\n        - mnemonic: and\n        - number: 0x2 = KdDebuggerNotPresent\n      - instruction:\n        - mnemonic: and\n        - number: 0x1 = KdDebuggerEnabled\n","matches":[[{"type":"absolute","value":4303540},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147353300,"description":"UserSharedData->KdDebuggerEnabled"}},"children":[],"locations":[{"type":"absolute","value":4394639}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":4394685}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"KdDebuggerNotPresent"}},"children":[],"locations":[{"type":"absolute","value":4394685}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4394685}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"and"}},"children":[],"locations":[{"type":"absolute","value":4394651}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"KdDebuggerEnabled"}},"children":[],"locations":[{"type":"absolute","value":4394651}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4394651}],"captures":{}}],"locations":[],"captures":{}}]]},"get disk size":{"meta":{"name":"get disk size","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347"],"examples":["al-khaser_x86.exe_:0x4343D0","al-khaser_x86.exe_:0x434010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get disk size\n    namespace: host-interaction/hardware/storage\n    authors:\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L347\n    examples:\n      - al-khaser_x86.exe_:0x4343D0\n      - al-khaser_x86.exe_:0x434010\n  features:\n    - or:\n      - api: kernel32.GetDiskFreeSpace\n      - api: kernel32.GetDiskFreeSpaceEx\n      - property/read: System.IO.DriveInfo::TotalSize\n      - property/read: System.IO.DriveInfo::TotalFreeSpace\n      - property/read: System.IO.DriveInfo::AvailableFreeSpace\n      - basic block:\n        - and:\n          - match: interact with driver via IOCTL\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\n      - call:\n        - and:\n          - match: interact with driver via IOCTL\n          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO\n      - and:\n        - or:\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i\n          - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i\n        - string: \"Size\"\n","matches":[[{"type":"absolute","value":4304105},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4409203}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4409176}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":4409194}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"interact with driver via IOCTL"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"absolute","value":4408982}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4408955}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":475228,"description":"IOCTL_DISK_GET_LENGTH_INFO"}},"children":[],"locations":[{"type":"absolute","value":4408973}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4409176},{"type":"absolute","value":4408955}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/c9a9ddfc47144dc59ab2f22c9a32b9f8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4304805},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetDiskFreeSpaceEx"}},"children":[],"locations":[{"type":"absolute","value":4407116}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalSize"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::TotalFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.DriveInfo::AvailableFreeSpace"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/84a496d0950b4028a26a7ef5f2193505"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"get disk size/c9a9ddfc47144dc59ab2f22c9a32b9f8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_LogicalDisk/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_DiskDrive\\s+WHERE\\s+\\(SerialNumber\\s+IS\\s+NOT\\s+NULL\\)\\s+AND\\s+\\(MediaType\\s+LIKE\\s+\\'Fixed\\s+hard\\s+disk\\%\\'\\)/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"Size"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate disk properties":{"meta":{"name":"enumerate disk properties","namespace":"host-interaction/hardware/storage","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518"],"examples":["al-khaser_x86.exe_:0x4369B0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: enumerate disk properties\n    namespace: host-interaction/hardware/storage\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires bytes features\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L518\n    examples:\n      - al-khaser_x86.exe_:0x4369B0\n  features:\n    - and:\n      - basic block:\n        - and:\n          - api: setupapi.SetupDiGetClassDevs\n          - bytes: 67 E9 36 4D 25 E3 CE 11 BF C1 08 00 2B E1 03 18 = GUID_DEVCLASS_DISKDRIVE\n      - api: setupapi.SetupDiEnumDeviceInfo\n      - api: setupapi.SetupDiGetDeviceRegistryProperty\n      - optional:\n        - api: setupapi.SetupDiDestroyDeviceInfoList\n","matches":[[{"type":"absolute","value":4304225},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetClassDevs"}},"children":[],"locations":[{"type":"absolute","value":4418038}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"bytes","bytes":"67e9364d25e3ce11bfc108002be10318","description":"GUID_DEVCLASS_DISKDRIVE"}},"children":[],"locations":[{"type":"absolute","value":4418033}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4417968}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiEnumDeviceInfo"}},"children":[],"locations":[{"type":"absolute","value":4418120}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiGetDeviceRegistryProperty"}},"children":[],"locations":[{"type":"absolute","value":4418169}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetupDiDestroyDeviceInfoList"}},"children":[],"locations":[{"type":"absolute","value":4418437}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for PEB NtGlobalFlag flag":{"meta":{"name":"check for PEB NtGlobalFlag flag","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","Process Environment Block NtGlobalFlag"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"Process Environment Block NtGlobalFlag","id":"B0001.036"}],"references":["Practical Malware Analysis, Chapter 16, p. 355","https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm"],"examples":["Practical Malware Analysis Lab 16-01.exe_:0x403530"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for PEB NtGlobalFlag flag\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: unsupported  # requires offset, mnemonic features\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]\n    references:\n      - Practical Malware Analysis, Chapter 16, p. 355\n      - https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/index.htm\n    examples:\n      - Practical Malware Analysis Lab 16-01.exe_:0x403530\n  features:\n    - and:\n      - basic block:\n        - and:\n          - match: PEB access\n          - or:\n            - and:\n              - arch: i386\n              - offset: 0x68 = PEB.NtGlobalFlag\n            - and:\n              - arch: amd64\n              - offset: 0xBC = PEB.NtGlobalFlag\n            - instruction:\n              - arch: i386\n              - mnemonic: add\n              - offset: 0x68 = PEB.NtGlobalFlag\n            - instruction:\n              - arch: amd64\n              - mnemonic: add\n              - offset: 0xBC = PEB.NtGlobalFlag\n      - number: 0x70 = (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)\n","matches":[[{"type":"absolute","value":4304340},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"PEB access"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"peb access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/1b3ff676b8764d3098ff74ec8a74fc6d"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"fs access"}},"children":[],"locations":[{"type":"absolute","value":4328790}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":48}},"children":[],"locations":[{"type":"absolute","value":4328802}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/04d048263e4d48d6815d4f3dc4ace594"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"characteristic","characteristic":"gs access"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":96}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"PEB access/898a980d0aa34d88959ae5d7bfbf5e80"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328736}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":104,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":4328811}],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"arch","arch":"amd64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":188,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"instruction"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"arch","arch":"i386"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"mnemonic","mnemonic":"add"}},"children":[],"locations":[{"type":"absolute","value":4328811}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"offset","offset":104,"description":"PEB.NtGlobalFlag"}},"children":[],"locations":[{"type":"absolute","value":4328811}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328811}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for PEB NtGlobalFlag flag/a93ba2f42ad947438b9d02b75f92d9df/f9d3e555cc594ac1b1cfcee4ec58d059"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4328736}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":112,"description":"(FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)"}},"children":[],"locations":[{"type":"absolute","value":4328924},{"type":"absolute","value":4328877}],"captures":{}}],"locations":[],"captures":{}}]]},"modify access privileges":{"meta":{"name":"modify access privileges","namespace":"host-interaction/process/modify","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Privilege Escalation","Access Token Manipulation"],"tactic":"Privilege Escalation","technique":"Access Token Manipulation","subtechnique":"","id":"T1134"}],"mbc":[],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x403BE0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: modify access privileges\n    namespace: host-interaction/process/modify\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Privilege Escalation::Access Token Manipulation [T1134]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x403BE0\n  features:\n    - and:\n      - api: advapi32.AdjustTokenPrivileges\n      - optional:\n        - or:\n          - api: advapi32.LookupPrivilegeValue\n","matches":[[{"type":"absolute","value":4304465},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"AdjustTokenPrivileges"}},"children":[],"locations":[{"type":"absolute","value":4479948}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LookupPrivilegeValue"}},"children":[],"locations":[{"type":"absolute","value":4479913}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"absolute","value":4480208},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"AdjustTokenPrivileges"}},"children":[],"locations":[{"type":"absolute","value":4480368},{"type":"absolute","value":4480530}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"LookupPrivilegeValue"}},"children":[],"locations":[{"type":"absolute","value":4480277}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"find graphical window":{"meta":{"name":"find graphical window","namespace":"host-interaction/gui/window/find","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Discovery","Application Window Discovery"],"tactic":"Discovery","technique":"Application Window Discovery","subtechnique":"","id":"T1010"}],"mbc":[],"references":[],"examples":["7C843E75D4F02087B932FE280DF9C90C:0x41B180"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: find graphical window\n    namespace: host-interaction/gui/window/find\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::Application Window Discovery [T1010]\n    examples:\n      - 7C843E75D4F02087B932FE280DF9C90C:0x41B180\n  features:\n    - or:\n      - api: user32.FindWindow\n      - api: user32.FindWindowEx\n","matches":[[{"type":"absolute","value":4304550},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"FindWindow"}},"children":[],"locations":[{"type":"absolute","value":4436129},{"type":"absolute","value":4436154}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"FindWindowEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get number of processor cores":{"meta":{"name":"get number of processor cores","namespace":"host-interaction/hardware/cpu","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207"],"examples":["al-khaser_x86.exe_:0x435BA0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: get number of processor cores\n    namespace: host-interaction/hardware/cpu\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L207\n    examples:\n      - al-khaser_x86.exe_:0x435BA0\n  features:\n    - and:\n      - string: /SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/\n      - string: \"NumberOfCores\"\n","matches":[[{"type":"absolute","value":4304635},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"NumberOfCores"}},"children":[],"locations":[{"type":"absolute","value":4414607}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SELECT\\s+\\*\\s+FROM\\s+Win32_Processor/"}},"children":[],"locations":[{"type":"absolute","value":4414487}],"captures":{"SELECT * FROM Win32_Processor":[{"type":"absolute","value":4414487}]}}],"locations":[],"captures":{}}]]},"create mutex":{"meta":{"name":"create mutex","namespace":"host-interaction/mutex","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[],"mbc":[{"parts":["Process","Create Mutex"],"objective":"Process","behavior":"Create Mutex","method":"","id":"C0042"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: create mutex\n    namespace: host-interaction/mutex\n    authors:\n      - moritz.raabe@mandiant.com\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - Process::Create Mutex [C0042]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - api: kernel32.CreateMutex\n      - api: kernel32.CreateMutexEx\n      - api: System.Threading.Mutex::ctor\n","matches":[[{"type":"absolute","value":4304785},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutex"}},"children":[],"locations":[{"type":"absolute","value":4394365}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateMutexEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Threading.Mutex::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"check for protected handle exception":{"meta":{"name":"check for protected handle exception","namespace":"anti-analysis/anti-debugging/debugger-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Debugger Detection","SetHandleInformation"],"objective":"Anti-Behavioral Analysis","behavior":"Debugger Detection","method":"SetHandleInformation","id":"B0001.024"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp"],"examples":["al-khaser_x86.exe_:0x430D20"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: check for protected handle exception\n    namespace: anti-analysis/anti-debugging/debugger-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp\n    examples:\n      - al-khaser_x86.exe_:0x430D20\n  features:\n    - and:\n      - or:\n        - description: SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);\n        - basic block:\n          - and:\n            - count(number(2)): 2 or more\n            - api: SetHandleInformation\n        - call:\n          - and:\n            - count(number(2)): 2 or more\n            - api: SetHandleInformation\n      - api: CloseHandle\n","matches":[[{"type":"absolute","value":4304785},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"CloseHandle"}},"children":[],"locations":[{"type":"absolute","value":4394423}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or","description":"SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"basic block"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetHandleInformation"}},"children":[],"locations":[{"type":"absolute","value":4394397}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"range","min":2,"max":9223372036854775808,"child":{"type":"number","number":2}}},"children":[],"locations":[{"type":"absolute","value":4394389},{"type":"absolute","value":4394391}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4394387}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"check for protected handle exception/9e03e0d6682f4b48900d086faa1fddf2"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: query or enumerate registry value\n    namespace: host-interaction/registry\n    authors:\n      - william.ballenthin@mandiant.com\n      - michael.hunhoff@mandiant.com\n      - anushka.virgaonkar@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Value [C0036.006]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegGetValue\n        - api: advapi32.RegEnumValue\n        - api: advapi32.RegQueryValue\n        - api: advapi32.RegQueryValueEx\n        - api: advapi32.RegQueryMultipleValues\n        - api: ZwQueryValueKey\n        - api: ZwEnumerateValueKey\n        - api: NtQueryValueKey\n        - api: NtEnumerateValueKey\n        - api: RtlQueryRegistryValues\n        - api: SHGetValue\n        - api: SHEnumValue\n        - api: SHRegGetInt\n        - api: SHRegGetPath\n        - api: SHRegGetValue\n        - api: SHQueryValueEx\n        - api: SHRegGetUSValue\n        - api: SHOpenRegStream\n        - api: SHRegEnumUSValue\n        - api: SHOpenRegStream2\n        - api: SHRegQueryUSValue\n        - api: SHRegGetBoolUSValue\n        - api: SHRegGetValueFromHKCUHKLM\n        - api: SHRegGetBoolValueFromHKCUHKLM\n        - api: Microsoft.Win32.RegistryKey::GetValue\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\n        - api: Microsoft.Win32.Registry::GetValue\n","matches":[[{"type":"absolute","value":4305120},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyEx"}},"children":[],"locations":[{"type":"absolute","value":4479374}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4479264}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryValueEx"}},"children":[],"locations":[{"type":"absolute","value":4479419}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set application hook":{"meta":{"name":"set application hook","namespace":"host-interaction/gui","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"thread"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: set application hook\n    namespace: host-interaction/gui\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: thread\n    examples:\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\n  features:\n    - and:\n      - or:\n        - api: user32.SetWindowsHookEx\n        - api: user32.UnhookWindowsHookEx\n","matches":[[{"type":"absolute","value":4305765},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":4451860}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"log keystrokes via application hook":{"meta":{"name":"log keystrokes via application hook","namespace":"collection/keylog","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"call"},"attack":[{"parts":["Collection","Input Capture","Keylogging"],"tactic":"Collection","technique":"Input Capture","subtechnique":"Keylogging","id":"T1056.001"}],"mbc":[{"parts":["Collection","Keylogging","Application Hook"],"objective":"Collection","behavior":"Keylogging","method":"Application Hook","id":"F0002.001"}],"references":[],"examples":["Practical Malware Analysis Lab 12-03.exe_:0x401000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: log keystrokes via application hook\n    namespace: collection/keylog\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Collection::Input Capture::Keylogging [T1056.001]\n    mbc:\n      - Collection::Keylogging::Application Hook [F0002.001]\n    examples:\n      - Practical Malware Analysis Lab 12-03.exe_:0x401000\n  features:\n    - and:\n      - match: set application hook\n      - or:\n        - number: 13 = WH_KEYBOARD_LL\n        - number: 2  = WH_KEYBOARD\n","matches":[[{"type":"absolute","value":4305765},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"set application hook"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"SetWindowsHookEx"}},"children":[],"locations":[{"type":"absolute","value":4451860}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"UnhookWindowsHookEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"absolute","value":4305765}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":13,"description":"WH_KEYBOARD_LL"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"WH_KEYBOARD"}},"children":[],"locations":[{"type":"absolute","value":4451858}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings":{"meta":{"name":"reference anti-VM strings","namespace":"anti-analysis/anti-vm/vm-detection","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp"],"examples":["Practical Malware Analysis Lab 17-02.dll_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/ctxis/CAPE/blob/master/modules/signatures/antivm_*\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_\n  features:\n    - or:\n      - string: /HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i\n      - string: /HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i\n      - string: /HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i\n      - string: /SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i\n      - string: /A M I/i\n      - string: /Hyper-V/i\n      - string: /Kernel-VMDetection-Private/i\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L699\n      - string: /KVMKVMKVM/i\n        description: KVM\n      - string: /Microsoft Hv/i\n        description: Microsoft Hyper-V or Windows Virtual PC\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L8\n      - string: /avghookx.dll/i\n        description: AVG\n      - string: /avghooka.dll/i\n        description: AVG\n      - string: /snxhk.dll/i\n        description: Avast\n      - string: /pstorec.dll/i\n        description: SunBelt Sandbox\n      - string: /vmcheck.dll/i\n        description: Virtual PC\n      - string: /wpespy.dll/i\n        description: WPE Pro\n      - string: /cmdvrt64.dll/i\n        description: Comodo Container\n      - string: /cmdvrt32.dll/i\n        description: Comodo Container\n      # https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Generic.cpp#L46\n      - string: /sample.exe/i\n      - string: /bot.exe/i\n      - string: /sandbox.exe/i\n      - string: /malware.exe/i\n      - string: /test.exe/i\n      - string: /klavme.exe/i\n      - string: /myapp.exe/i\n      - string: /testapp.exe/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\(DSDT|FADT|RSDT)\\\\BOCHS/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\(SystemBiosVersion|VideoBiosVersion)/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\DEVICEMAP\\\\Scsi\\\\Scsi Port 0\\\\Scsi Bus 0\\\\Target Id 0\\\\Logical Unit Id 0/i"}},"children":[],"locations":[{"type":"file","value":264424}],"captures":{"HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0":[{"type":"file","value":264424}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Enum\\\\IDE/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Services\\\\Disk\\\\Enum\\\\/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\(CurrentControlSet|ControlSet001)\\\\Control\\\\SystemInformation\\\\SystemManufacturer/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/A M I/i"}},"children":[],"locations":[{"type":"file","value":262288}],"captures":{"A M I":[{"type":"file","value":262288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Hyper-V/i"}},"children":[],"locations":[{"type":"file","value":262916}],"captures":{"Hyper-V":[{"type":"file","value":262916}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Kernel-VMDetection-Private/i"}},"children":[],"locations":[{"type":"file","value":247632},{"type":"file","value":262936}],"captures":{"Checking NtQueryLicenseValue with Kernel-VMDetection-Private ":[{"type":"file","value":247632}],"Kernel-VMDetection-Private":[{"type":"file","value":262936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/KVMKVMKVM/i","description":"KVM"}},"children":[],"locations":[{"type":"file","value":261952}],"captures":{"KVMKVMKVM":[{"type":"file","value":261952}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Microsoft Hv/i","description":"Microsoft Hyper-V or Windows Virtual PC"}},"children":[],"locations":[{"type":"file","value":261984}],"captures":{"Microsoft Hv":[{"type":"file","value":261984}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghookx.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":260612}],"captures":{"avghookx.dll":[{"type":"file","value":260612}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/avghooka.dll/i","description":"AVG"}},"children":[],"locations":[{"type":"file","value":260644}],"captures":{"avghooka.dll":[{"type":"file","value":260644}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/snxhk.dll/i","description":"Avast"}},"children":[],"locations":[{"type":"file","value":260676}],"captures":{"snxhk.dll":[{"type":"file","value":260676}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/pstorec.dll/i","description":"SunBelt Sandbox"}},"children":[],"locations":[{"type":"file","value":260820}],"captures":{"pstorec.dll":[{"type":"file","value":260820}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmcheck.dll/i","description":"Virtual PC"}},"children":[],"locations":[{"type":"file","value":260848}],"captures":{"vmcheck.dll":[{"type":"file","value":260848}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/wpespy.dll/i","description":"WPE Pro"}},"children":[],"locations":[{"type":"file","value":260876}],"captures":{"wpespy.dll":[{"type":"file","value":260876}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt64.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":260904}],"captures":{"cmdvrt64.dll":[{"type":"file","value":260904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/cmdvrt32.dll/i","description":"Comodo Container"}},"children":[],"locations":[{"type":"file","value":260936}],"captures":{"cmdvrt32.dll":[{"type":"file","value":260936}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sample.exe/i"}},"children":[],"locations":[{"type":"file","value":261088}],"captures":{"sample.exe":[{"type":"file","value":261088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/bot.exe/i"}},"children":[],"locations":[{"type":"file","value":261116}],"captures":{"bot.exe":[{"type":"file","value":261116}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sandbox.exe/i"}},"children":[],"locations":[{"type":"file","value":261136}],"captures":{"sandbox.exe":[{"type":"file","value":261136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/malware.exe/i"}},"children":[],"locations":[{"type":"file","value":261164}],"captures":{"malware.exe":[{"type":"file","value":261164}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/test.exe/i"}},"children":[],"locations":[{"type":"file","value":261192}],"captures":{"test.exe":[{"type":"file","value":261192}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/klavme.exe/i"}},"children":[],"locations":[{"type":"file","value":261216}],"captures":{"klavme.exe":[{"type":"file","value":261216}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/myapp.exe/i"}},"children":[],"locations":[{"type":"file","value":261244}],"captures":{"myapp.exe":[{"type":"file","value":261244}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/testapp.exe/i"}},"children":[],"locations":[{"type":"file","value":261268}],"captures":{"testapp.exe":[{"type":"file","value":261268}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Parallels":{"meta":{"name":"reference anti-VM strings targeting Parallels","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting Parallels\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Parallels.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /Parallels/i\n      - string: /prl_cc.exe/i\n      - string: /prl_tools.exe/i\n      - string: /prl hyperv/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Parallels/i"}},"children":[],"locations":[{"type":"file","value":264328}],"captures":{"Checking Parallels processes: %s":[{"type":"file","value":264328}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_cc.exe/i"}},"children":[],"locations":[{"type":"file","value":264260}],"captures":{"prl_cc.exe":[{"type":"file","value":264260}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl_tools.exe/i"}},"children":[],"locations":[{"type":"file","value":264288}],"captures":{"prl_tools.exe":[{"type":"file","value":264288}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/prl hyperv/i"}},"children":[],"locations":[{"type":"file","value":262080}],"captures":{"prl hyperv  ":[{"type":"file","value":262080}]}}],"locations":[],"captures":{}}]]},"contain a thread local storage (.tls) section":{"meta":{"name":"contain a thread local storage (.tls) section","namespace":"executable/pe/section/tls","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 16-02.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contain a thread local storage (.tls) section\n    namespace: executable/pe/section/tls\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - Practical Malware Analysis Lab 16-02.exe_\n  features:\n    - section: .tls\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"section","section":".tls"}},"children":[],"locations":[{"type":"absolute","value":4743168}],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference analysis tools strings\n    namespace: anti-analysis\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    mbc:\n      - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /ollydbg(\\.exe)?/i\n      - string: /ProcessHacker(\\.exe)?/i\n      - string: /tcpview(\\.exe)?/i\n      - string: /autoruns(\\.exe)?/i\n      - string: /autorunsc(\\.exe)?/i\n      - string: /filemon(\\.exe)?/i\n      - string: /procmon(\\.exe)?/i\n      - string: /regmon(\\.exe)?/i\n      - string: /procexp(\\.exe)?/i\n      - string: /(?<!\\w)ida[gqtuw]?(\\.exe)?$/i\n      - string: /ida[gqtuw]?64(\\.exe)?$/i\n      - string: /ImmunityDebugger(\\.exe)?/i\n      - string: /Wireshark(\\.exe)?/i\n      - string: /dumpcap(\\.exe)?/i\n      - string: /HookExplorer(\\.exe)?/i\n      - string: /ImportREC(\\.exe)?/i\n      - string: /PETools(\\.exe)?/i\n      - string: /LordPE(\\.exe)?/i\n      - string: /SysInspector(\\.exe)?/i\n      - string: /proc_analyzer(\\.exe)?/i\n      - string: /sysAnalyzer(\\.exe)?/i\n      - string: /sniff_hit(\\.exe)?/i\n      - string: /windbg(\\.exe)?/i\n      - string: /joeboxcontrol(\\.exe)?/i\n      - string: /joeboxserver(\\.exe)?/i\n      - string: /ResourceHacker(\\.exe)?/i\n      - string: /x32dbg(\\.exe)?/i\n      - string: /x64dbg(\\.exe)?/i\n      - string: /Fiddler(\\.exe)?/i\n      - string: /httpdebugger(\\.exe)?/i\n      - string: /fakenet(\\.exe)?/i\n      - string: /netmon(\\.exe)?/i\n      - string: /WPE PRO(\\.exe)?/i\n      - string: /decompile(\\.exe)?/i\n      - string: /scylla/i\n      - string: /megadumper/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253136}],"captures":{"ollydbg.exe":[{"type":"file","value":253136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253164}],"captures":{"ProcessHacker.exe":[{"type":"file","value":253164}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253208}],"captures":{"tcpview.exe":[{"type":"file","value":253208}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253236},{"type":"file","value":253268}],"captures":{"autoruns.exe":[{"type":"file","value":253236}],"autorunsc.exe":[{"type":"file","value":253268}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253268}],"captures":{"autorunsc.exe":[{"type":"file","value":253268}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253304}],"captures":{"filemon.exe":[{"type":"file","value":253304}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253332}],"captures":{"procmon.exe":[{"type":"file","value":253332}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253360}],"captures":{"regmon.exe":[{"type":"file","value":253360}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253388}],"captures":{"procexp.exe":[{"type":"file","value":253388}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/(?<!\\w)ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":253416}],"captures":{"idaq.exe":[{"type":"file","value":253416}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?64(\\.exe)?$/i"}},"children":[],"locations":[{"type":"file","value":253440}],"captures":{"idaq64.exe":[{"type":"file","value":253440}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253468}],"captures":{"ImmunityDebugger.exe":[{"type":"file","value":253468}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253520}],"captures":{"Wireshark.exe":[{"type":"file","value":253520}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253556}],"captures":{"dumpcap.exe":[{"type":"file","value":253556}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253584}],"captures":{"HookExplorer.exe":[{"type":"file","value":253584}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253624}],"captures":{"ImportREC.exe":[{"type":"file","value":253624}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253660}],"captures":{"PETools.exe":[{"type":"file","value":253660}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253688}],"captures":{"LordPE.exe":[{"type":"file","value":253688}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253716}],"captures":{"SysInspector.exe":[{"type":"file","value":253716}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253756}],"captures":{"proc_analyzer.exe":[{"type":"file","value":253756}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253800}],"captures":{"sysAnalyzer.exe":[{"type":"file","value":253800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253840}],"captures":{"sniff_hit.exe":[{"type":"file","value":253840}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253876}],"captures":{"windbg.exe":[{"type":"file","value":253876}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253904}],"captures":{"joeboxcontrol.exe":[{"type":"file","value":253904}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253948}],"captures":{"joeboxserver.exe":[{"type":"file","value":253948}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":253988}],"captures":{"ResourceHacker.exe":[{"type":"file","value":253988}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254036}],"captures":{"x32dbg.exe":[{"type":"file","value":254036}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254064}],"captures":{"x64dbg.exe":[{"type":"file","value":254064}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254092}],"captures":{"Fiddler.exe":[{"type":"file","value":254092}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[{"type":"file","value":254120}],"captures":{"httpdebugger.exe":[{"type":"file","value":254120}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualPC":{"meta":{"name":"reference anti-VM strings targeting VirtualPC","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting VirtualPC\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualPC.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /VirtualPC/i\n      - string: /VMSrvc.exe/i\n      - string: /VMUSrvc.exe/i\n      - string: /SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualPC/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":269304}],"captures":{"VMSrvc.exe":[{"type":"file","value":269304}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMUSrvc.exe/i"}},"children":[],"locations":[{"type":"file","value":269332}],"captures":{"VMUSrvc.exe":[{"type":"file","value":269332}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Microsoft\\\\Virtual Machine\\\\Guest\\\\Parameters/i"}},"children":[],"locations":[{"type":"file","value":269448}],"captures":{"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters":[{"type":"file","value":269448}]}}],"locations":[],"captures":{}}]]},"contains PDB path":{"meta":{"name":"contains PDB path","namespace":"executable/pe/pdb","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":["464EF2CA59782CE697BC329713698CCC"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: contains PDB path\n    namespace: executable/pe/pdb\n    authors:\n      - moritz.raabe@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - 464EF2CA59782CE697BC329713698CCC  # level32.exe\n  features:\n    - string: /:\\\\.*\\.pdb/\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/:\\\\.*\\.pdb/"}},"children":[],"locations":[{"type":"file","value":291092}],"captures":{"C:\\Users\\spring\\Desktop\\al-khaser-master\\Debug\\al-khaser.pdb":[{"type":"file","value":291092}]}}]]},"reference anti-VM strings targeting Xen":{"meta":{"name":"reference anti-VM strings targeting Xen","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting Xen\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Xen.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /^Xen/i\n      - string: /XenVMMXenVMM/i\n      - string: /xenservice.exe/i\n      - string: /XenVMMXenVMM/i\n      - string: /HVM domU/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^Xen/i"}},"children":[],"locations":[{"type":"file","value":262048},{"type":"file","value":271872},{"type":"file","value":250956}],"captures":{"Xen Detection":[{"type":"file","value":250956}],"XenVMMXenVMM":[{"type":"file","value":262048}],"xenservice.exe":[{"type":"file","value":271872}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":262048}],"captures":{"XenVMMXenVMM":[{"type":"file","value":262048}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/xenservice.exe/i"}},"children":[],"locations":[{"type":"file","value":271872}],"captures":{"xenservice.exe":[{"type":"file","value":271872}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/XenVMMXenVMM/i"}},"children":[],"locations":[{"type":"file","value":262048}],"captures":{"XenVMMXenVMM":[{"type":"file","value":262048}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HVM domU/i"}},"children":[],"locations":[{"type":"file","value":262432}],"captures":{"HVM domU":[{"type":"file","value":262432}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VirtualBox":{"meta":{"name":"reference anti-VM strings targeting VirtualBox","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting VirtualBox\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VirtualBox.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /VBOX/i\n      - string: /VEN_VBOX/i\n      - string: /VirtualBox/i\n      - string: /06/23/99/i\n      - string: /HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i\n      - string: /HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i\n      - string: /HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i\n      - string: /SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i\n      - string: /SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i\n      - string: /VBoxMouse\\.sys/i\n      - string: /VBoxGuest\\.sys/i\n      - string: /VBoxSF\\.sys/i\n      - string: /VBoxVideo\\.sys/i\n      - string: /vboxdisp\\.dll/i\n      - string: /vboxhook\\.dll/i\n      - string: /vboxmrxnp\\.dll/i\n      - string: /vboxogl\\.dll/i\n      - string: /vboxoglarrayspu\\.dll/i\n      - string: /vboxoglcrutil\\.dll/i\n      - string: /vboxoglerrorspu\\.dll/i\n      - string: /vboxoglfeedbackspu\\.dll/i\n      - string: /vboxoglpackspu\\.dll/i\n      - string: /vboxoglpassthroughspu\\.dll/i\n      - string: /vboxservice\\.exe/i\n      - string: /vboxtray\\.exe/i\n      - string: /VBoxControl\\.exe/i\n      - string: /oracle\\\\virtualbox guest additions\\\\/i\n      - string: /\\\\\\\\.\\\\VBoxMiniRdrDN/i\n      - string: /\\\\\\\\.\\\\VBoxGuest/i\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i\n      - string: /\\\\\\\\.\\\\VBoxTrayIPC/i\n      - string: /\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i\n      - string: /VBoxTrayToolWndClass/i\n      - string: /VBoxTrayToolWnd/i\n      - string: /vboxservice\\.exe/i\n      - string: /vboxtray.exe/i\n      - string: /vboxvideo/i\n      - string: /VBoxVideoW8/i\n      - string: /VBoxWddm/i\n      - string: /PCI\\\\VEN_80EE&DEV_CAFE/i\n      - string: /82801FB/i\n      - string: /82441FX/i\n      - string: /82371SB/i\n      - string: /OpenHCD/i\n      - string: /ACPIBus_BUS_0/i\n      - string: /PCI_BUS_0/i\n      - string: /PNP_BUS_0/i\n      - string: /Oracle Corporation/i\n      - string: /VBoxWdd/i\n      - string: /VBoxS/i\n        description: VirtualBox Shared Folders\n      - string: /VBoxMouse/i\n        description: VirtualBox Guest Mouse\n      - string: /VBoxGuest/i\n        description: VirtualBox Guest Driver\n      - string: /VBoxVBoxVBox/i\n      - string: /innotek GmbH/i\n      - string: /drivers\\\\vboxdrv/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBOX/i"}},"children":[],"locations":[{"type":"file","value":250112},{"type":"file","value":265600},{"type":"file","value":265728},{"type":"file","value":261892},{"type":"file","value":266884},{"type":"file","value":264968},{"type":"file","value":265992},{"type":"file","value":266376},{"type":"file","value":268424},{"type":"file","value":267020},{"type":"file","value":266776},{"type":"file","value":267676},{"type":"file","value":264992},{"type":"file","value":266528},{"type":"file","value":267808},{"type":"file","value":268448},{"type":"file","value":267172},{"type":"file","value":265896},{"type":"file","value":266280},{"type":"file","value":267436},{"type":"file","value":267948},{"type":"file","value":266672},{"type":"file","value":249784},{"type":"file","value":267324},{"type":"file","value":249536},{"type":"file","value":265664},{"type":"file","value":267720},{"type":"file","value":267848},{"type":"file","value":268104},{"type":"file","value":266956},{"type":"file","value":266192},{"type":"file","value":266832},{"type":"file","value":266452},{"type":"file","value":249944},{"type":"file","value":267096},{"type":"file","value":265308},{"type":"file","value":268640},{"type":"file","value":262112},{"type":"file","value":264928},{"type":"file","value":268000},{"type":"file","value":266596},{"type":"file","value":266724},{"type":"file","value":269280},{"type":"file","value":268648},{"type":"file","value":266088},{"type":"file","value":267240},{"type":"file","value":267756},{"type":"file","value":268144},{"type":"file","value":128375},{"type":"file","value":264952},{"type":"file","value":267384}],"captures":{"szVBoxSources":[{"type":"file","value":128375}],"vbox":[{"type":"file","value":268640},{"type":"file","value":261892}],"VBOX":[{"type":"file","value":268648},{"type":"file","value":265308}],"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":249536}],"Checking Win32_PnPDevice DeviceId from WMI for VBox PCI device ":[{"type":"file","value":249784}],"Checking Win32_PnPDevice Name from WMI for VBox controller hardware ":[{"type":"file","value":249944}],"Checking Win32_PnPDevice Name from WMI for VBOX names ":[{"type":"file","value":250112}],"VBoxVBoxVBox":[{"type":"file","value":262112}],"VBoxWddm":[{"type":"file","value":264928}],"VBoxSF":[{"type":"file","value":264952}],"VBoxMouse":[{"type":"file","value":264968}],"VBoxGuest":[{"type":"file","value":264992}],"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":265600}],"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":265664}],"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":265728}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":265896}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":265992}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":266088}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":266192}],"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":266280}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":266376}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":266452}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":266528}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":266596}],"System32\\vboxdisp.dll":[{"type":"file","value":266672}],"System32\\vboxhook.dll":[{"type":"file","value":266724}],"System32\\vboxmrxnp.dll":[{"type":"file","value":266776}],"System32\\vboxogl.dll":[{"type":"file","value":266832}],"System32\\vboxoglarrayspu.dll":[{"type":"file","value":266884}],"System32\\vboxoglcrutil.dll":[{"type":"file","value":266956}],"System32\\vboxoglerrorspu.dll":[{"type":"file","value":267020}],"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":267096}],"System32\\vboxoglpackspu.dll":[{"type":"file","value":267172}],"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":267240}],"System32\\vboxservice.exe":[{"type":"file","value":267324}],"System32\\vboxtray.exe":[{"type":"file","value":267384}],"System32\\VBoxControl.exe":[{"type":"file","value":267436}],"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":267676}],"\\\\.\\VBoxGuest":[{"type":"file","value":267720}],"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":267756}],"\\\\.\\VBoxTrayIPC":[{"type":"file","value":267808}],"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":267848}],"VBoxTrayToolWndClass":[{"type":"file","value":267948}],"VBoxTrayToolWnd":[{"type":"file","value":268000}],"vboxservice.exe":[{"type":"file","value":268104}],"vboxtray.exe":[{"type":"file","value":268144}],"vboxvideo":[{"type":"file","value":268424}],"VBoxVideoW8":[{"type":"file","value":268448}],"VEN_VBOX":[{"type":"file","value":269280}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VEN_VBOX/i"}},"children":[],"locations":[{"type":"file","value":269280}],"captures":{"VEN_VBOX":[{"type":"file","value":269280}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VirtualBox/i"}},"children":[],"locations":[{"type":"file","value":265792},{"type":"file","value":267544},{"type":"file","value":262404},{"type":"file","value":249224},{"type":"file","value":268040},{"type":"file","value":268624},{"type":"file","value":249168},{"type":"file","value":265360},{"type":"file","value":268176},{"type":"file","value":249656}],"captures":{"VirtualBox":[{"type":"file","value":268624},{"type":"file","value":262404}],"VirtualBox Detection":[{"type":"file","value":249168}],"Checking VirtualBox Guest Additions directory ":[{"type":"file","value":249224}],"Checking VirtualBox Shared Folders network provider ":[{"type":"file","value":249656}],"VIRTUALBOX":[{"type":"file","value":265360}],"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":265792}],"oracle\\virtualbox guest additions\\":[{"type":"file","value":267544}],"VirtualBox Shared Folders":[{"type":"file","value":268040}],"Checking VirtualBox process %s ":[{"type":"file","value":268176}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/06/23/99/i"}},"children":[],"locations":[{"type":"file","value":265424}],"captures":{"06/23/99":[{"type":"file","value":265424}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\DSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":265600}],"captures":{"HARDWARE\\ACPI\\DSDT\\VBOX__":[{"type":"file","value":265600}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\FADT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":265664}],"captures":{"HARDWARE\\ACPI\\FADT\\VBOX__":[{"type":"file","value":265664}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HARDWARE\\\\ACPI\\\\RSDT\\\\VBOX__/i"}},"children":[],"locations":[{"type":"file","value":265728}],"captures":{"HARDWARE\\ACPI\\RSDT\\VBOX__":[{"type":"file","value":265728}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\Oracle\\\\VirtualBox Guest Additions/i"}},"children":[],"locations":[{"type":"file","value":265792}],"captures":{"SOFTWARE\\Oracle\\VirtualBox Guest Additions":[{"type":"file","value":265792}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":265896}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":265896}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxMouse/i"}},"children":[],"locations":[{"type":"file","value":265992}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":265992}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxService/i"}},"children":[],"locations":[{"type":"file","value":266088}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":266088}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxSF/i"}},"children":[],"locations":[{"type":"file","value":266192}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":266192}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SYSTEM\\\\ControlSet001\\\\Services\\\\VBoxVideo/i"}},"children":[],"locations":[{"type":"file","value":266280}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":266280}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266376}],"captures":{"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":266376}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266452}],"captures":{"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":266452}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxSF\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266528}],"captures":{"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":266528}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideo\\.sys/i"}},"children":[],"locations":[{"type":"file","value":266596}],"captures":{"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":266596}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxdisp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266672}],"captures":{"System32\\vboxdisp.dll":[{"type":"file","value":266672}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxhook\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266724}],"captures":{"System32\\vboxhook.dll":[{"type":"file","value":266724}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxmrxnp\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266776}],"captures":{"System32\\vboxmrxnp.dll":[{"type":"file","value":266776}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxogl\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266832}],"captures":{"System32\\vboxogl.dll":[{"type":"file","value":266832}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglarrayspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266884}],"captures":{"System32\\vboxoglarrayspu.dll":[{"type":"file","value":266884}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglcrutil\\.dll/i"}},"children":[],"locations":[{"type":"file","value":266956}],"captures":{"System32\\vboxoglcrutil.dll":[{"type":"file","value":266956}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglerrorspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267020}],"captures":{"System32\\vboxoglerrorspu.dll":[{"type":"file","value":267020}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglfeedbackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267096}],"captures":{"System32\\vboxoglfeedbackspu.dll":[{"type":"file","value":267096}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpackspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267172}],"captures":{"System32\\vboxoglpackspu.dll":[{"type":"file","value":267172}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxoglpassthroughspu\\.dll/i"}},"children":[],"locations":[{"type":"file","value":267240}],"captures":{"System32\\vboxoglpassthroughspu.dll":[{"type":"file","value":267240}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":268104},{"type":"file","value":267324}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":267324}],"vboxservice.exe":[{"type":"file","value":268104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":267384},{"type":"file","value":268144}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":267384}],"vboxtray.exe":[{"type":"file","value":268144}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxControl\\.exe/i"}},"children":[],"locations":[{"type":"file","value":267436}],"captures":{"System32\\VBoxControl.exe":[{"type":"file","value":267436}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/oracle\\\\virtualbox guest additions\\\\/i"}},"children":[],"locations":[{"type":"file","value":267544}],"captures":{"oracle\\virtualbox guest additions\\":[{"type":"file","value":267544}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxMiniRdrDN/i"}},"children":[],"locations":[{"type":"file","value":267676}],"captures":{"\\\\.\\VBoxMiniRdrDN":[{"type":"file","value":267676}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxGuest/i"}},"children":[],"locations":[{"type":"file","value":267720}],"captures":{"\\\\.\\VBoxGuest":[{"type":"file","value":267720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxMiniRdDN/i"}},"children":[],"locations":[{"type":"file","value":267756}],"captures":{"\\\\.\\pipe\\VBoxMiniRdDN":[{"type":"file","value":267756}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":267808}],"captures":{"\\\\.\\VBoxTrayIPC":[{"type":"file","value":267808}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\pipe\\\\VBoxTrayIPC/i"}},"children":[],"locations":[{"type":"file","value":267848}],"captures":{"\\\\.\\pipe\\VBoxTrayIPC":[{"type":"file","value":267848}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWndClass/i"}},"children":[],"locations":[{"type":"file","value":249536},{"type":"file","value":267948}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":249536}],"VBoxTrayToolWndClass":[{"type":"file","value":267948}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxTrayToolWnd/i"}},"children":[],"locations":[{"type":"file","value":249536},{"type":"file","value":267948},{"type":"file","value":268000}],"captures":{"Checking VBoxTrayToolWndClass / VBoxTrayToolWnd ":[{"type":"file","value":249536}],"VBoxTrayToolWndClass":[{"type":"file","value":267948}],"VBoxTrayToolWnd":[{"type":"file","value":268000}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxservice\\.exe/i"}},"children":[],"locations":[{"type":"file","value":268104},{"type":"file","value":267324}],"captures":{"System32\\vboxservice.exe":[{"type":"file","value":267324}],"vboxservice.exe":[{"type":"file","value":268104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxtray.exe/i"}},"children":[],"locations":[{"type":"file","value":267384},{"type":"file","value":268144}],"captures":{"System32\\vboxtray.exe":[{"type":"file","value":267384}],"vboxtray.exe":[{"type":"file","value":268144}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vboxvideo/i"}},"children":[],"locations":[{"type":"file","value":266280},{"type":"file","value":266596},{"type":"file","value":268424},{"type":"file","value":268448}],"captures":{"SYSTEM\\ControlSet001\\Services\\VBoxVideo":[{"type":"file","value":266280}],"System32\\drivers\\VBoxVideo.sys":[{"type":"file","value":266596}],"vboxvideo":[{"type":"file","value":268424}],"VBoxVideoW8":[{"type":"file","value":268448}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVideoW8/i"}},"children":[],"locations":[{"type":"file","value":268448}],"captures":{"VBoxVideoW8":[{"type":"file","value":268448}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWddm/i"}},"children":[],"locations":[{"type":"file","value":264928}],"captures":{"VBoxWddm":[{"type":"file","value":264928}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI\\\\VEN_80EE&DEV_CAFE/i"}},"children":[],"locations":[{"type":"file","value":268752}],"captures":{"PCI\\VEN_80EE&DEV_CAFE":[{"type":"file","value":268752}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82801FB/i"}},"children":[],"locations":[{"type":"file","value":268816}],"captures":{"82801FB":[{"type":"file","value":268816}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82441FX/i"}},"children":[],"locations":[{"type":"file","value":268836}],"captures":{"82441FX":[{"type":"file","value":268836}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/82371SB/i"}},"children":[],"locations":[{"type":"file","value":268856}],"captures":{"82371SB":[{"type":"file","value":268856}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/OpenHCD/i"}},"children":[],"locations":[{"type":"file","value":268876}],"captures":{"OpenHCD":[{"type":"file","value":268876}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ACPIBus_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":268956}],"captures":{"ACPIBus_BUS_0":[{"type":"file","value":268956}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PCI_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":268992}],"captures":{"PCI_BUS_0":[{"type":"file","value":268992}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/PNP_BUS_0/i"}},"children":[],"locations":[{"type":"file","value":269016}],"captures":{"PNP_BUS_0":[{"type":"file","value":269016}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Oracle Corporation/i"}},"children":[],"locations":[{"type":"file","value":269132}],"captures":{"Oracle Corporation":[{"type":"file","value":269132}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxWdd/i"}},"children":[],"locations":[{"type":"file","value":264928}],"captures":{"VBoxWddm":[{"type":"file","value":264928}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxS/i","description":"VirtualBox Shared Folders"}},"children":[],"locations":[{"type":"file","value":266192},{"type":"file","value":266528},{"type":"file","value":268104},{"type":"file","value":266088},{"type":"file","value":128375},{"type":"file","value":264952},{"type":"file","value":267324}],"captures":{"szVBoxSources":[{"type":"file","value":128375}],"VBoxSF":[{"type":"file","value":264952}],"SYSTEM\\ControlSet001\\Services\\VBoxService":[{"type":"file","value":266088}],"SYSTEM\\ControlSet001\\Services\\VBoxSF":[{"type":"file","value":266192}],"System32\\drivers\\VBoxSF.sys":[{"type":"file","value":266528}],"System32\\vboxservice.exe":[{"type":"file","value":267324}],"vboxservice.exe":[{"type":"file","value":268104}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxMouse/i","description":"VirtualBox Guest Mouse"}},"children":[],"locations":[{"type":"file","value":264968},{"type":"file","value":265992},{"type":"file","value":266376}],"captures":{"VBoxMouse":[{"type":"file","value":264968}],"SYSTEM\\ControlSet001\\Services\\VBoxMouse":[{"type":"file","value":265992}],"System32\\drivers\\VBoxMouse.sys":[{"type":"file","value":266376}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxGuest/i","description":"VirtualBox Guest Driver"}},"children":[],"locations":[{"type":"file","value":264992},{"type":"file","value":266452},{"type":"file","value":265896},{"type":"file","value":267720}],"captures":{"VBoxGuest":[{"type":"file","value":264992}],"SYSTEM\\ControlSet001\\Services\\VBoxGuest":[{"type":"file","value":265896}],"System32\\drivers\\VBoxGuest.sys":[{"type":"file","value":266452}],"\\\\.\\VBoxGuest":[{"type":"file","value":267720}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VBoxVBoxVBox/i"}},"children":[],"locations":[{"type":"file","value":262112}],"captures":{"VBoxVBoxVBox":[{"type":"file","value":262112}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/innotek GmbH/i"}},"children":[],"locations":[{"type":"file","value":262488}],"captures":{"innotek GmbH":[{"type":"file","value":262488}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/drivers\\\\vboxdrv/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting Qemu":{"meta":{"name":"reference anti-VM strings targeting Qemu","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting Qemu\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/Qemu.cpp\n    examples:\n      - al-khaser_x86.exe_\n  features:\n    - or:\n      - string: /Qemu/i\n      - string: /qemu-ga.exe/i\n      - string: /BOCHS/i\n      - string: /^BXPC/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Qemu/i"}},"children":[],"locations":[{"type":"file","value":264896},{"type":"file","value":261920},{"type":"file","value":264800},{"type":"file","value":262520},{"type":"file","value":250920},{"type":"file","value":264828},{"type":"file","value":264904}],"captures":{"qemu":[{"type":"file","value":264896},{"type":"file","value":261920}],"QEMU":[{"type":"file","value":264904},{"type":"file","value":262520}],"QEMU Detection":[{"type":"file","value":250920}],"qemu-ga.exe":[{"type":"file","value":264800}],"Checking qemu processes %s ":[{"type":"file","value":264828}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/qemu-ga.exe/i"}},"children":[],"locations":[{"type":"file","value":264800}],"captures":{"qemu-ga.exe":[{"type":"file","value":264800}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/BOCHS/i"}},"children":[],"locations":[{"type":"file","value":264912}],"captures":{"BOCHS":[{"type":"file","value":264912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/^BXPC/i"}},"children":[],"locations":[{"type":"file","value":264920}],"captures":{"BXPC":[{"type":"file","value":264920}]}}],"locations":[],"captures":{}}]]},"reference anti-VM strings targeting VMWare":{"meta":{"name":"reference anti-VM strings targeting VMWare","namespace":"anti-analysis/anti-vm/vm-detection","authors":["michael.hunhoff@mandiant.com","@johnk3r"],"scopes":{"static":"file","dynamic":"file"},"attack":[{"parts":["Defense Evasion","Virtualization/Sandbox Evasion","System Checks"],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","subtechnique":"System Checks","id":"T1497.001"}],"mbc":[{"parts":["Anti-Behavioral Analysis","Virtual Machine Detection"],"objective":"Anti-Behavioral Analysis","behavior":"Virtual Machine Detection","method":"","id":"B0009"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp"],"examples":["al-khaser_x86.exe_","b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: reference anti-VM strings targeting VMWare\n    namespace: anti-analysis/anti-vm/vm-detection\n    authors:\n      - michael.hunhoff@mandiant.com\n      - \"@johnk3r\"\n    scopes:\n      static: file\n      dynamic: file\n    att&ck:\n      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]\n    mbc:\n      - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]\n    references:\n      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiVM/VMWare.cpp\n    examples:\n      - al-khaser_x86.exe_\n      - b83480162ede09d4aa6d4850f9faa0a4c3834152752fd04cfdb22d647aa1f825:0x17D80\n  features:\n    - or:\n      - string: /VMWare/i\n      - string: /VMTools/i\n      - string: /SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i\n      - string: /vmnet\\.sys/i\n      - string: /vmmouse\\.sys/i\n      - string: /vmusb\\.sys/i\n      - string: /vm3dmp\\.sys/i\n      - string: /vmci\\.sys/i\n      - string: /vmhgfs\\.sys/i\n      - string: /vmmemctl\\.sys/i\n      - string: /vmx86\\.sys/i\n      - string: /vmrawdsk\\.sys/i\n      - string: /vmusbmouse\\.sys/i\n      - string: /vmkdb\\.sys/i\n      - string: /vmnetuserif\\.sys/i\n      - string: /vmnetadapter\\.sys/i\n      - string: /\\\\\\\\.\\\\HGFS/i\n      - string: /\\\\\\\\.\\\\vmci/i\n      - string: /vmtoolsd\\.exe/i\n      - string: /vmwaretray\\.exe/i\n      - string: /vmwareuser\\.exe/i\n      - string: /VGAuthService\\.exe/i\n      - string: /vmacthlp\\.exe/i\n      - string: /vmci/i\n        description: VMWare VMCI Bus Driver\n      - string: /vmhgfs/i\n        description: VMWare Host Guest Control Redirector\n      - string: /vmmouse/i\n      - string: /vmmemctl/i\n        description: VMWare Guest Memory Controller Driver\n      - string: /vmusb/i\n      - string: /vmusbmouse/i\n      - string: /vmx_svga/i\n      - string: /vmxnet/i\n      - string: /vmx86/i\n      - string: /VMwareVMware/i\n      - string: /vmGuestLib\\.dll/i\n      - string: /vmGuestLib\\.dll/i\n      - string: /Applications\\\\VMwareHostOpen\\.exe/i\n      - string: /vm3dgl\\.dll/i\n      - string: /vmdum\\.dll/i\n      - string: /vm3dver\\.dll/i\n      - string: /vmtray\\.dll/i\n      - string: /VMToolsHook\\.dll/i\n      - string: /vmmousever\\.dll/i\n      - string: /VmGuestLibJava\\.dll/i\n      - string: /vmscsi\\.sys/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMWare/i"}},"children":[],"locations":[{"type":"file","value":262016},{"type":"file","value":269572},{"type":"file","value":271752},{"type":"file","value":270216},{"type":"file","value":250672},{"type":"file","value":271760},{"type":"file","value":261904},{"type":"file","value":271536},{"type":"file","value":250804},{"type":"file","value":271220},{"type":"file","value":271572},{"type":"file","value":250712},{"type":"file","value":262236}],"captures":{"VMware":[{"type":"file","value":271752}],"VMWARE":[{"type":"file","value":271760},{"type":"file","value":269572}],"VMWare Detection":[{"type":"file","value":250672}],"Checking VMWare network adapter name ":[{"type":"file","value":250712}],"Checking VMWare directory ":[{"type":"file","value":250804}],"vmware":[{"type":"file","value":261904}],"VMwareVMware":[{"type":"file","value":262016}],"VMWare":[{"type":"file","value":262236}],"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":270216}],"VMWare\\":[{"type":"file","value":271220}],"vmwaretray.exe":[{"type":"file","value":271536}],"vmwareuser.exe":[{"type":"file","value":271572}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMTools/i"}},"children":[],"locations":[{"type":"file","value":271504}],"captures":{"vmtoolsd.exe":[{"type":"file","value":271504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/SOFTWARE\\\\VMware, Inc\\.\\\\VMware Tools/i"}},"children":[],"locations":[{"type":"file","value":270216}],"captures":{"SOFTWARE\\VMware, Inc.\\VMware Tools":[{"type":"file","value":270216}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnet\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270300}],"captures":{"System32\\drivers\\vmnet.sys":[{"type":"file","value":270300}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270364}],"captures":{"System32\\drivers\\vmmouse.sys":[{"type":"file","value":270364}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270436}],"captures":{"System32\\drivers\\vmusb.sys":[{"type":"file","value":270436}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dmp\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270500}],"captures":{"System32\\drivers\\vm3dmp.sys":[{"type":"file","value":270500}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270568}],"captures":{"System32\\drivers\\vmci.sys":[{"type":"file","value":270568}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270632}],"captures":{"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":270632}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270700}],"captures":{"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":270700}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270772}],"captures":{"System32\\drivers\\vmx86.sys":[{"type":"file","value":270772}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmrawdsk\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270836}],"captures":{"System32\\drivers\\vmrawdsk.sys":[{"type":"file","value":270836}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270912}],"captures":{"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":270912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmkdb\\.sys/i"}},"children":[],"locations":[{"type":"file","value":270988}],"captures":{"System32\\drivers\\vmkdb.sys":[{"type":"file","value":270988}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetuserif\\.sys/i"}},"children":[],"locations":[{"type":"file","value":271056}],"captures":{"System32\\drivers\\vmnetuserif.sys":[{"type":"file","value":271056}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmnetadapter\\.sys/i"}},"children":[],"locations":[{"type":"file","value":271136}],"captures":{"System32\\drivers\\vmnetadapter.sys":[{"type":"file","value":271136}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\HGFS/i"}},"children":[],"locations":[{"type":"file","value":271456}],"captures":{"\\\\.\\HGFS":[{"type":"file","value":271456}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/\\\\\\\\.\\\\vmci/i"}},"children":[],"locations":[{"type":"file","value":271480}],"captures":{"\\\\.\\vmci":[{"type":"file","value":271480}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtoolsd\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271504}],"captures":{"vmtoolsd.exe":[{"type":"file","value":271504}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwaretray\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271536}],"captures":{"vmwaretray.exe":[{"type":"file","value":271536}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmwareuser\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271572}],"captures":{"vmwareuser.exe":[{"type":"file","value":271572}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VGAuthService\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271608}],"captures":{"VGAuthService.exe":[{"type":"file","value":271608}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmacthlp\\.exe/i"}},"children":[],"locations":[{"type":"file","value":271652}],"captures":{"vmacthlp.exe":[{"type":"file","value":271652}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmci/i","description":"VMWare VMCI Bus Driver"}},"children":[],"locations":[{"type":"file","value":265016},{"type":"file","value":270568},{"type":"file","value":271480}],"captures":{"vmci":[{"type":"file","value":265016}],"System32\\drivers\\vmci.sys":[{"type":"file","value":270568}],"\\\\.\\vmci":[{"type":"file","value":271480}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmhgfs/i","description":"VMWare Host Guest Control Redirector"}},"children":[],"locations":[{"type":"file","value":270632},{"type":"file","value":265028}],"captures":{"vmhgfs":[{"type":"file","value":265028}],"System32\\drivers\\vmhgfs.sys":[{"type":"file","value":270632}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmouse/i"}},"children":[],"locations":[{"type":"file","value":265044},{"type":"file","value":270364}],"captures":{"vmmouse":[{"type":"file","value":265044}],"System32\\drivers\\vmmouse.sys":[{"type":"file","value":270364}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmemctl/i","description":"VMWare Guest Memory Controller Driver"}},"children":[],"locations":[{"type":"file","value":265064},{"type":"file","value":270700}],"captures":{"vmmemctl":[{"type":"file","value":265064}],"System32\\drivers\\vmmemctl.sys":[{"type":"file","value":270700}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusb/i"}},"children":[],"locations":[{"type":"file","value":265088},{"type":"file","value":270912},{"type":"file","value":270436},{"type":"file","value":265104}],"captures":{"vmusb":[{"type":"file","value":265088}],"vmusbmouse":[{"type":"file","value":265104}],"System32\\drivers\\vmusb.sys":[{"type":"file","value":270436}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":270912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmusbmouse/i"}},"children":[],"locations":[{"type":"file","value":265104},{"type":"file","value":270912}],"captures":{"vmusbmouse":[{"type":"file","value":265104}],"System32\\drivers\\vmusbmouse.sys":[{"type":"file","value":270912}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx_svga/i"}},"children":[],"locations":[{"type":"file","value":265132}],"captures":{"vmx_svga":[{"type":"file","value":265132}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmxnet/i"}},"children":[],"locations":[{"type":"file","value":265156}],"captures":{"vmxnet":[{"type":"file","value":265156}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmx86/i"}},"children":[],"locations":[{"type":"file","value":270772},{"type":"file","value":265172}],"captures":{"vmx86":[{"type":"file","value":265172}],"System32\\drivers\\vmx86.sys":[{"type":"file","value":270772}]}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMwareVMware/i"}},"children":[],"locations":[{"type":"file","value":262016}],"captures":{"VMwareVMware":[{"type":"file","value":262016}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmGuestLib\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Applications\\\\VMwareHostOpen\\.exe/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dgl\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmdum\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vm3dver\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmtray\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VMToolsHook\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmmousever\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/VmGuestLibJava\\.dll/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/vmscsi\\.sys/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read raw disk data":{"meta":{"name":"read raw disk data","namespace":"host-interaction/file-system","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[],"references":[],"examples":[],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n  meta:\n    name: read raw disk data\n    namespace: host-interaction/file-system\n    authors:\n      - william.ballenthin@mandiant.com\n    scopes:\n      static: file\n      dynamic: file\n  features:\n    - or:\n      - string: \"\\\\\\\\.\\\\PhysicalDrive0\"\n      - string: \"\\\\\\\\.\\\\C:\"\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\PhysicalDrive0"}},"children":[],"locations":[{"type":"file","value":261844}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"\\\\.\\C:"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}}